SploitXE_BEta.rar
- SHA256 e9c4cdb578c440ae2f25590d9ad7b155ae309d4f0cdc67c1f9528e070b30fac9
Behavioral task
behavioral1
Sample
SploitXE_BEta.rar
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
General
- Target SploitXE_BEta.rar
- Size 3.3MB
- Sample240617-vhsf2swfke
- SHA256 e9c4cdb578c440ae2f25590d9ad7b155ae309d4f0cdc67c1f9528e070b30fac9
- MD5 68f23738f5bf5e2612eb02d5e1526b8a
- SHA1 f59898686617dab7a596f5c452e4a38d90b90449
- SHA512 3897abe5798c11bbe8ca45c59c1a73d055313bc41b42ef7feba9a504f01d7fa155d4a7b26193c51cbb1ccc245305ad71f7c900dbee15316261d09f997119bcb2
- SSDEEP 98304:oEc3CcFLpIlSZfA9l0N4MRpJ7BwsE60b81jvO:+lVugOlCRpJ7BwsEGZm
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- AgentTesla payload 1 IoCs
resource yara_rule static1/unpack001/SploitXE BEta/Guna.UI2.dll family_agenttesla - Agenttesla family
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/SploitXE BEta/SploitXE.exe unpack001/SploitXE BEta/rbxfpsunlocker.exe unpack002/$PLUGINSDIR/AdvSplash.dll unpack002/$PLUGINSDIR/StartMenu.dll unpack002/$PLUGINSDIR/System.dll unpack002/$SYSDIR/frapsv64.dll unpack002/$SYSDIR/frapsvid.dll unpack002/frapslcd.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/SploitXE BEta/setup.exe nsis_installer_1 static1/unpack001/SploitXE BEta/setup.exe nsis_installer_2
File Explorer
-
SploitXE_BEta.rar.rar 3.3MB
-
SploitXE BEta/Guna.UI2.dll.dll 2.1MB
-
SploitXE BEta/SploitXE.exe.exe 59KB
-
SploitXE BEta/SploitXE.exe.config189B
-
SploitXE BEta/SploitXE.pdb51KB
-
SploitXE BEta/rbxfpsunlocker.exe.exe 605KB
-
SploitXE BEta/setup.exe.exe 2.4MB
-
$PLUGINSDIR/AdvSplash.dll.dll 6KB
-
$PLUGINSDIR/StartMenu.dll.dll 7KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$SYSDIR/frapsv64.dll.dll 103KB
-
$SYSDIR/frapsvid.dll.dll 92KB
-
$TEMP/beepa.bmp386KB
-
HELP/help_fps.htm.html 546B
-
HELP/help_general.htm.html 550B
-
HELP/help_movies.htm.html 549B
-
HELP/help_screenshots.htm.html 554B
-
README.HTM.html 1KB
-
changes.txt27KB
-
fraps.exe.exe 2.5MB
-
fraps32.dll.dll 263KB
-
fraps64.dat.exe 112KB
-
fraps64.dll.dll 224KB
-
frapslcd.dll.dll 170KB
-
uninstall.exe.nsis1KB
SploitXE BEta/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82
- MD5 c19e9e6a4bc1b668d19505a0437e7f7e
- SHA1 73be712aef4baa6e9dabfc237b5c039f62a847fa
- SHA512 b6cd0af436459f35a97db2d928120c53d3691533b01e4f0e8b382f2bd81d9a9a2c57e5e2aa6ade9d6a1746d5c4b2ef6c88d3a0cf519424b34445d0d30aab61de
- SSDEEP 49152:6QNztBO2+VN7N3HtnPhx70ZO4+CPXOn5PThDH2TBeHjvjiBckYf+Yh/FJ3:6Ahck2z
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla payload
PE Signature issue
Digest
47:b4:cf:f5:c2:a1:e0:36:e9:3f:b8:c2:44:a0:df:33:c2:26:10:62
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Nov 25, 2023
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Minor OS version
0
Major OS version
4
Entry point
2159838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SploitXE BEta/SploitXE.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f8fd35f40cf45e0332813d5ac555663c6d041256120d6e0fd0300d7b677379e1
- MD5 8f53627c43fe6a510a9fc17a7a50c348
- SHA1 813323918300c83c8878a043db0631b1d156f07a
- SHA512 f4e0f4e3cf8833b9caab846e16558b882905d2cf5d0f037aa15cbe818f33052236780aea4c5e84eafc61333e63decfe64c694f1536117d39001a2e39f8f58c11
- SSDEEP 768:QUNFDR8oN3NmUqVLVbXrhsPWHrdRpfO4HjCMLpPd0:lR8oN3c3O0rdRpfO4DpLdd0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
66002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Ludwig\OneDrive\Skrivbord\kirph\kirph\obj\Debug\kirph.pdb
mscoree
_CorExeMain
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SploitXE BEta/SploitXE.exe.config
- SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
- MD5 9dbad5517b46f41dbb0d8780b20ab87e
- SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
- SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
- MD5 SHA1 SHA512
SploitXE BEta/SploitXE.pdb
- SHA256 d8d5e239642dd32821e9088676cf5a0c262cdf423653902a62863b14240963fa
- MD5 0683712542db9ef9e3a5dcb4fcffa58a
- SHA1 b90e7691b131f7a984132da0733e15b3a6b96b29
- SHA512 e317cce6f56fde7860f1a1e2a1a46058c4205d0e08b988aef4cb856bbea7f6b66cb38a3640710f04dd8ee2abb3cc4779fff11afe81e7edb713a554b3260c348a
- SSDEEP 768:Gz5OcN5O6st02XVxyAriNsQBdGbst02uC2:Gm7y2doGzz
- MD5 SHA1 SHA512 SSDEEP
SploitXE BEta/rbxfpsunlocker.exe
- IMPHASH b67b812388a1094acd5db594749b4971
- SHA256 83dfcb08ea4aa1b857d952a8a177db775d1a7e9cfc30b528848a4a29c8dbf0b9
- MD5 09d083f0e2c1e8a3561209902333ad8f
- SHA1 d9692d3aba34a39aeb9e53cb3d25562b94e2e597
- SHA512 c71371263cacc4872a4bf621614940f08c9436062683be5de921ae6e509079e25ea380623e8945d40858819a664bd76590defb2a89949e8e5666190f1024ca6b
- SSDEEP 12288:IKOjJsDc2+WC+D+4H/xeGofENaTSuGCC709:IKyacgDD+4fwG1NaTSw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
211056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\rbxfpsunlocker\rbxfpsunlocker\x64\Release\rbxfpsunlocker.pdb
kernel32
GetProcessId
CreateMutexA
DuplicateHandle
OpenProcess
Sleep
GetLastError
CloseHandle
ReadProcessMemory
VirtualQueryEx
GetExitCodeProcess
Process32First
CreateToolhelp32Snapshot
QueryFullProcessImageNameA
Process32Next
Module32FirstW
Module32NextW
IsWow64Process
SetConsoleTitleA
TerminateThread
FreeConsole
CreateThread
GetConsoleWindow
AllocConsole
GetStdHandle
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
SetConsoleTextAttribute
GetCurrentProcess
GetConsoleScreenBufferInfo
SetEndOfFile
WriteProcessMemory
LCMapStringW
HeapFree
HeapAlloc
GetFileType
SetFilePointerEx
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
WriteFile
GetFileSizeEx
RtlUnwind
user32
EnumWindows
GetWindowTextA
MessageBoxA
IsWindowVisible
GetSystemMenu
GetMessageA
CheckMenuRadioItem
DispatchMessageA
LoadCursorA
CreatePopupMenu
TrackPopupMenu
ShowWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
LoadIconA
AppendMenuA
CheckMenuItem
PostQuitMessage
EnableMenuItem
RegisterClassExA
SetForegroundWindow
GetCursorPos
GetWindowThreadProcessId
gdi32
GetStockObject
advapi32
RegOpenKeyExA
RegQueryValueExA
shell32
Shell_NotifyIconA
ShellExecuteA
SHGetKnownFolderPath
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
Name
.text
Size
367KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=177, id=261, version=30795,
count=18, id=260, version=30795,
count=17, id=260, version=32533,
count=10, id=259, version=32533,
count=88, id=261, version=32533,
count=1, id=262, version=30795,
count=13, id=257, version=30795,
count=206, id=1, productName=Unmarked objects,
count=6, id=265, version=32825,
count=1, id=255, version=32825,
count=1, id=151,
count=1, id=258, version=32825,
SploitXE BEta/setup.exe
- IMPHASH 099c0646ea7282d232219f8807883be0
- SHA256 7213f30970c9764e1e0f85f15125f9241cf2619fb4724d322b5fe6f8ee3d9da0
- MD5 d1be561690e1d91e515faf9581cf81a6
- SHA1 9fed9a02c3845ca78bd72319bbfcf5140e64a36a
- SHA512 919e7bd14b65bf4fc778ce3409a92fdb5a59516cdb43d5dd3626ff2d18be9389951a289afe7453aeb6f8b9e314007c007a6f3bb7137f4fd167ce5688cebf28f5
- SSDEEP 49152:Ytavs+rX1wXzrf7XC4yY86lG8mFMRkoma4ftd0B8K4QH9SsmHFDTWU:Yn+j1wHzyb38mORkdtdCzdSsmHRTn
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Digest
c9:aa:51:4a:92:06:c0:31:51:b9:d0:42:1e:42:f0:b2:f5:d1:a4:e8:4e:7b:2e:18:b1:2b:fa:29:6f:c5:b1:fe
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Chains
Aug 30, 2019
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Digest
bb:7d:dd:16:3f:cd:e2:02:ad:1f:4f:e0:81:61:80:ec:cd:66:eb:d7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Chains
Aug 30, 2019
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 27, 2011 - May 30, 2020
Subject
CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Issuer
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - May 30, 2020
Subject
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Serial Number
b8:b9:96:66:79:19:d0:c0:55:ef:5a:f3:55:8f:09:d2
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 20, 2019 - Aug 19, 2020
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Serial Number
b8:b9:96:66:79:19:d0:c0:55:ef:5a:f3:55:8f:09:d2
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 20, 2019 - Aug 19, 2020
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Aug 1, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
12860
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/AdvSplash.dll
- IMPHASH 741b6bafe355b63a372d737b30543a95
- SHA256 eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
- MD5 13cc92f90a299f5b2b2f795d0d2e47dc
- SHA1 aa69ead8520876d232c6ed96021a4825e79f542f
- SHA512 ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3
- SSDEEP 96:6hNSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpPwoS:JXIpzTSd1BSk/kJtWpP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4448
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpynA
GetVersion
lstrcpyA
lstrcatA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
user32
LoadCursorA
RegisterClassA
SetWindowPos
SetWindowLongA
SystemParametersInfoA
EndPaint
GetClientRect
BeginPaint
DefWindowProcA
DestroyWindow
LoadImageA
CreateWindowExA
IsWindow
GetMessageA
DispatchMessageA
UnregisterClassA
wsprintfA
PostMessageA
SetWindowRgn
EnumDisplaySettingsA
gdi32
CombineRgn
CreateRectRgn
GetDIBits
SelectObject
CreateCompatibleDC
GetObjectA
DeleteDC
BitBlt
DeleteObject
winmm
timeSetEvent
PlaySoundA
timeKillEvent
show
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=1, productName=Unmarked objects,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/StartMenu.dll
- IMPHASH a648aeaa164b592c1e8892a10400b5ae
- SHA256 7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
- MD5 a4173b381625f9f12aadb4e1cdaefdb8
- SHA1 cf1680c2bc970d5675adbf5e89292a97e6724713
- SHA512 fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
- SSDEEP 96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6391
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleA
lstrcatA
FindClose
FindNextFileA
MulDiv
GlobalFree
lstrcpynA
GlobalAlloc
lstrcmpiA
FindFirstFileA
lstrcpyA
user32
TranslateMessage
GetMessageA
IsDialogMessageA
PostMessageA
DispatchMessageA
GetWindowLongA
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
IsDlgButtonChecked
GetWindowTextA
DestroyWindow
GetDlgItem
CreateDialogParamA
SetWindowLongA
wsprintfA
CallWindowProcA
gdi32
GetTextMetricsA
SelectObject
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32
CoTaskMemFree
Init
Select
Show
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
518B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=1, productName=Unmarked objects,
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/System.dll
- IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10544
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=42, version=8803,
count=4, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$SYSDIR/frapsv64.dll
- IMPHASH cef4b21c53f78138c51f40a3490d2038
- SHA256 bf12399f4e00cadf27c1207d20ff7be2a8895a5f8385caa48a75364ed3b75796
- MD5 2e5bfef71637ac61c0b96c4e1b5ef2d8
- SHA1 56af94478781b036161c5c5f7fe27d483c62ea48
- SHA512 80615b8a4e62c3d9875d79652831abbb3f17df0122b50a5c9857d8f13062475ef3e3e4f5bb19cbfa4cd75b2d19e82b229e0702b12a0876473bb8cd9a7f38c16c
- SSDEEP 3072:qf8rrdZ7TMD0ms8Drf6FGOLWT483lMYbN0h4sf:jTHmrf6FGOSU83B0Cs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
20540
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
winmm
DefDriverProc
kernel32
TlsFree
FlushFileBuffers
IsBadReadPtr
GetCurrentProcess
WaitForSingleObject
SetEvent
VirtualFree
TerminateThread
CreateEventA
IsProcessorFeaturePresent
IsBadWritePtr
VirtualAlloc
ResetEvent
GetModuleFileNameA
GetProcessAffinityMask
CloseHandle
CreateThread
GetCurrentThread
SetThreadPriority
WaitForMultipleObjects
HeapSize
OutputDebugStringW
WriteConsoleW
IsDebuggerPresent
GetCommandLineA
GetCurrentThreadId
EncodePointer
DecodePointer
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetLastError
SetLastError
MultiByteToWideChar
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
CreateFileW
GetStartupInfoW
GetModuleHandleW
GetProcAddress
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
LCMapStringW
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetModuleFileNameW
LoadLibraryExW
HeapAlloc
HeapReAlloc
SetStdHandle
user32
EnumDisplaySettingsA
MessageBoxA
DriverProc
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=225, version=20806,
count=106, id=224, version=20806,
count=8, id=223, version=20806,
count=7, id=203, version=65501,
count=94, id=1, productName=Unmarked objects,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=9, id=229, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
$SYSDIR/frapsvid.dll
- IMPHASH 8bd657e3a2aec874ff7b8761afab1713
- SHA256 9246354e999750b19f8e16314d7e64f072a705adb03dc2aa55742c03454761de
- MD5 88be8fce67c977fa48e0105990779137
- SHA1 f6785cb9d91f125704b69807e3bd17e18d1695c5
- SHA512 a71dd611f7e13ef56c2f6365a5ad5a632e4351a2ac8efeeb9c6344b9348032a3dc52e2cfe9eec1db10fcb2595ce89cb86be40089eb34f6b3a9a7344cffb58b7e
- SSDEEP 1536:yxOxmRqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq+9H+3mKwvmAiUj9IIyQMjH2LNkdT:yxOxwqqqqqqqqqqqqqqqqqqqqqqqqqqh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
22181
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
winmm
DefDriverProc
kernel32
FlushFileBuffers
IsBadReadPtr
GetCurrentProcess
WaitForSingleObject
SetEvent
VirtualFree
TerminateThread
CreateEventA
IsProcessorFeaturePresent
IsBadWritePtr
VirtualAlloc
ResetEvent
GetModuleFileNameA
GetProcessAffinityMask
CloseHandle
CreateThread
GetCurrentThread
SetThreadPriority
WaitForMultipleObjects
HeapSize
OutputDebugStringW
WriteConsoleW
IsDebuggerPresent
GetCommandLineA
GetCurrentThreadId
EncodePointer
DecodePointer
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetLastError
SetLastError
MultiByteToWideChar
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CreateFileW
GetModuleHandleW
GetProcAddress
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
LCMapStringW
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
HeapAlloc
HeapReAlloc
SetStdHandle
user32
EnumDisplaySettingsA
MessageBoxA
DriverProc
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=225, productName=VS2013 build 21005, version=21005,
count=18, id=223, productName=VS2013 build 21005, version=21005,
count=109, id=224, productName=VS2013 build 21005, version=21005,
count=7, id=203, version=65501,
count=91, id=1, productName=Unmarked objects,
count=9, id=229, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
$TEMP/beepa.bmp
- SHA256 0bf79b0b07c1da6b6183da39378b32953d7e5c3ba42449a03ec742b597c5c181
- MD5 1ac1185d0e10ef4d48f5ee334b4c6a6d
- SHA1 611dd2b48b544522c93320ed1dc8f74bdce63b29
- SHA512 b8d312f5b289e7a28a1d45f6c074b0935e15bbbe7df047b287e46e2395b53a333a86e02ff27aecfd7812cbf9acce0c8616287fca0b5f49832505206790fd200b
- SSDEEP 768:IGGqTq9W1NiUvU/fFuEVBnCstGxxYDLfdWVU+:IGHeWumU3FuEVBnCstGTYnfUVU+
- MD5 SHA1 SHA512 SSDEEP
HELP/help_fps.htm
- SHA256 b1419a421ea79de26a910c941c72d8eef7f97f42e55c28e8f7df9d31be3a0889
- MD5 f335e9e4e8a45c7dcfc30b5b8b61d838
- SHA1 cbaa325097d7c203d7c875325a79de76f60e4d3e
- SHA512 4f7d27ede6eb61ba7d656d44d1c442e1ac9db016f1278c67afcf6f4674ea3786d1f77f0cef1930f0f07e0db587c11ba79f652916b96b2e1995ed89f27762290b
- MD5 SHA1 SHA512
HELP/help_general.htm
- SHA256 731aa299a4024b9574282c12ff9385b6bc972a360d327633259c5bfff7bd8b86
- MD5 ca2111dcbc54a05e596894f3b0b3e453
- SHA1 4f22bd6da136ed717e06cc7abbb7d4995fbcaa02
- SHA512 83a76b771711ef883de7808f0f5e9143614554bb6b82f810e3ffe0b936bb51ebcadd14df725869beed3cfe5dda122f57412a10d114eea79821d84c12c9bbb2cf
- MD5 SHA1 SHA512
HELP/help_movies.htm
- SHA256 241da611a040ed0d1b9e51d92eaa7ef7f9821cd1bcbfcbc6759db2babc4d6881
- MD5 28ae0688b33354b80e4d29d980d648a3
- SHA1 69fa776c403f75ce5961f04f9ac2b25479d6a17b
- SHA512 d9e00c72a1bbfbb5376a65fd98335346593765bea0a7c7739d5b927e863ee54cc7a93b397e8c745a48bf9ef51cd9b56228ed0f3f76844298c7779dc5459397be
- MD5 SHA1 SHA512
HELP/help_screenshots.htm
- SHA256 b2bebc38395e4678c78af793b1c5ad214a3f832fbe860dedb0d8db36118350fe
- MD5 834e553c909b7600700f25fcdfe8046a
- SHA1 3d8a844cd24e519f73e6e14c83464ca801188aa5
- SHA512 245dce23051e67dc786ef07bb0dcdc2c98bcad859bc4b4bc522a64b72db28a7d0fb657df7b27a7d0f3ab7612a11275ba04307847eb7836917b39d25517221205
- MD5 SHA1 SHA512
README.HTM
- SHA256 68030a6f628f860115432c4ab704d8a8cd6b7a511b09c63f1c0c59e35c38a00d
- MD5 5d333847ea3381ede70b2e44ee020416
- SHA1 ac04265c3e1af4222c417216282ce16a7b63c5a1
- SHA512 a0fd61dd88d9961903f53c82adaae503acce8c1ef8e8505a07b0245d629ec8eedc946961bf8ae6d9f631f2f9ef950a7cda8ab697c2102451807185d7d4c23bec
- MD5 SHA1 SHA512
changes.txt
- SHA256 a9efa59f631e97b1e0afadde3722531b45b0565ff2e71f920073fb5485808e31
- MD5 ec966f0695144d69258c2431d182cb6b
- SHA1 02e0f81080d4c6b5e2fd60029b4c058b82065155
- SHA512 a34e5fdd8e57f3173bdd701a050fb211dafad3cb556d5d66850a9f8dfd0f85e7f607559626cc8cb0053c1e2a7535849f98eae03cfa4477c48147d00fe75e0747
- SSDEEP 768:DEFJIroNZpnWGYZyAUdCEY4Wd3fZQT7WlTqREGr7id7BTUvOYsMYiDn:D0skSE72h85
- MD5 SHA1 SHA512 SSDEEP
fraps.exe
- IMPHASH 2eabe9054cad5152567f0699947a2c5b
- SHA256 da7f61f2b04266a2ae897a0b001e721f1920cb579d5e08a8e5930a79c5d2fb80
- MD5 0ff5b5161a78bf5721811779376db71d
- SHA1 35308429117b514237d34bd8015bfe4efa8e7d55
- SHA512 d701440fa49f287a9631c8fb98cef5ea89b4f135901519d3ff3c45d0a7b8c464901514078bcf5ea8d2ffd23dbc7e30816ec0beaf06a531af045fdd1f5aec0204
- SSDEEP 49152:FE2Bj+HwlrUcObnP6q8m7X3wYdurAFfCUOvtig+wf0PUVKje/rJFz6:r9+MrpObnPH851rNUOV/+wIngFz6
- MD5 SHA1 SHA512 SSDEEP
Digest
86:83:28:a3:ab:f8:76:8a:84:91:fb:a6:20:df:84:ca:12:4b:97:db:17:07:ff:96:38:de:cc:d5:ca:0c:58:36
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Chains
Aug 30, 2019
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Digest
7c:e7:bf:2f:7e:bd:48:b2:c3:e2:1e:cc:58:19:6a:45:83:85:64:d1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Chains
Aug 30, 2019
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 27, 2011 - May 30, 2020
Subject
CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Issuer
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - May 30, 2020
Subject
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Serial Number
b8:b9:96:66:79:19:d0:c0:55:ef:5a:f3:55:8f:09:d2
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 20, 2019 - Aug 19, 2020
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Serial Number
b8:b9:96:66:79:19:d0:c0:55:ef:5a:f3:55:8f:09:d2
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 20, 2019 - Aug 19, 2020
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Aug 1, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
5
Entry point
8396800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpy
Name
Size
94KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.0MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
dnwaofmj
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
utdrwcfv
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=36, id=225, productName=VS2013 build 21005, version=21005,
count=21, id=223, productName=VS2013 build 21005, version=21005,
count=127, id=224, productName=VS2013 build 21005, version=21005,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=232, id=1, productName=Unmarked objects,
count=28, id=229, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
fraps32.dll
- IMPHASH 901cf2a321aa7eb39bd863e73e1f8add
- SHA256 e800f37cb2efa8ba13a25278cdd578dae4a2c86d23d4247349673160b0301e4f
- MD5 6328007efe11f2ad0a50f122367ce743
- SHA1 3f48580a32d0c5cd2551dcbcbce885c9337ce044
- SHA512 67d38b4dadecf020d1dc1e567327b5c0ebb72391448956e3e5a99943b6552851a94236d407da47c70abeed841898d2681382d78c522a40f28f22bbb654f7a8ec
- SSDEEP 6144:4DOK/Uddz0HzTLcy2q5lylI/QkvD8q6LkWhFOlHg:bK/Uddz0Hzncy2q5lylI/QkvD81kWalA
- MD5 SHA1 SHA512 SSDEEP
Digest
b2:cf:b7:81:14:15:7e:ef:f7:18:28:3d:9d:52:b0:73:40:d7:e6:b4:16:9a:5f:1a:55:80:06:fd:63:92:bd:f3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Chains
Aug 30, 2019
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Digest
c4:51:5d:28:1d:9a:28:2b:2f:d6:65:55:4a:05:ff:3b:a0:13:1d:af
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Chains
Aug 30, 2019
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 27, 2011 - May 30, 2020
Subject
CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Issuer
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - May 30, 2020
Subject
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Serial Number
b8:b9:96:66:79:19:d0:c0:55:ef:5a:f3:55:8f:09:d2
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 20, 2019 - Aug 19, 2020
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Serial Number
b8:b9:96:66:79:19:d0:c0:55:ef:5a:f3:55:8f:09:d2
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 20, 2019 - Aug 19, 2020
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Aug 1, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
162186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualAlloc
VirtualFree
GetModuleHandleA
CloseHandle
GetCurrentProcessId
GetSystemDirectoryA
GetVersionExA
MapViewOfFileEx
UnmapViewOfFile
DisableThreadLibraryCalls
GetSystemInfo
GetProcAddress
OpenFileMappingA
SetEvent
WaitForSingleObject
CreateMutexA
FreeLibrary
LoadLibraryA
WriteConsoleW
SetFilePointerEx
GetModuleFileNameA
IsBadReadPtr
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
RtlUnwind
VirtualQuery
EncodePointer
IsDebuggerPresent
DecodePointer
GetLastError
SetLastError
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
HeapFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
WriteFile
GetModuleFileNameW
LoadLibraryExW
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
CreateFileW
user32
CallNextHookEx
gdi32
DeleteObject
FrapsCount
FrapsFunc
FrapsKey
FrapsProcCALLWND
FrapsProcCBT
FrapsSetup
FrapsSharedData
FrapsVersion
Name
.text
Size
195KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=225, productName=VS2013 build 21005, version=21005,
count=18, id=223, productName=VS2013 build 21005, version=21005,
count=104, id=224, productName=VS2013 build 21005, version=21005,
count=7, id=257, version=26715,
count=93, id=1, productName=Unmarked objects,
count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=21, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
fraps64.dat
- IMPHASH ad82390a62dede519dea4dbfc7b3c581
- SHA256 a62a9241f3bf39176956d6fa45cec7a9aae12908c7156e4b533b81d35e902a9e
- MD5 79856998086dec03fa34a614708ae1e2
- SHA1 f858dd68780063527953aeccdcbfc955b3ea2cb9
- SHA512 ca63ea0f8f269b957efa65faf4c836133c93cbe38b76f5c0117bdb3e9a1719ef1b1943a9a3f2f7e51e31e08fdc0a02b24233baaa12aa6087112db9b4b7bb7f48
- SSDEEP 3072:XcH4TH6vYjeTtyvsfGIBrYUYAv4tYRfNNgS:XcYTyYjUUKGIBEFE4+f3
- MD5 SHA1 SHA512 SSDEEP
Digest
c2:bb:2e:14:14:78:97:03:fa:e7:9f:16:22:55:15:97:d6:1f:e5:09:62:b6:2e:d1:40:67:f2:a3:e2:c7:c2:a9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Chains
Aug 30, 2019
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Digest
3d:9c:c8:76:cc:38:5a:e9:fa:4f:06:fd:62:f8:ee:43:3f:f3:87:e9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Chains
Aug 30, 2019
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 27, 2011 - May 30, 2020
Subject
CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Issuer
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - May 30, 2020
Subject
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Serial Number
b8:b9:96:66:79:19:d0:c0:55:ef:5a:f3:55:8f:09:d2
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 20, 2019 - Aug 19, 2020
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Serial Number
b8:b9:96:66:79:19:d0:c0:55:ef:5a:f3:55:8f:09:d2
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 20, 2019 - Aug 19, 2020
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Aug 1, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
2
Major OS version
5
Entry point
13080
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
FreeLibrary
MapViewOfFileEx
GetCurrentProcess
Sleep
GetSystemDirectoryA
GetLastError
GetProcAddress
LoadLibraryA
GetModuleFileNameA
CreateMutexA
GetProcessAffinityMask
GetVersionExA
CloseHandle
OpenFileMappingA
UnmapViewOfFile
GetModuleHandleA
QueryPerformanceCounter
LCMapStringW
HeapSize
HeapReAlloc
HeapAlloc
GetStringTypeW
SetProcessAffinityMask
ExitProcess
FlushFileBuffers
ReadProcessMemory
TlsAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
EncodePointer
DecodePointer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TerminateProcess
CreateFileW
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetCurrentThreadId
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
WriteFile
GetModuleFileNameW
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
GetConsoleMode
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapFree
LoadLibraryExW
OutputDebugStringW
SetStdHandle
WriteConsoleW
user32
PostQuitMessage
SetWindowTextA
DestroyWindow
CreateDialogParamW
TranslateMessage
MessageBoxA
PeekMessageA
SetWindowsHookExA
SendMessageTimeoutA
DispatchMessageA
UnhookWindowsHookEx
advapi32
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
Name
.text
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=225, version=20806,
count=105, id=224, version=20806,
count=8, id=223, version=20806,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=105, id=1, productName=Unmarked objects,
count=28, id=229, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
fraps64.dll
- IMPHASH 1e6a56d4f5105ead332a252c267b6f0e
- SHA256 6acebecb8934508832a44fdd92823e8026ea4878c81e6eb18ae03eaa7b5b5c6f
- MD5 5fd7bee98d14dacdf2f206dad278a621
- SHA1 03181ad2c9ff23f679f4276ed6c34bdcc7a7282c
- SHA512 12886a63450ed203dad5f4e485ae8cb0bad97e2d4ab76e136c37e4679f2fd83918786dd5c2c3b593766835447c9d4e320f8d82161281c097c5b852b741c13f56
- SSDEEP 3072:Y1WDoRcIUA27g3nH/38b6ehJiyrOzpMrFMinDCeTvFxCczKwL1fD35D3PMBPIAgB:Y1PV0b6/Z+DCeTv5/B757LFpyW
- MD5 SHA1 SHA512 SSDEEP
Digest
87:a9:44:be:b7:8b:21:a4:c1:d9:bd:b2:77:16:98:7c:69:f6:85:ce:3e:6d:cb:22:0f:12:8b:67:ac:35:a4:87
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Chains
Aug 30, 2019
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Digest
a8:0e:12:c0:5c:24:41:3c:9a:da:6f:63:5e:b3:cd:21:a0:62:cf:37
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Chains
Aug 30, 2019
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 27, 2011 - May 30, 2020
Subject
CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Issuer
CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - May 30, 2020
Subject
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Serial Number
b8:b9:96:66:79:19:d0:c0:55:ef:5a:f3:55:8f:09:d2
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 20, 2019 - Aug 19, 2020
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Beepa Pty Ltd,O=Beepa Pty Ltd,POSTALCODE=3006,STREET=5902 / 1 Queensbridge Square,L=Southbank,ST=Victoria,C=AU
Serial Number
b8:b9:96:66:79:19:d0:c0:55:ef:5a:f3:55:8f:09:d2
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 20, 2019 - Aug 19, 2020
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Aug 1, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
118440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualFree
GetModuleHandleA
IsBadReadPtr
CloseHandle
GetCurrentProcessId
GetSystemDirectoryA
GetVersionExA
MapViewOfFileEx
UnmapViewOfFile
DisableThreadLibraryCalls
VirtualAlloc
GetProcAddress
OpenFileMappingA
SetEvent
WaitForSingleObject
CreateMutexA
FreeLibrary
LoadLibraryA
WriteConsoleW
SetFilePointerEx
GetModuleFileNameA
GetSystemInfo
RtlUnwindEx
GetCommandLineA
GetCurrentThreadId
EncodePointer
IsDebuggerPresent
DecodePointer
IsProcessorFeaturePresent
GetLastError
SetLastError
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
HeapFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
WriteFile
GetModuleFileNameW
LoadLibraryExW
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
CreateFileW
user32
CallNextHookEx
gdi32
DeleteObject
FrapsCount
FrapsFunc
FrapsKey
FrapsProcCALLWND
FrapsProcCBT
FrapsSetup
FrapsSharedData
FrapsVersion
Name
.text
Size
151KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=225, version=20806,
count=97, id=224, version=20806,
count=10, id=223, version=20806,
count=7, id=257, version=26715,
count=95, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=21, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
frapslcd.dll
- IMPHASH 95039ae47858a565b3441bc31de120b0
- SHA256 1376f53554c5977a627a7e749dd147cd10e7735ef4b860fd69b7ae31a7b15e74
- MD5 895c32a4eefd648d62e92201e4954cd2
- SHA1 5d7753f95ab95176da45473eaa0d7de29ca02973
- SHA512 76823f00376aff72b7ddf7fad259a43cdc5feec5486e3d79f6d63758f7325059d8e83dc10beb9447254501fe606b9f17fa6ed4d54f98a59dd4571453ff58fb35
- SSDEEP 1536:sa9292/UraStXim9/GcE1oVCGuTZgoOcj1EJsWjcdnnsf70:h292/UraStXuHiEC2nsf7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
14559
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateThread
GetCurrentThread
SetThreadPriority
GetTickCount
Sleep
FreeLibrary
LoadLibraryA
WriteConsoleW
SetFilePointerEx
WaitForSingleObject
CloseHandle
GetProcAddress
DisableThreadLibraryCalls
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
CreateFileW
user32
wsprintfA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
LCDInit
LCDStart
LCDStop
LCDVersion
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
97KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=225, productName=VS2013 build 21005, version=21005,
count=15, id=223, productName=VS2013 build 21005, version=21005,
count=101, id=224, productName=VS2013 build 21005, version=21005,
count=7, id=203, version=65501,
count=84, id=1, productName=Unmarked objects,
count=1, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=3, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
uninstall.exe.nsis
- SHA256 730e8c132af5f9c1535dce5e336a8fa27b2d8735cd621e3ec73ec703862ab4b7
- MD5 0aaf65620556e3b25c67eb21b17ea3ce
- SHA1 da73025bdb9085fc9d33787fb2f592dcb671c165
- SHA512 c06386acaef3d8c2e90df89a6b96ca29c100e4109a2c9388a4c32aab5c51f068b74d964d5ed386355361c9c1baea4c089abb17a129217a1eee263bd26c2b9e2c
- MD5 SHA1 SHA512