ProtonVPN-10_11[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

ProtonVPN-10_11.zip
Size

23.5MB
MD5

d9829ab6d8fbc09656007b40d6b6cb01
SHA1

dbee736452421bc365e1af75d935c7199d9b40f2
SHA256

e24cfa0f2969d1df115d09223a689d3f1a2c8badaec53e9d925641919a6400ef
SHA512

f1b60e2d47833b58cd0e680bc2ffa30202d098326ce10fa3137382fc12537a8cd69fce134183a43012015f4959aa174fc21e9ba350043ed726b01bc6ddbbf6d7
SSDEEP

393216:M5CB8xKa+Nw/mNP5xmT0Sae9fmdGlAZlaTRCogiotvyHD78gasYxpH877sS99mS/:taEwkP6I2AeaiotvtqYb8HVmSWfY

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/Launcher.dll
unpack001/data/appInfo/services/Launhcer.dll
unpack001/data/appInfo/services/data/Launcher.dll

Files

ProtonVPN-10_11.zip
.zip
Launcher.dll
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Launcher.exe
.exe windows:6 windows x86 arch:x86

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

18-09-2019 12:58

Not After

11-12-2022 11:53

Subject

CN=Adersoft,O=Adersoft,L=Paris,C=FR,1.2.840.113549.1.9.1=#0c14737570706f72744061646572736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 09:55

Not After

28-06-2032 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:fb:58:56:78:83:c0:9f:de:c5:ac:2a:33:b7:94:e6:e3:17:b1:5a:f9:ed:78:3e:8f:61:f7:67:75:db:dd:23
Signer

Actual PE Digest

03:fb:58:56:78:83:c0:9f:de:c5:ac:2a:33:b7:94:e6:e3:17:b1:5a:f9:ed:78:3e:8f:61:f7:67:75:db:dd:23

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleW
lstrcmpiW
MultiByteToWideChar
LoadLibraryExW
ExitProcess
LocalAlloc
LocalFree
FormatMessageW
WaitForSingleObject
GetExitCodeProcess
CreateThread
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
FindResourceExW
GetACP
WideCharToMultiByte
FreeResource
SetFilePointer
ReadFile
CreateFileW
CreateFileMappingW
MapViewOfFile
IsBadReadPtr
UnmapViewOfFile
GetCurrentProcessId
EnumResourceNamesW
GetFileAttributesW
GetFileSize
OpenEventW
SetEvent
ExpandEnvironmentStringsW
Sleep
FlushFileBuffers
GetFileType
WriteFile
WriteConsoleW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
CloseHandle
FindNextFileW
FindFirstFileExW
FindClose
GetFileSizeEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
LCMapStringW
GetStdHandle
GetModuleHandleExW
GetCommandLineW
GetCommandLineA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
SizeofResource
LockResource
LoadResource
FindResourceW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
HeapFree
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
FreeLibrary
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
IsValidCodePage

user32

UnregisterClassW
MessageBoxW
GetDlgItem
SetWindowPos
MapWindowPoints
GetClientRect
wsprintfA
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindowLongW
GetWindow
SetTimer
SendMessageW
GetParent
SetWindowTextW
CharNextW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
CreateWindowExW
DestroyWindow
LoadCursorW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
SetWindowLongW
DefWindowProcW
DialogBoxParamW
EndDialog
GetActiveWindow
KillTimer

advapi32

RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
CreateProcessWithLogonW
RegDeleteKeyW
RegCreateKeyExW

shell32

ShellExecuteW

ole32

CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoGetObject
CoGetInstanceFromFile
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoTaskMemFree

oleaut32

VariantCopy
VariantClear
SafeArrayUnaccessData
VariantChangeType
SafeArrayAccessData
SysAllocString
SysFreeString
VariantInit
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
LoadTypeLibEx
SysAllocStringLen

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CryptQueryObject

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Launcher.exe.manifest
data/0YZkUSGUwRKS
data/0ZQXVExBqIi8
data/0ew22Cf9qKXO
data/0hWKR82p3YbQ
data/0sLKrpjAgVoU
data/129zj9HHP7qr
data/1IGMno6OedFY
data/1QZBWs0lBhks
data/1S6RvIM2Y7Wh
data/1YiMKiPIxhLJ
data/1iIqaNX5b2q2
data/1v9LGHYmM5qU
data/1wvLRHqHbzCu
data/2JOTplQGfG3e
data/2ReV7K6TJ5aK
data/2gibkcc0n35D
data/2n0PjvEg4RKN
data/2vZjBZbLZZSx
data/357OsJ7eT1cy
data/3H0QEzbhMU40
data/3InZyWwQ9kzE
data/3QVyyFFHE1JW
data/3ZEjzIfbccyS
data/3gMxRl84YmcF
data/3qS5xYj9OZ0o
data/3uLgfCF9PLG1
data/4487UqJ0aVme
data/472LPT9pLMsF
data/4c94nnHwfrBF
data/4dtzcQ9q0DcC
data/4jsRT5aIEJR6
data/4qtDu8daWMri
data/4xeyBxo8sdiZ
data/5JszQqpBEqOW
data/5L619aiUpDyL
data/5d7wRlM0efd0
data/5mblESvwnOaE
data/5o25o4u5csDx
data/5r2UBPq8iLz8
data/5zuQvR2Mnrss
data/619cWgwSvPOL
data/66bweP7R8RJa
data/6cbDkiAs9dxp
data/6qIEYxB09OI6
data/6rLN6pdsCoVQ
data/6sPnaw95qhKF
data/6spvcNjReTUR
data/6tSwl90J8cnf
data/72SpTdNxzVx4
data/73u7yRnK918O
data/7hd95ehXuekf
data/7i3mKPHL69tH
data/7x7yhHvbShue
data/7ydo1ctWOHU2
data/83jY2raxYMFt
data/86QIIY9CWkYu
data/88x2P2R5hKw1
data/8D6R37MClh0M
data/8QmBTY5PnRA5
data/8aHvEzGWzQEk
data/8dlfIGmYDJvi
data/8fkFiJt8vxbl
data/8isTtUIXWCmo
data/8lIMKFwXL6K5
data/8uCH92Ubi7UG
data/8wyHE6h4jHeH
data/91LRqrapGRLQ
data/91fkT9Oc4fys
data/97AA0tWRT8fy
data/97Ewi2kDXHBp
data/9ImQR4EzSSxm
data/9zZgVdCD8rUp
data/A9EDvGqzyXBU
data/AAvo6e73xFWV
data/AUaAOw2bgbL9
data/AUluWnH873Yv
data/AbDM7RYc31FB
data/AcQPEUTVG8c6
data/AkOsZNTvodj0
data/B2Rhjmzye9Pt
data/B3wP9G7yLlOL
data/B5NbFRwHby3N
data/BLGnRwcRRrPJ
data/BaPpac24EQ98
data/BgjXSisrmsyW
data/C2neXtyRT88y
data/CQ3bbYvSYaL5
data/CV9EaHbJ0Jy3
data/CXd2wigglzlh
data/CkmKX5GjDfmU
data/ClIQw8gfUr2N
data/CqOUi6inrlpB
data/D7ilnXt9P4aT
data/DFfwoOhBERHQ
data/DLJatZQEefl7
data/DgWjWvqF21xo
data/DqQlrwLMnWtc
data/DsbtMPL3jbKN
data/E2eOw4g4OWxc
data/E4fMsuBnOIqs
data/E5YzpFPWr6wR
data/EERQtCN5I50h
data/EPHOw4AUEpVj
data/ElYwvRWqrjPT
data/FFkfLYYwrbD6
data/FUihuP2eAo0g
data/FanTnx5EYzsh
data/Fkqt6bdE84qX
data/FsQLgji12P78
data/FvvgNMJTmHGr
data/FwMHTAxRQIh1
data/G8pfBOEmJcKm
data/GAeGrVccj4QL
data/GEouVMwg6sCK
data/GLCdXDonaDgc
data/GvgNIiQadzh9
data/H0KIungUvqcO
data/H0i2S3xPM8ex
data/H3fTQvLF1vav
data/HJP9chBeCAJh
data/He09uPWliEPN
data/HjXnnfWBZ7a0
data/HmJ1vov9u4Ys
data/HxNx9aeooobq
data/Hy86IKqRmETR
data/I5LmqgGnJo0H
data/I7LX5BU54ESr
data/I8tEUovarLI3
data/IEbGDNZKOPqs
data/IEg2VInns5LV
data/IG07kb7vTx05
data/IM7bS0pe44k8
data/IOplpkAbyBIc
data/IUffrapWJKkF
data/IakuGmlzexnJ
data/IcrlPDvrxrZ3
data/ImXUeOFpuCUj
data/IpYZZUhGLy81
data/ItuhXRDV2i8H
data/IuiSEvxKc3py
data/J7fG4h34fxOM
data/JGQLgTHGYwMg
data/JIW0Yw0M0gFJ
data/JLgJdR450hTE
data/JVKwyNt89WG8
data/JVn47VXc92Je
data/JZBOiinjuPyq
data/Ji2EdKq8iLtf
data/JmhDSILmJnok
data/Jseo2EaXhned
data/K6KtUuPChYgn
data/K87Sii3Yvmwn
data/KFBBSbp3aVQu
data/KKDoBlXO4DgB
data/KPnrWi5Rkqtv
data/KPrEtojqL9bu
data/KSIASJWnIacl
data/KaepBKREpWYh
data/KauAMANykJiS
data/Ki8iYtiqjQAe
data/Kk0ahcpXMr0j
data/KsdyrSYAIIyg
data/a4g5p85m5YXx
data/a68aQpTo5s1T
data/aEYV8rTd5YiE
data/aSka47qx44YV
data/aUVZfcVbvuGH
data/ajk8ejTOhanE
data/appInfo/L6wUR4OjPt93
data/appInfo/LBwJRPfnbNHe
data/appInfo/LYjmktPkVrL3
data/appInfo/Lfa4ZIBXznDx
data/appInfo/LzdqbzLtir17
data/appInfo/MA5gCKpJnavb
data/appInfo/MIcKvwcg9I8p
data/appInfo/MIhzIXPfmF3U
data/appInfo/MkdALEbSJtUc
data/appInfo/NI41ZjHX5w6Y
data/appInfo/NO16KWsN9Ib2
data/appInfo/NbUh47rVZj94
data/appInfo/NcOJ5qNbfVdP
data/appInfo/NguTVNtAqwbb
data/appInfo/NkhtAtmZIckr
data/appInfo/NqcKyBLOluzG
data/appInfo/NrCwJFzVkUN5
data/appInfo/NyquX3TT35e6
data/appInfo/ODFgACryjH3k
data/appInfo/OKL1FcEdQyYM
data/appInfo/OPVtTebdtpN0
data/appInfo/OtJ0y7zujZjz
data/appInfo/Ouaewb389ps4
data/appInfo/OwYxNsOWE8V0
data/appInfo/P8SD0AvL3g8o
data/appInfo/P8rF92IyL8ac
data/appInfo/PEMPDZZlbODC
data/appInfo/PHMsfEIFLDBW
data/appInfo/PLS2KZzcj3ut
data/appInfo/PQXNg5DBG3go
data/appInfo/PRU0KayTSecP
data/appInfo/PT1WsPVYbmXm
data/appInfo/PUy844f68nDP
data/appInfo/PVKIBzThdaHG
data/appInfo/PhsS5NAvTk17
data/appInfo/PlDapPYRtYP4
data/appInfo/Q21weMYZEYeL
data/appInfo/QLA9AxhWqN0j
data/appInfo/QN53KhUn6uQP
data/appInfo/QOICOQiMy66T
data/appInfo/QSZWJCtQnDwd
data/appInfo/Qc927QgkOamV
data/appInfo/QecB4CBJXBbn
data/appInfo/QsQqkaar6SI5
data/appInfo/QzXi2xYU9Y7P
data/appInfo/R25xZ50p5YFN
data/appInfo/R4MtTwfns2VG
data/appInfo/R6jx7rEz8zVq
data/appInfo/RIKVfBSOR4eE
data/appInfo/RobPqZu3J5tL
data/appInfo/S31ntx2gUIbc
data/appInfo/S9nCYwBWfCLy
data/appInfo/SCnsQwuOCXOQ
data/appInfo/ShoKJq7ksy0C
data/appInfo/SnN7VelaWzns
data/appInfo/Soy9iAiQOXxK
data/appInfo/TIlR6EyQXcab
data/appInfo/TTBLMeymu6al
data/appInfo/TY6isqI7q9NF
data/appInfo/Tcfit41r5wUW
data/appInfo/TczD0mpHfuoq
data/appInfo/Tu6QBTHcT1CT
data/appInfo/Tu92hhIUeX80
data/appInfo/U6mdmuKUVQfc
data/appInfo/UFlizOZJgeeL
data/appInfo/UJHOHt3ASNZ2
data/appInfo/UJeyXKGM3Z1K
data/appInfo/UJsaPyOrBd5h
data/appInfo/UNNpwM5q7546
data/appInfo/UNgClbVjyTu0
data/appInfo/UVxKBsieFEA7
data/appInfo/UgYN3rd9zExc
data/appInfo/UjYVViOrw8Dc
data/appInfo/UlYpLMEVRyxf
data/appInfo/UwgbZNW3vLRt
data/appInfo/V42tA3i9FPbX
data/appInfo/V8VSu14ySEYX
data/appInfo/V8rMUNO8iWZp
data/appInfo/VMrhYjhQ8dyn
data/appInfo/VZUwIcbzuINO
data/appInfo/VcjSHlpRYAQE
data/appInfo/VdvbndfZEv1u
data/appInfo/VfIfXiMZObDy
data/appInfo/WBurt7GKN9m7
data/appInfo/WT16wMUNO83r
data/appInfo/WdUIemGGIxDe
data/appInfo/WduJOvgkDiHP
data/appInfo/We213kkrvpkj
data/appInfo/WfXH7diPVUOk
data/appInfo/WsgfJTC7FoYm
data/appInfo/X15VvKSdEjzL
data/appInfo/X7bSx481ZQAl
data/appInfo/X8Mwoz6au2HF
data/appInfo/X8f7bWKN2IJ3
data/appInfo/XF5W5pmmF1C6
data/appInfo/XJlEJT68NKjZ
data/appInfo/XUshWitOy7IM
data/appInfo/XaE0ChSra4mp
data/appInfo/XhgFesWb0b2v
data/appInfo/Xo0WquAvruDh
data/appInfo/XscCxhVHqA2p
data/appInfo/XxqLfy9S7Zgb
data/appInfo/Y1Yaj0tOzIoS
data/appInfo/YAVqEgQ98nWn
data/appInfo/YYhyqAg5VNqV
data/appInfo/YcwUwU6FGgFf
data/appInfo/YmntQx5OJb6u
data/appInfo/YpeZlbeH70Cn
data/appInfo/YrjvuQFWBKlw
data/appInfo/Z4TfmX0yJDgR
data/appInfo/Z5mTJOepeknX
data/appInfo/ZB96rePHdLaH
data/appInfo/ZE17XzLMBaJ4
data/appInfo/ZIIPtOF1Bty5
data/appInfo/ZSWfSUi6QHzp
data/appInfo/ZfEZh4ZAQA2S
data/appInfo/ZgMRA4ZFEMTF
data/appInfo/ZmL4suRzDDXr
data/appInfo/Zv7a1iDHNlEY
data/appInfo/l8X65aJA3dYy
data/appInfo/lTPVgoP8Z6XP
data/appInfo/lXpZZMrCh9wc
data/appInfo/lmhMxalW9jyU
data/appInfo/ln3e4ivSdxF9
data/appInfo/m9N663lPQbiD
data/appInfo/mELzpf1CIwtR
data/appInfo/mIiSafKR0Mzn
data/appInfo/mOSob1H0mcYV
data/appInfo/mTm4Gsv3TNIU
data/appInfo/mUUp8R65Z56Z
data/appInfo/mUhSWeDSVZgk
data/appInfo/mZ0JXhdoY40Q
data/appInfo/mcl76g5MtqvU
data/appInfo/mglh9yxU1j4A
data/appInfo/mrj462o6JRo0
data/appInfo/mtvDOXrPjdRs
data/appInfo/mxXoLdTvUq63
data/appInfo/n2fCK9tcnCRx
data/appInfo/n33u3ORbDKGR
data/appInfo/nE1H08obe6BC
data/appInfo/nEjlCRDmNmmr
data/appInfo/nMkYM3H2IrHj
data/appInfo/nNjzKSc5N8BY
data/appInfo/nP5AdXyX7g7M
data/appInfo/nPN0i4a97GTM
data/appInfo/nQJKNUe2uJoE
data/appInfo/nRCRxIB7aYOV
.ps1
data/appInfo/nYeALr0Rdmdx
data/appInfo/nlkz83PtjGOD
data/appInfo/nvLQLfxjUjFo
data/appInfo/nwV1gVhZtw6T
data/appInfo/o6djXcPlGktb
data/appInfo/oJRwfDcUQ1F1
data/appInfo/oRayrVRiziz9
data/appInfo/oYLXr7Nw6Ycb
data/appInfo/ocUA1f8bc9mZ
data/appInfo/ogq1S3C921z1
data/appInfo/otpzOvV5lB2s
data/appInfo/p3YOISua2KQx
data/appInfo/p8L9foEyWsdW
data/appInfo/pG1kJ3rEVEGr
data/appInfo/pHHgXozJ1k5S
data/appInfo/pKZFzhuJDLcC
data/appInfo/pLMxV5LkaPjr
data/appInfo/pSbX8qnKOJs1
data/appInfo/pWkAZ3ZjvjAG
data/appInfo/qBDQeLnRieS7
data/appInfo/qEWvJ2RNG2iy
data/appInfo/qUpwFlazeEa0
data/appInfo/qc4fIrX6rYyb
data/appInfo/qitChVHIm2MM
data/appInfo/qlxni9ClqWy8
data/appInfo/qrjEu0MWLIUs
data/appInfo/rQMZMMxtYwLX
data/appInfo/rZ1V8z3A5dle
data/appInfo/rbv6wfq5YC5y
data/appInfo/rdWOwxxgthbq
data/appInfo/rqb7FiTGxCWq
data/appInfo/rrtthbkDOvx3
data/appInfo/rtdyE4PWXfxE
data/appInfo/rvV1O98ccrua
data/appInfo/rwPlNa001v20
data/appInfo/ryUoYLPLpunO
data/appInfo/s9DjEL1nFFNl
data/appInfo/sNtBCrTVLrzX
data/appInfo/sYt8K9dxbB3o
data/appInfo/sZqPkbYPFciR
data/appInfo/sbbomrp5daMH
data/appInfo/services/Launhcer.dll
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
data/appInfo/services/Launhcer.exe
.exe windows:6 windows x86 arch:x86

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

18-09-2019 12:58

Not After

11-12-2022 11:53

Subject

CN=Adersoft,O=Adersoft,L=Paris,C=FR,1.2.840.113549.1.9.1=#0c14737570706f72744061646572736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 09:55

Not After

28-06-2032 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b1:2c:12:6f:38:81:22:3b:4b:eb:ee:5a:25:d8:c4:d1:03:ac:88:dd:95:a1:f9:d2:d7:1a:c0:b8:bd:2d:9b:73
Signer

Actual PE Digest

b1:2c:12:6f:38:81:22:3b:4b:eb:ee:5a:25:d8:c4:d1:03:ac:88:dd:95:a1:f9:d2:d7:1a:c0:b8:bd:2d:9b:73

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleW
lstrcmpiW
MultiByteToWideChar
LoadLibraryExW
ExitProcess
LocalAlloc
LocalFree
FormatMessageW
WaitForSingleObject
GetExitCodeProcess
CreateThread
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
FindResourceExW
GetACP
WideCharToMultiByte
FreeResource
SetFilePointer
ReadFile
CreateFileW
CreateFileMappingW
MapViewOfFile
IsBadReadPtr
UnmapViewOfFile
GetCurrentProcessId
EnumResourceNamesW
GetFileAttributesW
GetFileSize
OpenEventW
SetEvent
ExpandEnvironmentStringsW
Sleep
FlushFileBuffers
GetFileType
WriteFile
WriteConsoleW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
CloseHandle
FindNextFileW
FindFirstFileExW
FindClose
GetFileSizeEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
LCMapStringW
GetStdHandle
GetModuleHandleExW
GetCommandLineW
GetCommandLineA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
SizeofResource
LockResource
LoadResource
FindResourceW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
HeapFree
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
FreeLibrary
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
IsValidCodePage

user32

UnregisterClassW
MessageBoxW
GetDlgItem
SetWindowPos
MapWindowPoints
GetClientRect
wsprintfA
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindowLongW
GetWindow
SetTimer
SendMessageW
GetParent
SetWindowTextW
CharNextW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
CreateWindowExW
DestroyWindow
LoadCursorW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
SetWindowLongW
DefWindowProcW
DialogBoxParamW
EndDialog
GetActiveWindow
KillTimer

advapi32

RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
CreateProcessWithLogonW
RegDeleteKeyW
RegCreateKeyExW

shell32

ShellExecuteW

ole32

CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoGetObject
CoGetInstanceFromFile
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoTaskMemFree

oleaut32

VariantCopy
VariantClear
SafeArrayUnaccessData
VariantChangeType
SafeArrayAccessData
SysAllocString
SysFreeString
VariantInit
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
LoadTypeLibEx
SysAllocStringLen

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CryptQueryObject

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/appInfo/services/Launhcer.exe.manifest
data/appInfo/services/WinRAR.exe
.exe windows:5 windows x86 arch:x86

93d6ffbeb6eb5774e72f7a9d4e82b889

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-06-2017 00:00

Not After

01-06-2020 23:59

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-06-2017 00:00

Not After

01-06-2020 23:59

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9b:89:b1:5c:05:2f:38:7e:09:3a:9b:ba:f5:18:32:e8:d1:da:b9:ba:5f:c1:9b:a2:77:d0:7f:99:b8:79:42:d7
Signer

Actual PE Digest

9b:89:b1:5c:05:2f:38:7e:09:3a:9b:ba:f5:18:32:e8:d1:da:b9:ba:5f:c1:9b:a2:77:d0:7f:99:b8:79:42:d7

Digest Algorithm

sha256

PE Digest Matches

true

98:17:ce:4e:f2:84:39:06:72:2c:9f:e2:57:6b:95:0b:7c:60:2e:bb
Signer

Actual PE Digest

98:17:ce:4e:f2:84:39:06:72:2c:9f:e2:57:6b:95:0b:7c:60:2e:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Projects\WinRAR\build\winrar32\Release\WinRAR.pdb

Imports

kernel32

DeviceIoControl
BackupRead
BackupSeek
GetShortPathNameW
GetLongPathNameW
GetFileType
GetStdHandle
FlushFileBuffers
GetFileTime
GetDiskFreeSpaceExW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
LoadResource
SizeofResource
FindResourceW
LoadLibraryExW
CompareStringA
GetCurrentThread
SetThreadPriority
SetThreadExecutionState
CreateEventW
GetSystemDirectoryW
SetCurrentDirectoryW
GetFullPathNameA
SetPriorityClass
GetProcessAffinityMask
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
CreateSemaphoreW
GetSystemTime
TzSpecificLocalTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
WideCharToMultiByte
CompareStringW
GetModuleHandleExW
GetCompressedFileSizeW
EnumResourceNamesW
EnumResourceLanguagesW
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
GetLocaleInfoW
GetNumberFormatW
GetLogicalDrives
LockResource
SuspendThread
ResumeThread
GetStartupInfoW
GetCurrentThreadId
FormatMessageW
CopyFileW
GetThreadPriority
SetErrorMode
GetPriorityClass
WaitForMultipleObjects
MulDiv
CompareFileTime
FindNextChangeNotification
HeapSize
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetStringTypeW
WriteConsoleW
SetStdHandle
LCMapStringW
HeapReAlloc
GetModuleFileNameA
ExitProcess
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
QueryPerformanceFrequency
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
RtlUnwind
InitializeSListHead
QueryPerformanceCounter
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileInformationByHandle
GetLocalTime
FindCloseChangeNotification
FindFirstChangeNotificationW
ExpandEnvironmentStringsW
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FindNextFileW
GetDiskFreeSpaceW
CreateHardLinkW
SetLastError
DosDateTimeToFileTime
LocalFileTimeToFileTime
HeapFree
HeapAlloc
HeapDestroy
HeapCreate
DeleteFileW
SetFileAttributesW
CreateFileW
RemoveDirectoryW
CreateDirectoryW
LoadLibraryW
GetSystemTimeAsFileTime
SetFileTime
SetFilePointer
SetEndOfFile
ReadFile
WriteFile
GetFileSize
FreeLibrary
MoveFileW
GetTickCount
GetCPInfoExW
GetOEMCP
GetACP
GetVolumeInformationW
GetDriveTypeW
Sleep
GetCurrentProcessId
GetCurrentProcess
CreateMutexW
ReleaseMutex
GetLastError
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
DecodePointer
MultiByteToWideChar
GetVersionExA
GetModuleHandleW
GetProcAddress
GetTempPathW
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CloseHandle
WaitForSingleObject
GetCommandLineW
GetModuleFileNameW
GetDateFormatW
GetTimeFormatW
FindFirstFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
FindClose
Beep
GetFileAttributesW

user32

CopyImage
FindWindowExW
FillRect
MessageBoxW
CreateIcon
EnumWindows
SetForegroundWindow
IsCharAlphaW
FlashWindow
CopyRect
RegisterClassExW
GetSysColor
ValidateRect
DrawIconEx
LoadImageW
SystemParametersInfoW
GetSystemMenu
KillTimer
SetTimer
MessageBoxIndirectW
CharLowerW
ExitWindowsEx
CharLowerA
LoadStringW
GetWindow
SetProcessDefaultLayout
CharToOemBuffW
OemToCharBuffA
OemToCharA
GetComboBoxInfo
RedrawWindow
MessageBeep
CharToOemA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
PeekMessageW
GetScrollInfo
EnableMenuItem
CheckMenuItem
GetFocus
MoveWindow
GetClientRect
GetWindowTextLengthW
EndPaint
BeginPaint
UpdateWindow
AppendMenuW
DrawMenuBar
wsprintfW
ScreenToClient
ClientToScreen
CallWindowProcW
PtInRect
SetMenuItemInfoW
GetMenuItemInfoW
InsertMenuItemW
TrackPopupMenu
DeleteMenu
InsertMenuW
GetSubMenu
SetMenu
LoadMenuW
LoadAcceleratorsW
IsChild
RegisterClassW
PostQuitMessage
SetScrollRange
SetScrollPos
ScrollWindowEx
GetClipboardData
LoadIconW
RegisterWindowMessageW
CreateDialogParamW
PostThreadMessageW
IsDialogMessageW
GetIconInfo
CreateIconIndirect
FindWindowW
RemovePropW
GetPropW
SendMessageW
DefWindowProcW
CreateWindowExW
DestroyWindow
SetFocus
GetWindowTextW
GetWindowLongW
SetWindowLongW
SetWindowPos
GetWindowPlacement
SetWindowPlacement
IsWindowVisible
DialogBoxParamW
SetPropW
GetForegroundWindow
TranslateAcceleratorW
CreateDialogIndirectParamW
BringWindowToTop
GetMenuState
GetMenuItemID
GetLastActivePopup
DispatchMessageW
TranslateMessage
DestroyMenu
CreatePopupMenu
GetMenu
IsWindow
WaitForInputIdle
LoadCursorW
EndDialog
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
SendDlgItemMessageW
GetWindowRect
MapWindowPoints
GetParent
DestroyIcon
CheckDlgButton
PostMessageW
InvalidateRect
EnumChildWindows
GetClassNameW
ShowWindow
CharToOemBuffA
SetDlgItemInt
GetDlgItemInt
GetMessageW
GetMenuItemCount
GetWindowThreadProcessId
WindowFromPoint
SetCursor
GetKeyState
RegisterClipboardFormatW
SystemParametersInfoA
GetDesktopWindow
IntersectRect
GetCursorPos
SetWindowTextW
ReleaseDC
GetDC
GetSystemMetrics
EnableWindow
IsIconic
IsWindowEnabled
IsDlgButtonChecked
CharUpperW

gdi32

TextOutA
SetPixel
Rectangle
GetTextExtentPoint32W
CreateSolidBrush
CreateDIBSection
GetPixel
DPtoLP
StretchBlt
SetMapMode
GetMapMode
GetDeviceCaps
CreateCompatibleBitmap
CreateBitmap
ExtTextOutW
SetBkColor
DeleteDC
CreateCompatibleDC
BitBlt
GetObjectW
TextOutW
MoveToEx
SetTextColor
LineTo
CreatePen
GetTextFaceW
GetTextMetricsW
SelectObject
DeleteObject
CreateFontW

comdlg32

GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError
ChooseFontW

advapi32

AllocateAndInitializeSid
AccessCheck
OpenProcessToken
MapGenericMask
GetFileSecurityW
RegCloseKey
IsTextUnicode
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
CheckTokenMembership
FreeSid
DuplicateToken
SetFileSecurityW
GetSecurityDescriptorLength
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegOpenKeyExW

shell32

FindExecutableW
DragFinish
DragQueryFileW
Shell_NotifyIconW
DragAcceptFiles
ShellExecuteW
SHGetSpecialFolderLocation
SHAddToRecentDocs
SHFileOperationW
SHGetFolderPathW
ShellExecuteExW
SHBrowseForFolderW
SHGetMalloc
SHChangeNotify
SHGetDesktopFolder
SHGetFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW
ord100

ole32

RevokeDragDrop
RegisterDragDrop
OleUninitialize
OleInitialize
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemAlloc
CoInitializeEx
CoTaskMemFree
CoCreateInstance
OleSetClipboard
DoDragDrop

oleaut32

VariantClear
SysAllocString

shlwapi

StrCmpLogicalW
SHAutoComplete

powrprof

SetSuspendState

comctl32

CreateStatusWindowW
ImageList_Create
ImageList_ReplaceIcon
InitCommonControlsEx
PropertySheetW

uxtheme

IsThemeActive
IsAppThemed

gdiplus

GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipBitmapGetPixel
GdipBitmapSetPixel

msimg32

GradientFill

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 646KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 888KB - Virtual size: 888KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/appInfo/services/data/Launcher.dll
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
data/appInfo/services/data/Launcher.exe
.exe windows:6 windows x86 arch:x86

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

18-09-2019 12:58

Not After

11-12-2022 11:53

Subject

CN=Adersoft,O=Adersoft,L=Paris,C=FR,1.2.840.113549.1.9.1=#0c14737570706f72744061646572736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 09:55

Not After

28-06-2032 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:fb:58:56:78:83:c0:9f:de:c5:ac:2a:33:b7:94:e6:e3:17:b1:5a:f9:ed:78:3e:8f:61:f7:67:75:db:dd:23
Signer

Actual PE Digest

03:fb:58:56:78:83:c0:9f:de:c5:ac:2a:33:b7:94:e6:e3:17:b1:5a:f9:ed:78:3e:8f:61:f7:67:75:db:dd:23

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleW
lstrcmpiW
MultiByteToWideChar
LoadLibraryExW
ExitProcess
LocalAlloc
LocalFree
FormatMessageW
WaitForSingleObject
GetExitCodeProcess
CreateThread
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
FindResourceExW
GetACP
WideCharToMultiByte
FreeResource
SetFilePointer
ReadFile
CreateFileW
CreateFileMappingW
MapViewOfFile
IsBadReadPtr
UnmapViewOfFile
GetCurrentProcessId
EnumResourceNamesW
GetFileAttributesW
GetFileSize
OpenEventW
SetEvent
ExpandEnvironmentStringsW
Sleep
FlushFileBuffers
GetFileType
WriteFile
WriteConsoleW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
CloseHandle
FindNextFileW
FindFirstFileExW
FindClose
GetFileSizeEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
LCMapStringW
GetStdHandle
GetModuleHandleExW
GetCommandLineW
GetCommandLineA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
SizeofResource
LockResource
LoadResource
FindResourceW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
HeapFree
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
FreeLibrary
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
IsValidCodePage

user32

UnregisterClassW
MessageBoxW
GetDlgItem
SetWindowPos
MapWindowPoints
GetClientRect
wsprintfA
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindowLongW
GetWindow
SetTimer
SendMessageW
GetParent
SetWindowTextW
CharNextW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
CreateWindowExW
DestroyWindow
LoadCursorW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
SetWindowLongW
DefWindowProcW
DialogBoxParamW
EndDialog
GetActiveWindow
KillTimer

advapi32

RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
CreateProcessWithLogonW
RegDeleteKeyW
RegCreateKeyExW

shell32

ShellExecuteW

ole32

CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoGetObject
CoGetInstanceFromFile
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoTaskMemFree

oleaut32

VariantCopy
VariantClear
SafeArrayUnaccessData
VariantChangeType
SafeArrayAccessData
SysAllocString
SysFreeString
VariantInit
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
LoadTypeLibEx
SysAllocStringLen

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CryptQueryObject

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/appInfo/services/data/Launcher.exe.manifest
data/appInfo/services/wget.exe
.exe windows:4 windows x86 arch:x86

9d364237d29bd7c53899e2d70965daa7

Code Sign

70:3f:38:4b:e7:0a:dd:9e:6a:17:5d:f4:be:6e:02:fe
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

24-02-2021 00:00

Not After

24-02-2024 23:59

Subject

CN=Jernej Simončič,O=Jernej Simončič,STREET=Herbersteinova 29,L=Ljubljana,C=SI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:8d:da:4e:59:e5:fb:68:5d:37:c0:7c:ef:b5:5c:bf:64:26:7a:3d:04:ac:4d:09:38:b7:1d:6c:22:98:0c:00
Signer

Actual PE Digest

d0:8d:da:4e:59:e5:fb:68:5d:37:c0:7c:ef:b5:5c:bf:64:26:7a:3d:04:ac:4d:09:38:b7:1d:6c:22:98:0c:00

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEnumProvidersW
CryptExportKey
CryptGenRandom
CryptGetProvParam
CryptGetUserKey
CryptReleaseContext
CryptSetHashParam
CryptSignHashW
DeregisterEventSource
GetUserNameW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegisterEventSourceW
ReportEventW

bcrypt

BCryptGenRandom

crypt32

CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

kernel32

CloseHandle
ConvertFiberToThread
ConvertThreadToFiber
CreateDirectoryA
CreateDirectoryW
CreateEventA
CreateFiber
CreateFileA
CreateFileMappingA
CreateFileW
CreateHardLinkA
CreatePipe
CreateProcessA
CreateProcessW
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFiber
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FormatMessageA
FormatMessageW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetConsoleWindow
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesA
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileType
GetHandleInformation
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNamedPipeInfo
GetNumberOfConsoleInputEvents
GetPriorityClass
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetThreadLocale
GetTickCount64
GetTickCount
GetVersion
GetVersionExA
GetVolumeInformationW
GetWindowsDirectoryA
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsDBCSLeadByteEx
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
LockFileEx
MapViewOfFile
MoveFileExA
MultiByteToWideChar
OpenFileMappingA
PeekConsoleInputA
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleA
ReadConsoleW
ReadFile
ReleaseSemaphore
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleTitleA
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFilePointer
SetFilePointerEx
SetFileTime
SetLastError
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepEx
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnlockFile
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

__getmainargs
__initenv
__lconv_init
__mb_cur_max
__p___argv
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_access
_amsg_exit
_assert
_cexit
_chdir
_dup
_dup2
_environ
_errno
_chmod
_close
_exit
_fdopen
_filelengthi64
_fileno
_findclose
_fullpath
_get_osfhandle
_getch
_getcwd
_getmaxstdio
_getmbcp
_getpid
_gmtime64
_initterm
_iob
_isatty
_isctype
_localtime64
_lock
_lseeki64
_onexit
_open
_open_osfhandle
_pipe
_putenv
_read
_rmdir
_setmaxstdio
_setmode
_vsnwprintf
_strdup
_stricmp
_strnicmp
_sys_errlist
_sys_nerr
_telli64
_time64
_unlink
_unlock
_vscprintf
_vsnprintf
_waccess
_wfopen
_wopen
_write
abort
atoi
bsearch
calloc
clearerr
clock
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwrite
getc
getenv
isalnum
isalpha
iscntrl
isgraph
islower
isprint
ispunct
isspace
isupper
iswctype
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
localtime
gmtime
_mkdir
perror
puts
qsort
raise
rand
realloc
rewind
setbuf
setlocale
setvbuf
signal
srand
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
tmpfile
tolower
toupper
towlower
towupper
ungetc
vfprintf
time
wcscat
wcscmp
wcscpy
wcslen
wcsstr
wcstombs
_stat
_fstat
_findnext
_findfirst
_write
_strnicmp
_strdup
_setmode
_read
_putenv
_open
_lseek
_isatty
_getpid
_fileno
_dup
_close
_access

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize

shell32

SHGetSpecialFolderPathW

user32

DispatchMessageA
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage

ws2_32

WSAAddressToStringA
WSACleanup
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSASetLastError
WSASocketW
WSAStartup
WSAStringToAddressW
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
gethostname
getnameinfo
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 466KB - Virtual size: 465KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/14
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/appInfo/t7NwnimS8VO3
data/appInfo/t8PdqDFDSCf1
data/appInfo/tCHrAYe33oiJ
data/appInfo/tMtCDnnNoKuE
data/appInfo/tOYRP3jc47Jy
data/appInfo/tfQAUi7WgEXe
data/appInfo/tkhdDD0iTzB4
data/appInfo/toilLojOLX3M
data/appInfo/tpcRWvI7Ysb2
data/appInfo/trPqXrmKdKGY
data/appInfo/u0odjHj8gS6c
data/appInfo/u2omk8s9Oknh
data/appInfo/uEv1hzyZa4eI
data/appInfo/uHEAkvnJhvZB
data/appInfo/uJJm2fOQFwbM
data/appInfo/uMeFBfGPCLz6
data/appInfo/uMxEodSzPhSA
data/appInfo/uNNr4hVxoBG3
data/appInfo/uNoI7MKKH40P
data/appInfo/uSmSoPt3Vky1
data/appInfo/uzaSk7BKNZw8
data/appInfo/v0QtTbwk68IL
data/appInfo/v0YH7s69ca7v
data/appInfo/vBpmxBqYSOyx
data/appInfo/vCwrszu4pLJT
data/appInfo/vNnRuLKWckem
data/appInfo/vatXKHkruaK3
data/appInfo/vcq9o2fQew3p
data/appInfo/vp1p0vRdooAR
data/appInfo/vsjffMBYM1pq
data/appInfo/vvofHApFPaqr
data/appInfo/w0z2bS0wQ0kY
data/appInfo/w1hsCOxovTQO
data/appInfo/w90cW1xG7Q5W
data/appInfo/wCXxsJNCbccf
data/appInfo/wQZATsbO5Tvg
data/appInfo/wTFnqqPviy4x
data/appInfo/wVh9vXMZslzB
data/appInfo/wWyS75Z50j6I
data/appInfo/wbLNrFzZMftK
data/appInfo/wlY3CSgJ5Rq7
data/appInfo/wrsv5TftGgYG
data/appInfo/wtfqtFTrGQcm
data/appInfo/xD3jIDT0qSMi
data/appInfo/xGEMQt9jBjZP
data/appInfo/xHWpsN9r6MDm
data/appInfo/xxsz8pDJy2RW
data/appInfo/yPPHu6OUVC8s
data/appInfo/yzAYFI02Stu7
data/appInfo/zBRN4wuOsGrb
data/appInfo/zC1XL60irSSM
data/appInfo/zRvhGMa4xslM
data/appInfo/zYdyE8Zu4kG9
data/appInfo/zZVXNs96pemG
data/b0FrQHXcByM8
data/bBxE25G9Tlyq
data/bC2nGCN5wqet
data/bPhFwztnJrk7
data/bpr9VemZafqU
data/brv1lt4KkDpk
data/c1MyQZf7DAFq
data/c3eWgoJVrFKX
data/c5bZcXAZXLSD
data/c6E0NCS1ifEU
data/cGalAXtl9el9
data/cQ0w9OJ3K3AZ
data/cp5AXUyDb3kB
data/cqHpu3kTxnho
data/cwORf5XFvb8z
data/cxqo71EFfP2k
data/cyKP74xmbpMX
data/d0PenhZZZSkg
data/dEXpZiA0fbmd
data/dHADg7y2uycZ
data/dJD6AWRkxPQt
data/dN8EamZKwimK
data/dUQaqVhgLp3i
data/dUauzEIz1WPq
data/dYiqBEwRgURP
data/dblf6EKxRaGC
data/dinofYSv1SzG
data/dmMXD6cNdReI
data/dzf4y0OKszR4
data/eDfJDpXZCaqG
data/eIyPLPcmSXt9
data/eLLJdlsbkZc2
data/eNQBzXtNcGKt
data/eWHsP4rdVPny
data/eWLbj8lAN7C9
data/eZ86aHOrN8wE
data/eZZi1PLtPPJg
data/eg4hr5AKFw8b
data/eh6vKzRik7id
data/en3w4zz9xpBC
data/eyNIGs8h5MNn
data/ezI9cjgXG3wc
data/fFRe3ArnRx1j
data/fIBe5bUkBNhA
data/fMeBX68Aa1jL
data/fWbyD0p3cF5v
data/feKrupMpwKGF
data/fsbO2IBjGH88
data/g0TinahQ28UP
data/g1mcosui9h3B
data/gGI7qJGmmtI1
data/gNOwkSFvLoDf
data/gONr81jqLSHE
data/gQOa3moegPra
data/gT6NI2vyXj9p
data/gfclrciQrzVv
data/giykhZ8gCs6U
data/h63wE0hMtrdM
data/hD7oLDHmV8mm
data/hIw3AE0qEPxS
data/hLx89kIuaJw4
data/hOlhRZwuzUir
data/hTRmgmM9rfhw
data/hW86JXAjVpi1
data/hYGjTBmJUt14
data/hc7RHhnIqUBA
data/hnj9nLUewnej
data/i4N11vecy1Yb
data/i9fVKKqDu1tL
data/iCgvlaf27jeC
data/iFkiRm4oPNby
data/im4hxMhXGgDC
data/inYbejNf9r3Y
data/j4uFdAV6KMlb
data/jFVf1oESqxQ8
data/jIXKl6Q0u2M5
data/jJfZzcPXPpp7
data/jJurWIM3jZDz
data/jQYuMOgIxRxV
data/jZ09fMf9R1Mz
data/jj6SMnI4xd50
data/jq2keABfbNDG
data/k1vig3YertMX
data/k5WdMueQfpvJ
data/k5XqqrWZ7MN4
data/kP4dsH6otpOK
data/kVs3qBGgKZxj
data/kes6JDVBTdGS
data/klQg2CBNfPF8
data/kvK4yPr3F9sD

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 140B

.rsrc Size: 1KB - Virtual size: 1KB

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8fCertificate

Extended Key Usages

Key Usages

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9fCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

03:fb:58:56:78:83:c0:9f:de:c5:ac:2a:33:b7:94:e6:e3:17:b1:5a:f9:ed:78:3e:8f:61:f7:67:75:db:dd:23Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

wintrust

crypt32

version

Sections

.text Size: 221KB - Virtual size: 220KB

.rdata Size: 68KB - Virtual size: 68KB

.data Size: 6KB - Virtual size: 12KB

.rsrc Size: 46KB - Virtual size: 46KB

.reloc Size: 11KB - Virtual size: 11KB

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 140B

.rsrc Size: 1KB - Virtual size: 1KB

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8fCertificate

Extended Key Usages

Key Usages

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9fCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

b1:2c:12:6f:38:81:22:3b:4b:eb:ee:5a:25:d8:c4:d1:03:ac:88:dd:95:a1:f9:d2:d7:1a:c0:b8:bd:2d:9b:73Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

.rdata
Size: 512B - Virtual size: 140B

.rsrc
Size: 1KB - Virtual size: 1KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

03:fb:58:56:78:83:c0:9f:de:c5:ac:2a:33:b7:94:e6:e3:17:b1:5a:f9:ed:78:3e:8f:61:f7:67:75:db:dd:23
Signer

.text
Size: 221KB - Virtual size: 220KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 6KB - Virtual size: 12KB

.rsrc
Size: 46KB - Virtual size: 46KB

.reloc
Size: 11KB - Virtual size: 11KB

.rdata
Size: 512B - Virtual size: 140B

.rsrc
Size: 1KB - Virtual size: 1KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

b1:2c:12:6f:38:81:22:3b:4b:eb:ee:5a:25:d8:c4:d1:03:ac:88:dd:95:a1:f9:d2:d7:1a:c0:b8:bd:2d:9b:73
Signer

.text
Size: 221KB - Virtual size: 220KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 6KB - Virtual size: 12KB

.rsrc
Size: 46KB - Virtual size: 46KB

.reloc
Size: 11KB - Virtual size: 11KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

9b:89:b1:5c:05:2f:38:7e:09:3a:9b:ba:f5:18:32:e8:d1:da:b9:ba:5f:c1:9b:a2:77:d0:7f:99:b8:79:42:d7
Signer

98:17:ce:4e:f2:84:39:06:72:2c:9f:e2:57:6b:95:0b:7c:60:2e:bb
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 104KB - Virtual size: 103KB

.data
Size: 17KB - Virtual size: 646KB

.gfids
Size: 512B - Virtual size: 248B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 888KB - Virtual size: 888KB

.reloc
Size: 53KB - Virtual size: 53KB