ffff[.]rar | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

ffff.rar
Size

5.2MB
MD5

2f1076300e4ad02d2d43985f4a55def9
SHA1

e2acda003a7980edf81ee4925ecc73a8deae3245
SHA256

662989d40ce8865042f68aaf3f831cba019a74090a36471077f7b51d2f5989c1
SHA512

7521344afa848a025f14a60f4648fe24bc1f152d897c77598f4d680dc64e11b0e1f8683232dfce02d846a6c0d256628e37c091f46d60425a16984b4fc6230eed
SSDEEP

98304:pP8US8h0T/tuX3buU6Sq4eEEOTfKf7MX4AcsV2GjqA8ea8O82+xxZUgLhQeRgWiG:pPXh0qrNqDEpTC5MJqA8eaMDLhQGUF5+

Score

1^/10

Malware Config

Signatures

Files

ffff.rar
.rar
Soundpad.exe
.exe windows:6 windows x64 arch:x64

edfa3f01383da0e9692b10e9bbd874f5

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:bd:46:a5:9a:9a:84:f8:8e:aa:72:ee:ee:d2:88:ba
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-10-2022 00:00

Not After

25-10-2025 23:59

Subject

CN=Arthur Lepp,O=Arthur Lepp,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

19:d0:1d:3d:f2:de:f8:d4:7a:0f:af:d1:d8:fe:be:64:e8:f5:a9:f8:26:29:66:53:55:86:bc:be:46:43:4b:4d
Signer

Actual PE Digest

19:d0:1d:3d:f2:de:f8:d4:7a:0f:af:d1:d8:fe:be:64:e8:f5:a9:f8:26:29:66:53:55:86:bc:be:46:43:4b:4d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\dev\UniteFx\x64\Release\Soundpad.pdb

Imports

usp10

ScriptItemize
ScriptBreak

dwmapi

DwmIsCompositionEnabled
DwmExtendFrameIntoClientArea

kernel32

GetDiskFreeSpaceExW
FreeLibrary
VerifyVersionInfoW
VerSetConditionMask
GetFileInformationByHandle
GetVolumeInformationW
DisconnectNamedPipe
HeapFree
LocalAlloc
FileTimeToSystemTime
HeapAlloc
FlushFileBuffers
LocalFree
GetProcessHeap
FindFirstFileW
CreateEventExW
FindNextFileW
DeviceIoControl
CreateMutexW
FindClose
GetVolumePathNameW
GetFileAttributesW
ReleaseMutex
OpenFileMappingW
GetSystemDirectoryW
GetVolumeNameForVolumeMountPointW
CreateToolhelp32Snapshot
FormatMessageW
GetFileAttributesExW
Process32NextW
Process32FirstW
GetWindowsDirectoryW
GetModuleHandleW
CreateFileMappingW
MapViewOfFile
GetProcessTimes
lstrcmpA
OutputDebugStringW
GetLocalTime
HeapSetInformation
GetFileType
MultiByteToWideChar
SetErrorMode
GetFileTime
GetLongPathNameW
GetTempFileNameW
GetTempPathW
SetCurrentDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentThread
SetThreadPriority
GetExitCodeThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetACP
GetLocaleInfoW
GetThreadLocale
GetEnvironmentVariableW
IsDebuggerPresent
TerminateProcess
GetVersionExW
GetNativeSystemInfo
LoadResource
LockResource
SizeofResource
FindResourceW
IsValidCodePage
GetCPInfo
RtlCaptureContext
GetCommandLineW
ExpandEnvironmentStringsW
SetThreadLocale
GetUserDefaultUILanguage
PeekNamedPipe
CreateThread
IsBadReadPtr
IsBadStringPtrA
MulDiv
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
GlobalSize
GlobalHandle
GetStdHandle
FreeConsole
AttachConsole
WriteConsoleA
WriteConsoleW
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
ReadConsoleOutputCharacterA
GetStringTypeW
GetLocaleInfoEx
RtlPcToFileHeader
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
EncodePointer
LCMapStringEx
CompareStringEx
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlUnwind
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetDriveTypeW
GetFullPathNameW
SystemTimeToTzSpecificLocalTime
SetStdHandle
GetTimeZoneInformation
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SetFilePointerEx
HeapReAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentDirectoryW
GetFileSizeEx
SetEndOfFile
GetOEMCP
GetLogicalDriveStringsW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FindFirstFileExW
GetCommandLineA
HeapSize
WriteFile
SetLastError
WideCharToMultiByte
CancelIo
ReadFile
ConnectNamedPipe
CreateNamedPipeW
CreateEventW
SetUnhandledExceptionFilter
GetCurrentThreadId
CreateFileW
GetProcAddress
LoadLibraryW
GetCurrentProcessId
GetCurrentProcess
ReplaceFileW
QueryFullProcessImageNameW
OpenProcess
DecodePointer
DeleteCriticalSection
GetTickCount64
Sleep
GetModuleFileNameW
UnmapViewOfFile
WaitForSingleObject
CloseHandle
GetExitCodeProcess
WaitForMultipleObjects
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteFileW
InitializeCriticalSectionEx
MoveFileExW
GetLastError
CopyFileW
CreateDirectoryW
FileTimeToLocalFileTime
SetEnvironmentVariableW

user32

DestroyCursor
DrawIconEx
GetMenuState
CreateMenu
CreatePopupMenu
DestroyMenu
GetSubMenu
InsertMenuW
AppendMenuW
ModifyMenuW
RemoveMenu
SetMenuInfo
InsertMenuItemW
DrawEdge
DrawFrameControl
CheckMenuItem
GetMenuItemID
GetSysColorBrush
CheckMenuRadioItem
RegisterWindowMessageW
SetMenu
EndDialog
EnumChildWindows
UnionRect
GetClassInfoW
IsRectEmpty
GetDesktopWindow
RegisterClipboardFormatW
GetClipboardFormatNameW
GetProcessDefaultLayout
GetPropW
GetWindowTextW
MessageBeep
GetClassNameW
CreateAcceleratorTableW
DestroyAcceleratorTable
TranslateAcceleratorW
GetMessageW
ValidateRect
GetWindowDC
BeginPaint
EndPaint
ValidateRgn
NotifyWinEvent
ChangeDisplaySettingsExW
EnumDisplaySettingsW
MonitorFromPoint
EnumDisplayMonitors
IsClipboardFormatAvailable
wsprintfW
IsMenu
ShowCursor
TranslateMessage
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
FillRect
DrawFocusRect
GetSysColor
GetWindowRect
DrawTextW
DdeFreeStringHandle
DdeQueryStringW
DdeCreateStringHandleW
FindWindowExW
DdeFreeDataHandle
DdeGetData
DdeCreateDataHandle
DdeClientTransaction
DdeNameService
DdePostAdvise
DdeDisconnect
DdeConnect
DdeUninitialize
DdeInitializeW
LoadCursorW
SetCursor
KillTimer
SetTimer
DestroyWindow
DefWindowProcW
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW
BringWindowToTop
CreateWindowExW
RegisterClassW
PostThreadMessageW
MessageBoxW
SetRectEmpty
RegisterHotKey
SetRect
DrawStateW
SetWindowRgn
EnableMenuItem
DrawMenuBar
GetDialogBaseUnits
CreateDialogIndirectParamW
IsZoomed
IsIconic
FlashWindowEx
SetLayeredWindowAttributes
OffsetRect
CopyRect
GetWindowPlacement
DestroyIcon
LoadImageW
LoadIconW
LoadBitmapW
GetIconInfo
CreateIconIndirect
GetDlgItem
ChildWindowFromPoint
CreateDialogParamW
SystemParametersInfoW
GetScrollInfo
SetScrollInfo
IsDialogMessageW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
SetParent
SetWindowLongW
PtInRect
InflateRect
ChildWindowFromPointEx
WindowFromPoint
MapWindowPoints
ScreenToClient
ClientToScreen
GetCursorPos
SetCursorPos
LoadCursorFromFileW
GetComboBoxInfo
GetCaretBlinkTime
ShowCaret
HideCaret
DdeGetLastError
GetClientRect
SetWindowTextW
EnableScrollBar
ScrollWindow
RedrawWindow
InvalidateRect
GetUpdateRgn
ReleaseDC
GetDC
UpdateWindow
GetMenuItemInfoW
GetMenuItemCount
GetSystemMetrics
IsWindowEnabled
EnableWindow
SetCapture
GetCapture
VkKeyScanW
SetWindowPos
ReleaseCapture
GetKeyState
GetFocus
GetActiveWindow
SendMessageW
UnregisterClassW
MonitorFromRect
GetMonitorInfoW
SetFocus
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetWindowLongW
GetClassLongPtrW
SetClassLongPtrW
MapVirtualKeyW
GetKeyNameTextW
GetAsyncKeyState
GetDoubleClickTime
GetForegroundWindow
GetWindowTextLengthW
MoveWindow
AnimateWindow
ShowWindow
IsWindow
CallWindowProcW
PostQuitMessage
GetMessageTime
GetMessagePos
UnregisterHotKey
AdjustWindowRectEx
SetForegroundWindow
MonitorFromWindow
SetMenuItemInfoW
PostMessageW
TrackPopupMenu
GetSystemMenu
keybd_event
ExitWindowsEx

advapi32

GetTokenInformation
RegDeleteKeyExW
RegEnumKeyW
RegDeleteKeyW
GetUserNameW
RegOpenKeyExW
FreeSid
RegSetValueExW
RegDeleteTreeW
RegSetKeySecurity
RegEnumKeyExW
RegCreateKeyExW
SetSecurityDescriptorOwner
RegGetKeySecurity
GetSecurityDescriptorDacl
GetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CloseEventLog
ReadEventLogW
OpenEventLogW
NotifyServiceStatusChangeW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
SetNamedSecurityInfoW
CryptReleaseContext
CryptGetHashParam
CryptImportKey
CryptDestroyHash
CryptHashData
CryptDeriveKey
CryptCreateHash
CryptVerifySignatureW
CryptDecrypt
CryptAcquireContextW
CryptDestroyKey
RegCloseKey
QueryServiceStatusEx
RegQueryValueExW
RegEnumValueW
ControlService
EnumDependentServicesW
StartServiceW
RegDeleteValueW

shell32

DragFinish
ExtractIconW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetPropertyStoreFromParsingName
SHGetSpecialFolderPathW
DragQueryPoint
DragQueryFileW
CommandLineToArgvW
DragAcceptFiles
Shell_NotifyIconW
SHGetFileInfoW
ord6
ExtractIconExW
SHGetStockIconInfo
SHCreateItemFromParsingName
ShellExecuteW
SHCreateDirectoryExW
ord155
SHOpenFolderAndSelectItems
ord190
SHChangeNotify
SHGetFolderPathW
ShellExecuteExW

ole32

CoSetProxyBlanket
StringFromGUID2
OleIsCurrentClipboard
OleFlushClipboard
OleGetClipboard
OleSetClipboard
DoDragDrop
RegisterDragDrop
CoLockObjectExternal
ReleaseStgMedium
RevokeDragDrop
OleUninitialize
OleInitialize
PropVariantClear
CoInitializeEx
CoTaskMemFree
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
CoUninitialize

ws2_32

WSAStartup
WSACleanup

comctl32

ImageList_DragLeave
ord16
ord17
ImageList_Create
ImageList_Destroy
ImageList_GetImageCount
ImageList_Add
ImageList_SetBkColor
ImageList_Draw
ImageList_Replace
ImageList_Remove
ImageList_GetIconSize
ImageList_GetImageInfo
ImageList_Copy
ImageList_ReplaceIcon
ImageList_BeginDrag
ImageList_SetDragCursorImage
ImageList_DragEnter
ImageList_EndDrag
ImageList_DragMove

rpcrt4

RpcStringFreeW
UuidToStringW

oleacc

LresultFromObject
CreateStdAccessibleObject

uxtheme

IsAppThemed
IsThemeActive
IsThemePartDefined
GetCurrentThemeName
GetThemeBackgroundExtent
GetThemeSysFont
GetThemeSysColor
GetThemeInt
GetThemePartSize
SetWindowTheme
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeMargins
DrawThemeParentBackground
GetThemeColor
GetThemeFont
IsThemeBackgroundPartiallyTransparent
GetThemeBackgroundContentRect

shlwapi

ord219
PathMatchSpecW
SHAutoComplete
AssocQueryStringW
ord12

imagehlp

ImageLoad
ImageUnload

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CryptDecodeObject
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CryptMsgClose

winhttp

WinHttpQueryDataAvailable
WinHttpConnect
WinHttpSetStatusCallback
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpOpen

propsys

PSGetPropertyKeyFromName
PSFormatForDisplayAlloc

mf

MFCreateTranscodeProfile
MFGetService
MFCreateMediaSession
MFCreateTranscodeTopology
MFTranscodeGetAudioOutputAvailableTypes

mfplat

MFShutdown
MFStartup
MFCreateSourceResolver
MFCreateMediaType
MFCreateMFByteStreamOnStream
MFCreateAttributes
MFCreateMemoryBuffer
MFCreateSample

mfreadwrite

MFCreateSourceReaderFromByteStream
MFCreateSourceReaderFromURL

avrt

AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsW

msimg32

GradientFill
AlphaBlend

gdi32

Rectangle
PolyPolygon
Pie
MaskBlt
GetPixel
SetBkMode
GetObjectType
GetClipBox
ExtFloodFill
Ellipse
Arc
SetStretchBltMode
StretchBlt
GetTextExtentPoint32W
GetStockObject
GetWindowExtEx
GetViewportExtEx
GetGraphicsMode
CreateSolidBrush
OffsetRgn
GetRegionData
ExtCreateRegion
GetObjectW
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmapIndirect
CreateBitmap
BitBlt
GetOutlineTextMetricsW
DeleteObject
CreateFontIndirectW
RoundRect
EndPage
StartPage
EndDoc
StartDocW
SetAbortProc
EnumFontFamiliesExW
GetSystemPaletteEntries
CreateDCW
PlayEnhMetaFile
GetEnhMetaFileHeader
GetEnhMetaFileW
DeleteEnhMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
SetViewportOrgEx
SetDIBColorTable
GetDIBColorTable
CreateDIBSection
GetDIBits
CreateDIBitmap
CreateICW
GetTextExtentExPointW
GetCharABCWidthsW
CreateRectRgnIndirect
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
RectInRegion
PtInRegion
GetRgnBox
GdiFlush
SetBrushOrgEx
GetTextMetricsW
SelectPalette
SelectObject
RealizePalette
GetDeviceCaps
ExcludeClipRect
CreateRectRgn
SetTextColor
SetBkColor
EqualRgn
CombineRgn
MoveToEx
LineTo
GetBkColor
ExtCreatePen
CreatePen
CreatePatternBrush
CreateHatchBrush
SetWindowOrgEx
SetWindowExtEx
SetViewportExtEx
PolyBezier
Polyline
Polygon
LPtoDP
DPtoLP
CreatePolygonRgn
ExtTextOutW
ModifyWorldTransform
SetWorldTransform
GetWorldTransform
SetROP2
StretchDIBits
SetPolyFillMode
SetPixel
GetLayout
SetLayout
SetMapMode
SetGraphicsMode
ExtSelectClipRgn
SelectClipRgn

winspool.drv

OpenPrinterW
GetPrinterW
DocumentPropertiesW
ClosePrinter

comdlg32

PageSetupDlgW
ChooseFontW
ChooseColorW
CommDlgExtendedError
PrintDlgW
GetSaveFileNameW
GetOpenFileNameW

oleaut32

SafeArrayUnlock
SysStringLen
SafeArrayLock
VariantClear
SysAllocString
SysFreeString
VariantInit
VarBstrFromCy
SystemTimeToVariantTime
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetVartype

Exports

Exports

??0UniteFxControl@@QEAA@$$QEAV0@@Z
??0UniteFxControl@@QEAA@XZ
??1UniteFxControl@@QEAA@XZ
??4UniteFxControl@@QEAAAEAV0@$$QEAV0@@Z
?PlaySoundData@UniteFxControl@@QEAAJAEAV?$vector@EV?$allocator@E@std@@@std@@AEBVAudioFormat@@@Z
?PlaySoundFile@UniteFxControl@@QEAAJPEB_WAEA_NAEAUUfxMediaControl@@@Z
?PlaySoundFileEx@UniteFxControl@@QEAAJPEAVAudioFile@@AEA_NAEAUUfxMediaControl@@@Z
?Stop@UniteFxControl@@QEAAJXZ

Sections

.text
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 187KB - Virtual size: 418KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 281KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SoundpadService.exe
.exe windows:6 windows x64 arch:x64

dead6bcd2456b640f6ea7e628795c697

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:bd:46:a5:9a:9a:84:f8:8e:aa:72:ee:ee:d2:88:ba
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-10-2022 00:00

Not After

25-10-2025 23:59

Subject

CN=Arthur Lepp,O=Arthur Lepp,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2e:2b:81:9a:2d:da:9e:b5:6c:68:4d:98:eb:26:1f:af:03:73:86:76:1d:c8:a8:90:fe:d7:37:30:b0:f1:ac:75
Signer

Actual PE Digest

2e:2b:81:9a:2d:da:9e:b5:6c:68:4d:98:eb:26:1f:af:03:73:86:76:1d:c8:a8:90:fe:d7:37:30:b0:f1:ac:75

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\dev\UniteFx\x64\Release\SoundpadService.pdb

Imports

kernel32

CreateEventW
GetLastError
ResetEvent
WaitForSingleObject
SetEvent
UnmapViewOfFile
Sleep
WriteConsoleW
SetEndOfFile
HeapSize
SetStdHandle
CreateEventExW
FindNextFileW
GetCurrentProcess
CreateMutexW
InitializeCriticalSectionEx
FindClose
CreateFileW
GetFileAttributesW
ReleaseMutex
OpenFileMappingW
OpenProcess
CreateToolhelp32Snapshot
FormatMessageW
GetFileAttributesExW
Process32NextW
DeleteFileW
Process32FirstW
CloseHandle
GetProcAddress
LocalFree
MoveFileExW
GetModuleHandleW
QueryFullProcessImageNameW
CreateFileMappingW
MapViewOfFile
CreateDirectoryW
GetCurrentThreadId
GetLocalTime
GetCurrentProcessId
HeapFree
HeapAlloc
GetProcessHeap
WaitForSingleObjectEx
GetExitCodeThread
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetLocaleInfoEx
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
ReadFile
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
HeapReAlloc
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
RtlUnwind

user32

GetShellWindow
GetDesktopWindow
GetWindowThreadProcessId
MapVirtualKeyW
GetMessageW
GetForegroundWindow
SendMessageW
GetMonitorInfoW
GetRawInputData
GetAsyncKeyState
RegisterRawInputDevices
UnhookWindowsHookEx
SetWindowsHookExW
PostMessageW
TranslateMessage
MonitorFromWindow
GetWindowInfo
RegisterClassW
CallNextHookEx
DispatchMessageW
PostQuitMessage
DefWindowProcW
CreateWindowExW
SendInput

gdi32

GetStockObject

advapi32

SetEntriesInAclW
InitializeSecurityDescriptor
FreeSid
GetNamedSecurityInfoW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
RegOpenKeyExW
RegQueryValueExW
SetNamedSecurityInfoW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW

Sections

.text
Size: 417KB - Virtual size: 417KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TTS.dll
.dll windows:6 windows x64 arch:x64

4a0dd77db4bf587d207da87187187bbc

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:bd:46:a5:9a:9a:84:f8:8e:aa:72:ee:ee:d2:88:ba
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-10-2022 00:00

Not After

25-10-2025 23:59

Subject

CN=Arthur Lepp,O=Arthur Lepp,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0c:51:8f:87:c0:90:ca:a7:d1:db:01:cd:32:4d:70:e7:d3:e8:03:af:42:b7:04:4f:af:1c:03:e5:b8:69:ec:74
Signer

Actual PE Digest

0c:51:8f:87:c0:90:ca:a7:d1:db:01:cd:32:4d:70:e7:d3:e8:03:af:42:b7:04:4f:af:1c:03:e5:b8:69:ec:74

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\dev\UniteFx\x64\Release\TTS.pdb

Imports

kernel32

Sleep
LoadLibraryW
FormatMessageW
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetStartupInfoW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

ole32

CoCreateFreeThreadedMarshaler

oleaut32

SetErrorInfo
GetErrorInfo
SysFreeString
SysAllocString
SysStringLen

Exports

Exports

CleanUp
GetAvailableVoiceCount
GetAvailableVoices
GetPreparedSpeech
PrepareTextToSpeech

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UniteFx.dll
.dll regsvr32 windows:6 windows x64 arch:x64

d5bb1b45cba52dbc2fc1c4cbc3771fcd

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:bd:46:a5:9a:9a:84:f8:8e:aa:72:ee:ee:d2:88:ba
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26-10-2022 00:00

Not After

25-10-2025 23:59

Subject

CN=Arthur Lepp,O=Arthur Lepp,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f9:70:6e:10:6a:a6:c5:cd:13:cc:85:25:fd:a3:5c:5b:b8:0b:4a:39:0f:30:f3:8d:22:3f:a5:3e:fd:cf:2c:18
Signer

Actual PE Digest

f9:70:6e:10:6a:a6:c5:cd:13:cc:85:25:fd:a3:5c:5b:b8:0b:4a:39:0f:30:f3:8d:22:3f:a5:3e:fd:cf:2c:18

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\dev\UniteFx\x64\Release\UniteFx.pdb

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
CloseHandle
UnmapViewOfFile
CreateEventExW
FindNextFileW
GetCurrentProcess
CreateMutexW
InitializeCriticalSectionEx
FindClose
CreateFileW
GetFileAttributesW
ReleaseMutex
OpenFileMappingW
FormatMessageW
GetLastError
GetFileAttributesExW
DeleteFileW
GetProcAddress
LocalFree
MoveFileExW
GetModuleHandleW
CreateFileMappingW
MapViewOfFile
CreateDirectoryW
GetCurrentThreadId
GetLocalTime
GetCurrentProcessId
WaitForSingleObjectEx
GetExitCodeThread
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
QueryPerformanceCounter
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
EncodePointer
DecodePointer
LCMapStringEx
InitializeCriticalSection
GetSystemTimeAsFileTime
GetLocaleInfoEx
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
ReadFile
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
HeapReAlloc
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
HeapSize
SetEndOfFile
WriteConsoleW
DeleteCriticalSection
HeapFree
HeapAlloc
GetProcessHeap
ResetEvent
SetEvent
WaitForSingleObject
RtlUnwind

advapi32

AllocateAndInitializeSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
FreeSid
InitializeSecurityDescriptor
SetEntriesInAclW
SetSecurityDescriptorDacl
RegNotifyChangeKeyValue
RegCloseKey
RegDeleteKeyExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

ole32

PropVariantClear
StringFromGUID2
CoTaskMemAlloc
CLSIDFromString
CoCreateInstance

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 426KB - Virtual size: 425KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
languages/ar/translation.mo
languages/bg_BG/translation.mo
languages/cs/translation.mo
languages/da/translation.mo
languages/de/translation.mo
languages/el_GR/translation.mo
languages/es_ES/translation.mo
languages/et_EE/translation.mo
languages/fi/translation.mo
languages/fr/translation.mo
languages/he_IL/translation.mo
languages/hi_IN/translation.mo
languages/hr_HR/translation.mo
languages/hu_HU/translation.mo
languages/id_ID/translation.mo
languages/it/translation.mo
languages/ja/translation.mo
languages/ko/translation.mo
languages/lt_LT/translation.mo
languages/lv_LV/translation.mo
languages/ms_MY/translation.mo
languages/nb_NO/translation.mo
languages/nl/translation.mo
languages/pl/translation.mo
languages/pt_BR/translation.mo
languages/ro_RO/translation.mo
languages/ru/translation.mo
languages/sk_SK/translation.mo
languages/sl_SI/translation.mo
languages/sr_RS/translation.mo
languages/sv/translation.mo
languages/th/translation.mo
languages/tr/translation.mo
languages/uk/translation.mo
languages/vi_VN/translation.mo
languages/zh_CN/translation.mo
sounds/ba dum tss.mp3
sounds/cue.mp3
sounds/firework.mp3
sounds/notify/auto-keys-disabled.m4a
sounds/notify/auto-keys-enabled.m4a
sounds/notify/default.m4a
sounds/notify/disabled.m4a
sounds/notify/enabled.m4a
sounds/notify/hotbar-page-1.m4a
sounds/notify/hotbar-page-2.m4a
sounds/notify/hotbar-page-3.m4a
sounds/notify/hotbar-page-4.m4a
sounds/notify/hotbar-page-5.m4a
sounds/notify/hotbar-page-6.m4a
sounds/notify/hotbar-page-7.m4a
sounds/notify/hotbar-page-8.m4a
sounds/notify/hotbar-page-9.m4a
sounds/notify/hotkeys-disabled.m4a
sounds/notify/hotkeys-enabled.m4a
sounds/notify/microphone.m4a
sounds/notify/recording-finished.m4a
sounds/notify/recording-microphone.m4a
sounds/notify/recording-speakers.m4a
sounds/notify/recording.m4a
sounds/notify/speakers.m4a
sounds/scream.mp3
sounds/white_noise.mp3

Sharing

General

Malware Config

Signatures

Files

edfa3f01383da0e9692b10e9bbd874f5

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

3e:bd:46:a5:9a:9a:84:f8:8e:aa:72:ee:ee:d2:88:baCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

19:d0:1d:3d:f2:de:f8:d4:7a:0f:af:d1:d8:fe:be:64:e8:f5:a9:f8:26:29:66:53:55:86:bc:be:46:43:4b:4dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

usp10

dwmapi

kernel32

user32

advapi32

shell32

ole32

ws2_32

comctl32

rpcrt4

oleacc

uxtheme

shlwapi

imagehlp

version

crypt32

winhttp

propsys

mf

mfplat

mfreadwrite

avrt

msimg32

gdi32

winspool.drv

comdlg32

oleaut32

Exports

Exports

Sections

.text Size: 7.1MB - Virtual size: 7.1MB

.rdata Size: 2.7MB - Virtual size: 2.7MB

.data Size: 187KB - Virtual size: 418KB

.pdata Size: 281KB - Virtual size: 280KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 157KB - Virtual size: 156KB

dead6bcd2456b640f6ea7e628795c697

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

3e:bd:46:a5:9a:9a:84:f8:8e:aa:72:ee:ee:d2:88:baCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

3e:bd:46:a5:9a:9a:84:f8:8e:aa:72:ee:ee:d2:88:ba
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

19:d0:1d:3d:f2:de:f8:d4:7a:0f:af:d1:d8:fe:be:64:e8:f5:a9:f8:26:29:66:53:55:86:bc:be:46:43:4b:4d
Signer

.text
Size: 7.1MB - Virtual size: 7.1MB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 187KB - Virtual size: 418KB

.pdata
Size: 281KB - Virtual size: 280KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 157KB - Virtual size: 156KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

3e:bd:46:a5:9a:9a:84:f8:8e:aa:72:ee:ee:d2:88:ba
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

2e:2b:81:9a:2d:da:9e:b5:6c:68:4d:98:eb:26:1f:af:03:73:86:76:1d:c8:a8:90:fe:d7:37:30:b0:f1:ac:75
Signer

.text
Size: 417KB - Virtual size: 417KB

.rdata
Size: 95KB - Virtual size: 95KB

.data
Size: 8KB - Virtual size: 16KB

.pdata
Size: 18KB - Virtual size: 17KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

3e:bd:46:a5:9a:9a:84:f8:8e:aa:72:ee:ee:d2:88:ba
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

0c:51:8f:87:c0:90:ca:a7:d1:db:01:cd:32:4d:70:e7:d3:e8:03:af:42:b7:04:4f:af:1c:03:e5:b8:69:ec:74
Signer

.text
Size: 87KB - Virtual size: 87KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 5KB - Virtual size: 9KB

.pdata
Size: 6KB - Virtual size: 5KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate