blankgrabber | R6-cheats_promanners-main[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

R6-cheats_promanners-main.zip
Size

27.7MB
MD5

649aafec992a45ae75dbb3d19292e9db
SHA1

9f38bd3b6075049c8f8847737aec482a07b83108
SHA256

952031a5cd13ce3f1cb3b547fb062bf6b5bca288fa793f7968820ffc6a902324
SHA512

8bfb77ae7a822c7fd3e11eea233ba733ffd9ff935b6855b66f903c337e7c7acecc065f0feffa08d391cebfe66bbacbfac3e10c13767a1a1edb521f79543f5dee
SSDEEP

786432:TexfNtE48bjUhot8hLBpdnGVdZhtPLRQf9JjA88JIO:TexVtx8bAhotaNznGhhPQF288KO

Score

10^/10

blankgrabber

Malware Config

Signatures

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
static1/unpack003/�׉�Wy.pyc	blankgrabber

Blankgrabber family
blankgrabber

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Installer.exe
unpack001/R6-cheats_promanners-main/dav1d.dll

Files

R6-cheats_promanners-main.zip
.zip
R6-cheats_promanners-main/CSERHelper.dll
.dll windows:4 windows x86 arch:x86

dc33390e11f40d35aacb3b7595b60d08

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

08:4c:af:4d:f4:99:14:1d:40:4b:71:99:aa:2c:21:31
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/09/2015, 00:00

Not After

03/10/2018, 12:00

Subject

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:b1:01:21:ff:0d:6b:21:e2:db:68:ef:fb:a5:ce:d5:6d:be:ae:a5
Signer

Actual PE Digest

7b:b1:01:21:ff:0d:6b:21:e2:db:68:ef:fb:a5:ce:d5:6d:be:ae:a5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

u:\p4clients\taylor_pubkeys\ThirdPartyCode\DebugNet\Release\BugslayerUtil.pdb

Imports

dbghelp

SymSetOptions
SymGetSymFromAddr
SymGetOptions
SymLoadModule64
SymGetModuleInfo64
SymGetLineFromAddr64
SymGetSymFromAddr64
SymGetModuleBase64
SymLoadModule
SymCleanup
SymInitialize
StackWalk64
UnDecorateSymbolName
SymFunctionTableAccess64

kernel32

GetThreadContext
OutputDebugStringW
WriteFile
IsDebuggerPresent
GetProfileIntW
SearchPathW
LoadLibraryW
GetProcAddress
MultiByteToWideChar
GetModuleFileNameA
CreateFileA
WideCharToMultiByte
GetACP
RaiseException
GetModuleHandleW
SetUnhandledExceptionFilter
IsBadCodePtr
IsBadReadPtr
FormatMessageW
lstrlenA
lstrcpynW
ReadProcessMemory
GlobalAlloc
GetCurrentProcess
GetCurrentThread
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
LocalFree
ExitProcess
OutputDebugStringA
VirtualQueryEx
GetVersionExW
DisableThreadLibraryCalls
VirtualQuery
VirtualProtect
IsBadStringPtrA
IsBadStringPtrW
CreateFileW
CloseHandle
GetCurrentThreadId
OpenProcess
GetThreadPriority
SetThreadPriority
OpenThread
SuspendThread
ResumeThread
FreeLibrary
GlobalLock
GlobalUnlock
GetLocaleInfoW
FindResourceExW
LoadResource
LockResource
GetProcessHeap
HeapFree
lstrlenW
GetLastError
HeapAlloc
GetCurrentProcessId
SetLastError
InterlockedExchange
LocalAlloc
IsBadWritePtr
GlobalFree
HeapReAlloc
TlsSetValue
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetModuleHandleA
TerminateProcess
HeapSize
TlsFree
TlsGetValue
TlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemInfo
LCMapStringA
LCMapStringW
InitializeCriticalSection
SetFilePointer
GetOEMCP
GetCPInfo
LoadLibraryA
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
RtlUnwind
SetStdHandle
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
FlushFileBuffers

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyW
RegCloseKey

Exports

Exports

AddClientDV
AddCrashHandlerLimitModule
AddDiagAssertModule
AllocAndFillProcessModuleList
BSUAnsi2Wide
BSUGetModuleBaseNameA
BSUGetModuleBaseNameW
BSUGetModuleFileNameExA
BSUGetModuleFileNameExW
BSUIsInteractiveUser
BSUSetCurrentThreadNameA
BSUSetCurrentThreadNameW
BSUSetThreadNameA
BSUSetThreadNameW
BSUSymInitializeA
BSUSymInitializeW
BSUWide2Ansi
CreateCurrentProcessCrashDumpA
CreateCurrentProcessCrashDumpW
DiagAssertA
DiagAssertW
DiagOutputA
DiagOutputW
GetFaultReason
GetFirstStackTraceString
GetLimitModuleCount
GetLimitModulesArray
GetLoadedModules
GetNextStackTraceString
GetProcessThreadIds
GetRegisterString
GetSuperAssertionCount
HookImportedFunctionsByNameA
HookImportedFunctionsByNameW
HookOrdinalExportA
HookOrdinalExportW
IsMiniDumpFunctionAvailable
IsNT
IsNT4
IsServer2003
IsServer2003orBetter
IsW2K
IsW2KorBetter
IsXP
IsXPorBetter
MemStressInitializeA
MemStressInitializeW
MemStressTerminate
SetCrashHandlerFilter
SetDiagAssertFile
SetDiagAssertOptions
SetDiagOutputFile
SnapCurrentProcessMiniDumpA
SnapCurrentProcessMiniDumpW
SuperAssertionA
SuperAssertionW
ValidateAllBlocks

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R6-cheats_promanners-main/GameOverlayRenderer.dll
.dll windows:6 windows x86 arch:x86

8c7ff060cb78c3e8c05369cec97a3996

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07/10/2021, 00:00

Not After

09/10/2024, 23:59

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6f:88:57:d4:a7:0d:08:ee:3f:b1:af:a9:94:49:a8:c6:e1:b7:d2:f5:0d:eb:f2:96:7b:68:43:d9:79:48:dd:6f
Signer

Actual PE Digest

6f:88:57:d4:a7:0d:08:ee:3f:b1:af:a9:94:49:a8:c6:e1:b7:d2:f5:0d:eb:f2:96:7b:68:43:d9:79:48:dd:6f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\buildslave\steam_rel_client_hotfix_win32\build\src\overlay\gameoverlayrenderer\Release\GameOverlayRenderer.pdb

Imports

kernel32

GetTickCount
GetModuleFileNameW
CreateFileA
ReadFile
GetExitCodeThread
GetThreadContext
SetThreadContext
VirtualProtectEx
GetModuleHandleW
MultiByteToWideChar
GetCurrentProcessId
LocalFree
FormatMessageA
GetLocaleInfoW
SetEvent
ResetEvent
CreateEventA
WaitForMultipleObjects
OpenProcess
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCommandLineA
SetEnvironmentVariableA
GetHandleInformation
SetHandleInformation
SetLastError
OpenEventW
OpenThread
SuspendThread
ResumeThread
CreateProcessA
CreateProcessW
GetSystemWindowsDirectoryW
VirtualFree
VirtualQueryEx
DisableThreadLibraryCalls
GetModuleFileNameA
Module32First
Module32Next
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
WriteFile
ConnectNamedPipe
DisconnectNamedPipe
GetOverlappedResult
CreateNamedPipeA
DuplicateHandle
ReleaseSemaphore
TerminateProcess
CreateThread
CreateSemaphoreA
SetEnvironmentVariableW
CreateFileW
GetModuleHandleExW
GetFullPathNameW
WriteConsoleW
SetEndOfFile
HeapSize
SetStdHandle
GetFileSizeEx
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExA
GetConsoleCP
FlushFileBuffers
HeapReAlloc
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetFileType
GetStdHandle
HeapAlloc
HeapFree
ExitProcess
InterlockedFlushSList
RaiseException
RtlUnwind
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
CreateEventW
WaitForSingleObjectEx
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
WriteProcessMemory
VirtualAllocEx
VirtualQuery
VirtualProtect
GetSystemInfo
FlushInstructionCache
GetProcessId
GetCurrentProcess
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetModuleHandleExA
WaitForSingleObject
ReleaseMutex
LoadLibraryW
LoadLibraryA
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
EncodePointer
InitializeCriticalSectionEx
InitOnceExecuteOnce
OutputDebugStringA
lstrcmpA
VerSetConditionMask
VerifyVersionInfoW
ExpandEnvironmentStringsW
lstrcmpW
LocalAlloc
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetLastError
WideCharToMultiByte
lstrcatW
lstrcpyW
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentThreadId
CreateMutexA
CloseHandle
OutputDebugStringW
GetEnvironmentVariableA
GetProcAddress
GetModuleHandleA
SetThreadPriority
GetCurrentThread
Sleep
IsDebuggerPresent

user32

ClientToScreen
GetDisplayConfigBufferSizes
QueryDisplayConfig
GetClientRect
MonitorFromWindow
GetMonitorInfoW
ReleaseDC
DisplayConfigGetDeviceInfo
EnumWindows
SendMessageTimeoutW
SendMessageTimeoutA
GetRawInputDeviceList
GetRawInputDeviceInfoA
CreateIconIndirect
LoadImageW
DestroyIcon
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowThreadProcessId
SetClassLongW
GetClassLongW
SetCursor
SetCursorPos
ShowCursor
GetMessageExtraInfo
GetDC
IsWindowUnicode
MapVirtualKeyExW
SendInput
VkKeyScanExW
GetKeyState
GetActiveWindow
IsChild
PostMessageW
PostMessageA
TranslateMessage
SetCaretPos
DestroyCaret
CreateCaret
GetWindowRect
GetKeyboardLayout
GetKeyboardLayoutList
ActivateKeyboardLayout
WindowFromDC
GetSystemMetrics
SetWindowLongW
AdjustWindowRect
GetForegroundWindow
IsIconic
SetWindowPos
ShowWindow

gdi32

CreateDIBSection
DeleteObject
GetDeviceCaps
CreateBitmap

advapi32

GetTokenInformation
RegOpenKeyA
RegQueryValueExA
IsValidSid
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
AddAccessAllowedAce
CopySid
CreateWellKnownSid
GetLengthSid
SetSecurityDescriptorDacl
InitializeAcl
InitializeSecurityDescriptor

ole32

CoUninitialize
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
CoCreateInstance

oleaut32

VariantInit
SysAllocString

winmm

timeBeginPeriod

imm32

ImmCreateContext
ImmDestroyContext
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListCountW
ImmGetCandidateListW
ImmGetConversionStatus
ImmSetConversionStatus
ImmGetProperty
ImmGetOpenStatus
ImmSetOpenStatus
ImmNotifyIME
ImmSetCandidateWindow

cfgmgr32

CM_Get_Parent
CM_Locate_DevNodeA
CM_Get_Device_IDA

psapi

GetModuleInformation
GetModuleBaseNameA

Exports

Exports

BOverlayNeedsPresent
IsOverlayEnabled
OverlayHookD3D3
SetNotificationInset
SetNotificationPosition
SteamOverlayIsUsingGamepad
SteamOverlayIsUsingKeyboard
SteamOverlayIsUsingMouse
ValveHookScreenshots
ValveIsScreenshotsHooked
VirtualFreeWrapper
VulkanSteamOverlayGetScaleFactors
VulkanSteamOverlayPresent
VulkanSteamOverlayProcessCapturedFrame

Sections

.text
Size: 833KB - Virtual size: 832KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R6-cheats_promanners-main/Installer.rar
.rar
Installer.exe
.exe windows:6 windows x64 arch:x64

c595f1660e1a3c84f4d9b0761d23cd7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
AddVectoredContinueHandler
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateMutexA
CreateSemaphoreA
CreateThread
CreateWaitableTimerExW
DeleteAtom
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
FormatMessageA
FreeEnvironmentStringsW
GetAtomNameA
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetHandleInformation
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RaiseFailFastException
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetLastError
SetProcessAffinityMask
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler

msvcrt

___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_lock
_memccpy
_onexit
_setjmp
_strdup
_ultoa
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
longjmp
malloc
memcpy
memmove
memset
printf
realloc
signal
strerror
strlen
strncmp
vfprintf
wcslen

Exports

Exports

_cgo_dummy_export

Sections

.text
Size: 11.6MB - Virtual size: 11.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12.9MB - Virtual size: 12.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 653KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 269KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R6-cheats_promanners-main/Installer_patch.exe
.exe windows:6 windows x64 arch:x64

72c4e339b7af8ab1ed2eb3821c98713a

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

29/09/2021, 00:00

Not After

28/09/2024, 23:59

Subject

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:ff:a1:aa:00:a5:f6:5f:9d:4a:68:40:bf:ab:af:b8:f3:8a:84:64:5e:b7:8b:59:85:2d:88:c2:22:26:e0:83
Signer

Actual PE Digest

4c:ff:a1:aa:00:a5:f6:5f:9d:4a:68:40:bf:ab:af:b8:f3:8a:84:64:5e:b7:8b:59:85:2d:88:c2:22:26:e0:83

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW

comctl32

ord380

kernel32

GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
LCMapStringW
CompareStringW
FlsFree
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
GetEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsSetValue
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue

advapi32

OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

gdi32

SelectObject
DeleteObject
CreateFontIndirectW

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
�׉�Wy.pyc
R6-cheats_promanners-main/README.md
R6-cheats_promanners-main/crashhandler.dll.old
.dll windows:6 windows x86 arch:x86

05c726fc1cf945d675bbf9861939ca4e

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07/10/2021, 00:00

Not After

09/10/2024, 23:59

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ef:98:d5:fb:fa:ac:7e:dd:b6:0f:ba:e0:26:4f:ef:2d:bd:7e:68:96:71:c7:29:53:48:c8:13:c0:b2:51:3e:83
Signer

Actual PE Digest

ef:98:d5:fb:fa:ac:7e:dd:b6:0f:ba:e0:26:4f:ef:2d:bd:7e:68:96:71:c7:29:53:48:c8:13:c0:b2:51:3e:83

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\buildslave\steam_rel_client_hotfix_win32\build\src\crashhandler\Release\crashhandler.pdb

Imports

kernel32

OutputDebugStringW
CloseHandle
GetLastError
CreateEventA
Sleep
CreateProcessW
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
LCMapStringEx
InitializeCriticalSectionEx
WaitNamedPipeW
GetSystemTime
RtlCaptureContext
EnterCriticalSection
GetCurrentProcess
ReleaseSemaphore
InterlockedDecrement
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetCurrentThreadId
TerminateThread
LoadLibraryW
CreateThread
DeleteCriticalSection
CreateSemaphoreW
InterlockedIncrement
OpenThread
VirtualQueryEx
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetCommandLineW
GetCurrentProcessId
GlobalMemoryStatusEx
VirtualAlloc
GetModuleFileNameA
LoadLibraryA
LocalAlloc
LocalFree
WideCharToMultiByte
GetCommandLineA
GetProcessHeap
HeapSetInformation
HeapLock
HeapUnlock
HeapWalk
HeapQueryInformation
GlobalAlloc
GlobalUnlock
GlobalLock
LoadLibraryExA
MultiByteToWideChar
RaiseException
SetLastError
TryEnterCriticalSection
SetEvent
ResetEvent
WaitForMultipleObjects
GetCurrentThread
GetExitCodeThread
DebugBreak
GetProcessHeaps
SetEnvironmentVariableW
WriteFile
CreateDirectoryW
GetFileAttributesW
GetFullPathNameW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetDriveTypeW
GetFileSizeEx
ReadFile
SetEndOfFile
UnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetStartupInfoW
InitializeSListHead
RtlUnwind
InterlockedFlushSList
EncodePointer
VirtualQuery
ExitProcess
GetModuleHandleExW
HeapSize
HeapValidate
GetFileType
HeapFree
HeapAlloc
GetStdHandle
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetFilePointerEx
HeapReAlloc
DecodePointer
SetStdHandle
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
WriteConsoleW
TransactNamedPipe
SetNamedPipeHandleState
OutputDebugStringA
GetCurrentDirectoryW
CreateFileW

psapi

GetModuleBaseNameW
GetProcessMemoryInfo
EnumProcessModules

user32

MessageBoxA
GetDesktopWindow
EnumWindows
GetWindowThreadProcessId
SetDlgItemInt
EndDialog
DialogBoxParamA
IsWindowVisible
GetWindowRect
GetWindowTextLengthA
EmptyClipboard
SetClipboardData
GetDlgItemInt
SetDlgItemTextA
OpenClipboard
CloseClipboard
GetDlgItem
wsprintfA
SetWindowPos

shell32

CommandLineToArgvW

wininet

InternetReadFile
HttpAddRequestHeadersW
InternetConnectW
InternetCloseHandle
HttpSendRequestW
HttpQueryInfoW
InternetOpenW
InternetQueryDataAvailable
HttpOpenRequestW
InternetCrackUrlW

Exports

Exports

Breakpad_SetSteamID
CreateInterface
g_dwDllEntryThreadId

Sections

.text
Size: 255KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 305KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R6-cheats_promanners-main/crashhandler64.dll
.dll windows:6 windows x64 arch:x64

cb076cef214ff70d2290afce5b4b1b83

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07/10/2021, 00:00

Not After

09/10/2024, 23:59

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:f8:23:88:4c:19:fc:56:be:82:fd:5a:62:b1:06:39:16:6b:99:48:b1:db:16:16:15:7c:01:2c:f8:44:e5:8b
Signer

Actual PE Digest

0d:f8:23:88:4c:19:fc:56:be:82:fd:5a:62:b1:06:39:16:6b:99:48:b1:db:16:16:15:7c:01:2c:f8:44:e5:8b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\buildslave\steam_rel_client_hotfix_win64\build\src\crashhandler\win64\Release\crashhandler64.pdb

Imports

kernel32

OutputDebugStringW
CloseHandle
GetLastError
CreateEventA
Sleep
GetCurrentProcessId
CreateProcessW
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
DecodePointer
LCMapStringEx
InitializeCriticalSectionEx
GetSystemTime
RtlCaptureContext
VirtualQueryEx
GetCurrentProcess
SetUnhandledExceptionFilter
CreateThread
GetCurrentThreadId
OpenThread
TerminateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
LoadLibraryW
IsDebuggerPresent
TerminateProcess
QueryPerformanceCounter
QueryPerformanceFrequency
RtlCaptureStackBackTrace
GetCommandLineW
GlobalMemoryStatusEx
VirtualAlloc
VirtualFree
GetModuleFileNameA
LoadLibraryA
LocalAlloc
LocalFree
WideCharToMultiByte
GetCommandLineA
HeapAlloc
HeapFree
GetProcessHeap
HeapSetInformation
HeapLock
HeapUnlock
HeapWalk
HeapQueryInformation
GlobalAlloc
GlobalUnlock
GlobalLock
LoadLibraryExA
MultiByteToWideChar
RaiseException
SetLastError
TryEnterCriticalSection
SetEvent
ResetEvent
WaitForMultipleObjects
GetExitCodeThread
DebugBreak
GetProcessHeaps
SetEnvironmentVariableW
WriteFile
CreateDirectoryW
GetFileAttributesW
GetFullPathNameW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetDriveTypeW
GetFileSizeEx
ReadFile
SetEndOfFile
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
EncodePointer
ExitProcess
GetModuleHandleExW
HeapSize
HeapValidate
GetFileType
GetStdHandle
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetFilePointerEx
HeapReAlloc
SetStdHandle
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
WriteConsoleW
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
OutputDebugStringA
GetCurrentDirectoryW
CreateFileW
RtlUnwind

psapi

GetModuleBaseNameW
EnumProcessModules
GetProcessMemoryInfo

user32

EnumWindows
GetWindowThreadProcessId
GetDesktopWindow
EmptyClipboard
GetDlgItem
EndDialog
MessageBoxA
GetWindowRect
SetDlgItemTextA
GetWindowTextLengthA
SetClipboardData
GetDlgItemInt
CloseClipboard
SetDlgItemInt
OpenClipboard
wsprintfA
SetWindowPos
IsWindowVisible
DialogBoxParamA

shell32

CommandLineToArgvW

wininet

HttpQueryInfoW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetSetOptionW
InternetQueryDataAvailable
InternetReadFile
InternetConnectW
InternetCloseHandle
InternetCrackUrlW
InternetOpenW

Exports

Exports

Breakpad_SetSteamID
CreateInterface
g_dwDllEntryThreadId

Sections

.text
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R6-cheats_promanners-main/d3dcompiler_46.dll
.dll windows:6 windows x86 arch:x86

876b48ac5a1cad7160b32c8df9ab9938

Code Sign

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/07/2012, 20:50

Not After

26/10/2013, 20:50

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:49:55:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:45

Not After

10/01/2013, 20:55

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:15:3e:2c:66:21:b8:92:81:de:f4:46:5a:0c:6b:75:ed:d9:c1:78:60:6b:49:bd:b5:6e:90:86:c9:d5:74:9c
Signer

Actual PE Digest

ee:15:3e:2c:66:21:b8:92:81:de:f4:46:5a:0c:6b:75:ed:d9:c1:78:60:6b:49:bd:b5:6e:90:86:c9:d5:74:9c

Digest Algorithm

sha256

PE Digest Matches

true

e5:7a:17:c6:92:b3:05:15:01:cb:16:53:25:2e:4c:43:b6:42:04:37
Signer

Actual PE Digest

e5:7a:17:c6:92:b3:05:15:01:cb:16:53:25:2e:4c:43:b6:42:04:37

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D3DCompiler_46.pdb

Imports

msvcrt

_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
_vsnprintf
_strtoui64
sscanf
_isnan
strtoul
isxdigit
atof
setlocale
_strdup
_mbstrlen
_vsnwprintf
ceil
modf
strrchr
isalnum
_finite
_clearfp
_controlfp
malloc
_strnicmp
_fpclass
_purecall
strncmp
isspace
strstr
strchr
free
_stricmp
memmove
qsort
isalpha
toupper
atoi
isdigit
tolower
??2@YAPAXI@Z
getenv
??3@YAXPAX@Z
_except_handler4_common
wcsncpy_s
_wcsicmp
memcpy
memset
fclose
strcpy_s
strcat_s
bsearch
_CxxThrowException
_snwprintf_s
wcschr
iswdigit
__unDName
fread
fseek
_wfsopen
vsprintf_s
strncpy_s
wcstol
_wcsnicmp
_wsplitpath_s
towlower
wcscpy_s
??_U@YAPAXI@Z
??_V@YAXPAX@Z
swprintf_s
wcsncat_s
wcsrchr
_wmakepath_s
time
_wfullpath
_wcsdup
_wgetenv
_chsize
_close
_read
_write
_lseeki64
_get_osfhandle
_open_osfhandle
wcscat_s
ftell
sprintf_s
_mbscmp
_memicmp
wcsncmp
_wsopen
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
__CxxFrameHandler3
_ftol2
_ftol2_sse
floor

advapi32

CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegOpenKeyExW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExW

kernel32

SetLastError
LeaveCriticalSection
EnterCriticalSection
LocalFree
LocalAlloc
GetVersion
InterlockedDecrement
InterlockedIncrement
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
LCMapStringW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlCaptureContext
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
GetSystemInfo
VirtualAlloc
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
GetFileAttributesW
SetFileAttributesW
CopyFileExW
DeleteFileW
GetFileType
DeviceIoControl
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
SetFilePointer
FlushViewOfFile
MapViewOfFileEx
GetCurrentProcessId
GetModuleFileNameA
DisableThreadLibraryCalls
CreateFileW
GetLastError
GetFileSizeEx
ReadFile
CloseHandle
WriteFile
WideCharToMultiByte
FreeLibrary
lstrcmpiA
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
HeapCreate
HeapDestroy
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
Sleep
TlsAlloc
InterlockedExchange
TlsSetValue
TlsGetValue
TlsFree
GetFullPathNameW
GetFullPathNameA
GetEnvironmentVariableA
LoadLibraryExW
GetProcAddress

rpcrt4

UuidCreate

Exports

Exports

D3DAssemble
D3DCompile
D3DCompile2
D3DCompileFromFile
D3DCompressShaders
D3DCreateBlob
D3DDecompressShaders
D3DDisassemble
D3DDisassemble10Effect
D3DDisassemble11Trace
D3DDisassembleRegion
D3DGetBlobPart
D3DGetDebugInfo
D3DGetInputAndOutputSignatureBlob
D3DGetInputSignatureBlob
D3DGetOutputSignatureBlob
D3DGetTraceInstructionOffsets
D3DPreprocess
D3DReadFileToBlob
D3DReflect
D3DReturnFailure1
D3DSetBlobPart
D3DStripShader
D3DWriteBlobToFile
DebugSetMute

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R6-cheats_promanners-main/d3dcompiler_46_64.dll
.dll windows:6 windows x64 arch:x64

dbf56f70ee344f39500f2f3cafb3ea13

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:16:11:04:b4:88:38:8c:be:c3:00:00:00:00:00:16
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/08/2012, 17:49

Not After

30/11/2013, 17:49

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d6:98:68:09:b0:d3:8f:2e:5a:a3:cc:7d:cf:b8:84:e9:9f:77:0b:1b:e9:cd:ab:f5:20:95:f2:8d:25:20:9b:44
Signer

Actual PE Digest

d6:98:68:09:b0:d3:8f:2e:5a:a3:cc:7d:cf:b8:84:e9:9f:77:0b:1b:e9:cd:ab:f5:20:95:f2:8d:25:20:9b:44

Digest Algorithm

sha256

PE Digest Matches

true

d6:33:8f:ba:6f:aa:0f:71:25:56:1f:d7:ab:5f:ac:ff:52:9d:b5:cb
Signer

Actual PE Digest

d6:33:8f:ba:6f:aa:0f:71:25:56:1f:d7:ab:5f:ac:ff:52:9d:b5:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D3DCompiler_46.pdb

Imports

msvcrt

__dllonexit
_unlock
_lock
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_strtoui64
sscanf
_vsnprintf
_isnan
strtoul
isxdigit
atof
setlocale
_strdup
_mbstrlen
_vsnwprintf
modf
strrchr
isalnum
_finite
_clearfp
_controlfp
malloc
_strnicmp
_fpclass
_purecall
strncmp
isspace
strstr
strchr
free
_stricmp
memmove
qsort
isalpha
toupper
atoi
isdigit
tolower
??2@YAPEAX_K@Z
getenv
??3@YAXPEAX@Z
wcsncmp
_onexit
_wcsicmp
memcpy
memset
fclose
strcpy_s
strcat_s
bsearch
_CxxThrowException
memcmp
_snwprintf_s
wcschr
iswdigit
__unDName
fread
fseek
_wfsopen
vsprintf_s
strncpy_s
wcstol
_wcsnicmp
_wsplitpath_s
towlower
wcscpy_s
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
swprintf_s
wcsncat_s
wcsrchr
_wfullpath
_wmakepath_s
_time64
_chsize
_close
_read
_write
_lseeki64
_get_osfhandle
_open_osfhandle
_wcsdup
wcscat_s
ftell
sprintf_s
_mbscmp
_memicmp
_wgetenv
wcsncpy_s
_wsopen
__CxxFrameHandler3
acos
asin
atan
atan2
ceil
cos
cosh
exp
floor
floorf
fmod
log
pow
sin
sinh
sqrt
tan
tanh

advapi32

CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegOpenKeyExW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExW

kernel32

LeaveCriticalSection
EnterCriticalSection
LocalFree
LocalAlloc
GetVersion
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
SetLastError
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetModuleFileNameA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
GetSystemInfo
VirtualAlloc
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
LCMapStringW
GetFileAttributesW
SetFileAttributesW
CopyFileExW
DeleteFileW
GetFileType
DeviceIoControl
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
SetFilePointer
FlushViewOfFile
MapViewOfFileEx
SetUnhandledExceptionFilter
RtlLookupFunctionEntry
DisableThreadLibraryCalls
CreateFileW
GetLastError
GetFileSizeEx
ReadFile
CloseHandle
WriteFile
WideCharToMultiByte
FreeLibrary
lstrcmpiA
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
HeapCreate
HeapDestroy
HeapAlloc
GetProcessHeap
HeapFree
Sleep
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
GetFullPathNameW
GetFullPathNameA
GetEnvironmentVariableA
LoadLibraryExW
GetProcAddress

rpcrt4

UuidCreate

Exports

Exports

D3DAssemble
D3DCompile
D3DCompile2
D3DCompileFromFile
D3DCompressShaders
D3DCreateBlob
D3DDecompressShaders
D3DDisassemble
D3DDisassemble10Effect
D3DDisassemble11Trace
D3DDisassembleRegion
D3DGetBlobPart
D3DGetDebugInfo
D3DGetInputAndOutputSignatureBlob
D3DGetInputSignatureBlob
D3DGetOutputSignatureBlob
D3DGetTraceInstructionOffsets
D3DPreprocess
D3DReadFileToBlob
D3DReflect
D3DReturnFailure1
D3DSetBlobPart
D3DStripShader
D3DWriteBlobToFile
DebugSetMute

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R6-cheats_promanners-main/dav1d.dll
.dll windows:6 windows x86 arch:x86

311b3b7cb919ba363729236b7a6fb798

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeConditionVariable
SleepConditionVariableSRW
InitializeSRWLock
InitializeConditionVariable
WakeAllConditionVariable
CloseHandle
InitOnceBeginInitialize
InitOnceComplete
WaitForSingleObject
GetCurrentThread
GetModuleHandleW
GetProcAddress
GetThreadGroupAffinity
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
GetStdHandle
GetFileType
HeapReAlloc
HeapSize
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
CreateFileW
WriteConsoleW
DecodePointer

Exports

Exports

dav1d_apply_grain
dav1d_close
dav1d_data_create
dav1d_data_props_unref
dav1d_data_unref
dav1d_data_wrap
dav1d_data_wrap_user_data
dav1d_default_settings
dav1d_flush
dav1d_get_decode_error_data_props
dav1d_get_event_flags
dav1d_get_frame_delay
dav1d_get_picture
dav1d_open
dav1d_parse_sequence_header
dav1d_picture_unref
dav1d_send_data
dav1d_set_cpu_flags_mask
dav1d_version

Sections

.text
Size: 881KB - Virtual size: 881KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R6-cheats_promanners-main/fossilize_engine_filters.json
R6-cheats_promanners-main/package/bins_webhelpers_win32_win10-64.zip.vz.d2b3e24420958c08bdff94f70e7fa0d569dd3034_2963951
R6-cheats_promanners-main/package/bins_webhelpers_win32_win7.zip.vz.af12407e0ddd4eea45ef705331bc35c32ed0047c_2604192
R6-cheats_promanners-main/package/resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342
R6-cheats_promanners-main/package/resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876
R6-cheats_promanners-main/package/strings_all.zip.vz.3b383251b8bf5cca5bd408c9d2864bc078e6d5b2_1993958
R6-cheats_promanners-main/package/strings_en_all.zip.8ebfe5f184cbfe30df39a3dde48e35ccbe8f2da9
.zip
controller_base/localization/dualshock_4_english.txt
controller_base/localization/steam_controller_english.txt
controller_base/localization/switch_controller_english.txt
controller_base/localization/xbox_360_english.txt
controller_base/localization/xbox_one_english.txt
friends/trackerui_english.txt
public/steambootstrapper_english.txt
public/steamclean_english.txt
public/steamhtml_english.txt
public/steamui_english.txt
resource/overlay_english.txt
resource/platform_english.txt
resource/vgui_english.txt
steam/cached/steamui_postlogon_english.txt
R6-cheats_promanners-main/public/RefreshLoginDialog.res
R6-cheats_promanners-main/public/ScreenshotErrorNotification.res
R6-cheats_promanners-main/public/ScreenshotNotification.res
R6-cheats_promanners-main/public/SubExtraFactorRecover.res
R6-cheats_promanners-main/public/SupportQueryProgress.res
R6-cheats_promanners-main/public/UseOfflineMode.res
R6-cheats_promanners-main/public/UseOfflineModeChosen.res
R6-cheats_promanners-main/public/c1.tga
R6-cheats_promanners-main/public/c2.tga
R6-cheats_promanners-main/public/c3.tga
R6-cheats_promanners-main/public/c4.tga
R6-cheats_promanners-main/public/c5.tga
R6-cheats_promanners-main/public/c6.tga
R6-cheats_promanners-main/public/psnaccountsetupdialog.res
R6-cheats_promanners-main/public/ssa/eula_brazilian_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/eula_english_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/eula_french_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/eula_german_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/eula_italian_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/eula_japanese_bigpicture.html
R6-cheats_promanners-main/public/ssa/eula_korean_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/eula_koreana_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/eula_portuguese_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/eula_russian_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/eula_sc_schinese_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/eula_schinese_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/eula_spanish_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/ppa_brazilian_bigpicture.html
R6-cheats_promanners-main/public/ssa/ppa_english_bigpicture.html
R6-cheats_promanners-main/public/ssa/ppa_french_bigpicture.html
R6-cheats_promanners-main/public/ssa/ppa_german_bigpicture.html
R6-cheats_promanners-main/public/ssa/ppa_italian_bigpicture.html
R6-cheats_promanners-main/public/ssa/ppa_japanese_bigpicture.html
R6-cheats_promanners-main/public/ssa/ppa_portuguese_bigpicture.html
R6-cheats_promanners-main/public/ssa/ppa_russian_bigpicture.html
R6-cheats_promanners-main/public/ssa/ppa_spanish_bigpicture.html
R6-cheats_promanners-main/public/ssa/ssa_bigpicture.css
R6-cheats_promanners-main/public/ssa/ssa_brazilian_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/ssa_english_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/ssa_french_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/ssa_german_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/ssa_italian_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/ssa_japanese_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/ssa_portuguese_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/ssa_russian_bigpicture.html
.html
R6-cheats_promanners-main/public/ssa/ssa_spanish_bigpicture.html
.html
R6-cheats_promanners-main/public/steambootstrapper_brazilian.txt
R6-cheats_promanners-main/public/steambootstrapper_bulgarian.txt
R6-cheats_promanners-main/public/steambootstrapper_czech.txt
R6-cheats_promanners-main/public/steambootstrapper_danish.txt
R6-cheats_promanners-main/public/steambootstrapper_dutch.txt
R6-cheats_promanners-main/public/steambootstrapper_english.txt
R6-cheats_promanners-main/public/steambootstrapper_finnish.txt
R6-cheats_promanners-main/public/steambootstrapper_french.txt
R6-cheats_promanners-main/public/steambootstrapper_german.txt
R6-cheats_promanners-main/public/steambootstrapper_greek.txt
R6-cheats_promanners-main/public/steamclean_english.txt
R6-cheats_promanners-main/public/subpanelchoosedefaultcachedir.res
R6-cheats_promanners-main/public/url_list.txt

Sharing

General

Malware Config

Signatures

Files

dc33390e11f40d35aacb3b7595b60d08

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

08:4c:af:4d:f4:99:14:1d:40:4b:71:99:aa:2c:21:31Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

7b:b1:01:21:ff:0d:6b:21:e2:db:68:ef:fb:a5:ce:d5:6d:be:ae:a5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dbghelp

kernel32

advapi32

Exports

Exports

Sections

.text Size: 73KB - Virtual size: 73KB

.rdata Size: 18KB - Virtual size: 18KB

.data Size: 4KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

8c7ff060cb78c3e8c05369cec97a3996

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4Certificate

Extended Key Usages

Key Usages

6f:88:57:d4:a7:0d:08:ee:3f:b1:af:a9:94:49:a8:c6:e1:b7:d2:f5:0d:eb:f2:96:7b:68:43:d9:79:48:dd:6fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

winmm

imm32

cfgmgr32

psapi

Exports

Exports

Sections

.text Size: 833KB - Virtual size: 832KB

.rdata Size: 230KB - Virtual size: 230KB

.data Size: 20KB - Virtual size: 172KB

.rsrc Size: 44KB - Virtual size: 43KB

.reloc Size: 62KB - Virtual size: 61KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

08:4c:af:4d:f4:99:14:1d:40:4b:71:99:aa:2c:21:31
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

7b:b1:01:21:ff:0d:6b:21:e2:db:68:ef:fb:a5:ce:d5:6d:be:ae:a5
Signer

.text
Size: 73KB - Virtual size: 73KB

.rdata
Size: 18KB - Virtual size: 18KB

.data
Size: 4KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

6f:88:57:d4:a7:0d:08:ee:3f:b1:af:a9:94:49:a8:c6:e1:b7:d2:f5:0d:eb:f2:96:7b:68:43:d9:79:48:dd:6f
Signer

.text
Size: 833KB - Virtual size: 832KB

.rdata
Size: 230KB - Virtual size: 230KB

.data
Size: 20KB - Virtual size: 172KB

.rsrc
Size: 44KB - Virtual size: 43KB

.reloc
Size: 62KB - Virtual size: 61KB

.text
Size: 11.6MB - Virtual size: 11.6MB

.data
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 12.9MB - Virtual size: 12.9MB

.pdata
Size: 316KB - Virtual size: 316KB

.xdata
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 653KB

.edata
Size: 512B - Virtual size: 78B

.idata
Size: 5KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 112B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 56KB - Virtual size: 56KB

.reloc
Size: 269KB - Virtual size: 269KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

4c:ff:a1:aa:00:a5:f6:5f:9d:4a:68:40:bf:ab:af:b8:f3:8a:84:64:5e:b7:8b:59:85:2d:88:c2:22:26:e0:83
Signer

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 75KB - Virtual size: 74KB

.data
Size: 3KB - Virtual size: 20KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate