C:\BUILD\work\b69487f8af4577da\BUILDSENG\Release\x64\ArPotEx64.pdb
Overview
overview
10Static
static
30a249bd7ff...66.dll
windows10-2004-x64
10a249bd7ff...66.dll
windows10-ltsc 2021-x64
10a249bd7ff...66.dll
windows11-21h2-x64
10a249bd7ff...66.dll
windows7-x64
10ba5ecdc64...c5.dll
windows10-2004-x64
10ba5ecdc64...c5.dll
windows10-ltsc 2021-x64
10ba5ecdc64...c5.dll
windows11-21h2-x64
10ba5ecdc64...c5.dll
windows7-x64
1178bba8686...67.dll
windows10-2004-x64
1178bba8686...67.dll
windows10-ltsc 2021-x64
1178bba8686...67.dll
windows11-21h2-x64
1178bba8686...67.dll
windows7-x64
11c85c44ead...98.dll
windows10-2004-x64
11c85c44ead...98.dll
windows10-ltsc 2021-x64
11c85c44ead...98.dll
windows11-21h2-x64
11c85c44ead...98.dll
windows7-x64
163caf6bc06...bf.dll
windows10-2004-x64
163caf6bc06...bf.dll
windows10-ltsc 2021-x64
163caf6bc06...bf.dll
windows11-21h2-x64
163caf6bc06...bf.dll
windows7-x64
1920baac34e...e7.dll
windows10-2004-x64
1920baac34e...e7.dll
windows10-ltsc 2021-x64
1920baac34e...e7.dll
windows11-21h2-x64
1920baac34e...e7.dll
windows7-x64
1c3439bcb0e...d5.dll
windows10-2004-x64
10c3439bcb0e...d5.dll
windows10-ltsc 2021-x64
10c3439bcb0e...d5.dll
windows11-21h2-x64
10c3439bcb0e...d5.dll
windows7-x64
10Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a249bd7ff613a7c5e52fea8bd01881b852c1966.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a249bd7ff613a7c5e52fea8bd01881b852c1966.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
0a249bd7ff613a7c5e52fea8bd01881b852c1966.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
0a249bd7ff613a7c5e52fea8bd01881b852c1966.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
0ba5ecdc64ab4863e0157174169f84b06aee76c5.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
0ba5ecdc64ab4863e0157174169f84b06aee76c5.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
0ba5ecdc64ab4863e0157174169f84b06aee76c5.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
0ba5ecdc64ab4863e0157174169f84b06aee76c5.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
178bba8686ea329b884a652fe0f8a0ae0c53d367.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
178bba8686ea329b884a652fe0f8a0ae0c53d367.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
178bba8686ea329b884a652fe0f8a0ae0c53d367.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
178bba8686ea329b884a652fe0f8a0ae0c53d367.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
1c85c44eadd77a0e131171dfc412afa215ae9098.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
1c85c44eadd77a0e131171dfc412afa215ae9098.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
1c85c44eadd77a0e131171dfc412afa215ae9098.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
1c85c44eadd77a0e131171dfc412afa215ae9098.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
63caf6bc065239224f5c53ef3fe38cf81c64d6bf.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
63caf6bc065239224f5c53ef3fe38cf81c64d6bf.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
63caf6bc065239224f5c53ef3fe38cf81c64d6bf.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
63caf6bc065239224f5c53ef3fe38cf81c64d6bf.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
920baac34e0b489273785d5152c96e6c3f5932e7.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
920baac34e0b489273785d5152c96e6c3f5932e7.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
920baac34e0b489273785d5152c96e6c3f5932e7.dll
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
920baac34e0b489273785d5152c96e6c3f5932e7.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
c3439bcb0ee6d1bda33ef15a3d1d040c331e77d5.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
c3439bcb0ee6d1bda33ef15a3d1d040c331e77d5.dll
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
c3439bcb0ee6d1bda33ef15a3d1d040c331e77d5.dll
Resource
win11-20241007-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
c3439bcb0ee6d1bda33ef15a3d1d040c331e77d5.dll
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
General
-
Target
bulk-download.rl.zip
-
Size
1.8MB
-
MD5
d44a1d977e95b40af083391f0e196712
-
SHA1
00aee69aacd9b89175cc6eeca01e31d20c70a1aa
-
SHA256
4ea5258eb8acf1e4627a6a91f4985ac541adde0ebd44eb4ea32d7448b7db230e
-
SHA512
15679812842dac18b8bb703b69b0b38199d0ed8128e68b0c3a151f2b6aa9c541ff5e22bd6ef5d97e8c10f479a7d60ccfcbf99d8023df5d3ce176bfa2d4e837f7
-
SSDEEP
49152:BOtmp+JIZ+8CRm7bEYWfWzH4A6elh5alX1y68:2mkJIc8r2+zYA6ov68
Score
3/10
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/0a249bd7ff613a7c5e52fea8bd01881b852c1966 unpack001/178bba8686ea329b884a652fe0f8a0ae0c53d367 unpack001/63caf6bc065239224f5c53ef3fe38cf81c64d6bf unpack001/c3439bcb0ee6d1bda33ef15a3d1d040c331e77d5
Files
-
bulk-download.rl.zip.zip
Password: infected
-
0a249bd7ff613a7c5e52fea8bd01881b852c1966.dll windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Sections
.text Size: 373KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
memcpy_ Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
0ba5ecdc64ab4863e0157174169f84b06aee76c5.dll windows:6 windows x64 arch:x64
d3f19c8462acea3b286599d6db4d7d49
Code Sign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29-04-2021 00:00Not After28-04-2036 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ffCertificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before16-09-2022 00:00Not After17-09-2025 23:59SubjectCN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate
IssuerCN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GBNot Before15-01-2024 00:00Not After14-04-2035 23:59SubjectCN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate
IssuerCN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GBNot Before22-03-2021 00:00Not After21-03-2036 23:59SubjectCN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before22-03-2021 00:00Not After18-01-2038 23:59SubjectCN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
86:0b:e2:18:7a:61:8c:78:49:70:5c:dd:92:4c:fb:30:94:e8:27:19:de:ae:d4:3c:db:3e:39:02:4c:0a:20:56Signer
Actual PE Digest86:0b:e2:18:7a:61:8c:78:49:70:5c:dd:92:4c:fb:30:94:e8:27:19:de:ae:d4:3c:db:3e:39:02:4c:0a:20:56Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\BUILD\work\b69487f8af4577da\BUILDSENG\Release\x64\ArPotEx64.pdb
Imports
kernel32
VirtualProtect
VirtualFree
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
VirtualProtectEx
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
VirtualQueryEx
SetLastError
GetModuleHandleW
RtlUnwindEx
RtlLookupFunctionEntry
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WriteConsoleW
IsProcessorFeaturePresent
ExitProcess
TerminateProcess
GetModuleHandleExW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetConsoleCtrlHandler
HeapAlloc
HeapFree
GetStdHandle
GetFileType
GetStartupInfoW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
HeapSize
HeapReAlloc
CloseHandle
ReadFile
ReadConsoleW
OutputDebugStringW
CreateFileW
RtlUnwind
Exports
Exports
AXA
AXC
AXD
AXL
AXS
Sections
.text Size: 373KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
memcpy_ Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
178bba8686ea329b884a652fe0f8a0ae0c53d367.dll windows:6 windows x64 arch:x64
d3f19c8462acea3b286599d6db4d7d49
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\BUILD\work\b69487f8af4577da\BUILDSENG\Release\x64\ArPotEx64.pdb
Imports
kernel32
VirtualProtect
VirtualFree
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
VirtualProtectEx
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
VirtualQueryEx
SetLastError
GetModuleHandleW
RtlUnwindEx
RtlLookupFunctionEntry
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WriteConsoleW
IsProcessorFeaturePresent
ExitProcess
TerminateProcess
GetModuleHandleExW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetConsoleCtrlHandler
HeapAlloc
HeapFree
GetStdHandle
GetFileType
GetStartupInfoW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
HeapSize
HeapReAlloc
CloseHandle
ReadFile
ReadConsoleW
OutputDebugStringW
CreateFileW
RtlUnwind
Exports
Exports
AXA
AXC
AXD
GetDeepDVCState
AXS
Sections
.text Size: 373KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
memcpy_ Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 270KB - Virtual size: 269KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
1c85c44eadd77a0e131171dfc412afa215ae9098.dll windows:6 windows x64 arch:x64
d3f19c8462acea3b286599d6db4d7d49
Code Sign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29-04-2021 00:00Not After28-04-2036 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ffCertificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before16-09-2022 00:00Not After17-09-2025 23:59SubjectCN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate
IssuerCN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GBNot Before15-01-2024 00:00Not After14-04-2035 23:59SubjectCN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate
IssuerCN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GBNot Before22-03-2021 00:00Not After21-03-2036 23:59SubjectCN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before22-03-2021 00:00Not After18-01-2038 23:59SubjectCN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
29:e8:cc:cf:53:07:35:1c:ca:9d:4a:f4:7e:50:85:98:fb:cf:8f:c2:7d:39:50:f7:6e:47:90:ba:c9:fa:67:6dSigner
Actual PE Digest29:e8:cc:cf:53:07:35:1c:ca:9d:4a:f4:7e:50:85:98:fb:cf:8f:c2:7d:39:50:f7:6e:47:90:ba:c9:fa:67:6dDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\BUILD\work\b69487f8af4577da\BUILDSENG\Release\x64\ArPotEx64.pdb
Imports
kernel32
VirtualProtect
VirtualFree
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
VirtualProtectEx
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
VirtualQueryEx
SetLastError
GetModuleHandleW
RtlUnwindEx
RtlLookupFunctionEntry
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WriteConsoleW
IsProcessorFeaturePresent
ExitProcess
TerminateProcess
GetModuleHandleExW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetConsoleCtrlHandler
HeapAlloc
HeapFree
GetStdHandle
GetFileType
GetStartupInfoW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
HeapSize
HeapReAlloc
CloseHandle
ReadFile
ReadConsoleW
OutputDebugStringW
CreateFileW
RtlUnwind
Exports
Exports
AXA
AXC
AXD
AXL
AXS
Sections
.text Size: 373KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
memcpy_ Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
63caf6bc065239224f5c53ef3fe38cf81c64d6bf.dll windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\BUILD\work\b69487f8af4577da\BUILDSENG\Release\x64\ArPotEx64.pdb
Sections
.text Size: 373KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
memcpy_ Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
920baac34e0b489273785d5152c96e6c3f5932e7.dll windows:6 windows x64 arch:x64
d3f19c8462acea3b286599d6db4d7d49
Code Sign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29-04-2021 00:00Not After28-04-2036 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ffCertificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before16-09-2022 00:00Not After17-09-2025 23:59SubjectCN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate
IssuerCN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GBNot Before15-01-2024 00:00Not After14-04-2035 23:59SubjectCN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate
IssuerCN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GBNot Before22-03-2021 00:00Not After21-03-2036 23:59SubjectCN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before22-03-2021 00:00Not After18-01-2038 23:59SubjectCN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
7d:41:09:96:e0:40:bc:43:36:1f:2d:ca:d5:c5:27:f6:18:a0:4a:50:04:17:41:95:7b:7b:82:94:ff:ff:d5:82Signer
Actual PE Digest7d:41:09:96:e0:40:bc:43:36:1f:2d:ca:d5:c5:27:f6:18:a0:4a:50:04:17:41:95:7b:7b:82:94:ff:ff:d5:82Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\BUILD\work\b69487f8af4577da\BUILDSENG\Release\x64\ArPotEx64.pdb
Imports
kernel32
VirtualProtect
VirtualFree
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
VirtualProtectEx
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
VirtualQueryEx
SetLastError
GetModuleHandleW
RtlUnwindEx
RtlLookupFunctionEntry
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WriteConsoleW
IsProcessorFeaturePresent
ExitProcess
TerminateProcess
GetModuleHandleExW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetConsoleCtrlHandler
HeapAlloc
HeapFree
GetStdHandle
GetFileType
GetStartupInfoW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
HeapSize
HeapReAlloc
CloseHandle
ReadFile
ReadConsoleW
OutputDebugStringW
CreateFileW
RtlUnwind
Exports
Exports
AXA
AXC
AXD
AXL
AXS
Sections
.text Size: 373KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
memcpy_ Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
c3439bcb0ee6d1bda33ef15a3d1d040c331e77d5.dll windows:6 windows x64 arch:x64
d3f19c8462acea3b286599d6db4d7d49
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\BUILD\work\b69487f8af4577da\BUILDSENG\Release\x64\ArPotEx64.pdb
Imports
kernel32
VirtualProtect
VirtualFree
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
VirtualProtectEx
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
VirtualQueryEx
SetLastError
GetModuleHandleW
RtlUnwindEx
RtlLookupFunctionEntry
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WriteConsoleW
IsProcessorFeaturePresent
ExitProcess
TerminateProcess
GetModuleHandleExW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetConsoleCtrlHandler
HeapAlloc
HeapFree
GetStdHandle
GetFileType
GetStartupInfoW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
HeapSize
HeapReAlloc
CloseHandle
ReadFile
ReadConsoleW
OutputDebugStringW
CreateFileW
RtlUnwind
Exports
Exports
AXA
AXC
AXD
AXL
AXS
Sections
.text Size: 373KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
memcpy_ Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 245KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ