Game[.]exe | Triage™

resource	yara_rule
static1/unpack001/$_2_/DiagnosticsNET/win32/network_agent.dll	acprotect

resource	yara_rule
static1/unpack001/$_2_/DiagnosticsNET/win32/network_agent.dll	upx
static1/unpack001/$_2_/DiagnosticsNET/win64/network_agent.dll	upx

resource
Game.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$_2_/GameSavings/Windows/win_libraries/32/dll/hopmn.dll
unpack001/$_2_/GameSavings/Windows/win_libraries/64/dll/hopmn.dll
unpack001/$_2_/SdkWin/C#(.NET)/4.5/net_diagn.dll
unpack001/$_2_/SdkWin/C#(.NET)/9.0/net_diagn.dll

resource
unpack001/$_2_/DiagnosticsNET/win32/network_agent.dll
unpack001/$_2_/DiagnosticsNET/win64/network_agent.dll

Game.exe

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 54d788b1af6ba0343256e528aadfaae30e2ad214e7a6915dc08f0dddc23b2f2c
MD5 ca4069130468d93ac7c719bf89f792c8
SHA1 7f6ae8f83b6d4cf9d1494221c14437942b9e9152
SHA512 920311a7fb624f09bca4fd42d48f1a59dadb0415f02b29c14197da0b4253809dbae3263e6f70ce8762c2e488b1aa1f9104648935477490d89ed27f72c4c611d0
SSDEEP 98304:qGRoaRfCxu9X/K4JIPXZMUiaBEp0eDYmqFxYrP3bwKaDZnq5hTah:qhaR9PKB/di8w0ipmYrfKDsy
TLSH
T1B4163336F13A7838D0E31ABE6D5219203CA7BDA68644DB0F2F1530A657F1397B5097AC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

13893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/temp_cleanup.ico

SHA256 f3ca0866c22c802a2e562d2d3c299ab16b0a480687add02880b553fe9d1f3b5b
MD5 c8902a54bbf2b6eef30b18c39632da06
SHA1 830d1dacfca896933b120a7623c87c9538285a95
SHA512 8784ca999ffe2922a58ce71856a54f66db2bd59bc8f29eeccc3bc730e8069ccada0a121c9f9725faaf10f46bb8dd1e1bfc6b9cb43d1e553fdbfa7f6c00d427f2
TLSH
T108417F3D6403C4FFD72075641001FD97365ABAA3F7D89979B6EB1728E9C7C20814980D
MD5 SHA1 SHA512 TLSH

$TEMP/tidy.bat

SHA256 a73a45f85d069b29d443648011719c36b47aa1487f2f3e4962d53307c8fab6dc
MD5 28568420a09f78012b81ef32191ce9cc
SHA1 507d15ab6e425524d30194f0692bceba128243b5
SHA512 45352ddca4bbae89b5990273e187907a7824529f154b8bbb528ab4994a1c1ad978b02eaa9ecc4f0efa1124c89fdccf558bf9521c177904c8504526b72c00f099
SSDEEP 192:uMWapyx5oB++XpcHK5UdmbHZgQvnZ53jkRO6UZrbNsOi2v3G839ufIl3AQ694mpb:uMMU/XpcJdq/NufckGSYvub1EGl0Gl0k
TLSH
T14C22759E35039AE603729BA8CDF76C10D65DA2AAD1B1D1DCF4CCD3CD83DA647828225C
MD5 SHA1 SHA512 SSDEEP TLSH

$_2_/DiagnosticsNET/configuration.tmp

SHA256 868f30d544d375eb85b51f0b0e9c95a466505cfba19b1d31103da5067e968d0c
MD5 0a011fde5ef12a6aedd47d625852fda3
SHA1 2e10b5f268c94ab48bf30074bc346cbf513eaec2
SHA512 6b6755f1401b46a8be216c1220b74c02567df409af718b1980f2ac99e87963b0077fc3fe9413155c9e73eb30da3e538f2e40fee35e1e6b00990324864d7b1de6
TLSH
T10B41DC446E06AA6299B21B35D5C612BCFB1A103F472E0160B6AD17946FF6036CA6CF4C
MD5 SHA1 SHA512 TLSH

$_2_/DiagnosticsNET/update.tmp

SHA256 484b1303209287c51520b6b2952f34b8f21085f51a9c9de1d21a8551fc850e69
MD5 bf7546635574ef69ad6aea52341f2ed1
SHA1 f5e0a5515e81872365e1e33112452c0fc9f5a2e8
SHA512 32bde069a96b7354c5f013aeb9bbabf84aa5e27cb69f07e04be8c4d366d7059521852f2da7631f80f18d885f4ff8c453d99668745079d326e60145b55f180bf8
TLSH
T174F02695BD8AE231B4568B0A4276C9AC075501D9231AE4283AC556C43C26B888FB038A
MD5 SHA1 SHA512 TLSH

$_2_/DiagnosticsNET/win32/network_agent.dll

SHA256 126a550686490b9354cfb51fa2d4d4703b469b8eec2497889d017ce4f32f38e4
MD5 6eec3ea965ecb6deaf3eb9f1eb06c00d
SHA1 f6f3f4a184f3becf0b7cef4ab2ab31b22329420d
SHA512 0b68a7d52824adaab7c6ca59ef7df1faf4117d0334a415371e905fcec2ab5a4176abcbac92d2225f154a493e915ae33ac48604d8e333f777a5a9d736ad31f96b
SSDEEP 24576:D45aKVcGlEINXVreysUh4tga0VhiKZ2yAu6lUpQScmL2FrDpirwzORy6sd:8xrXVrHlh4tChiKZc453UzOAH
TLSH
T1C775334C9BE3C770C5B80FBA55C13177F6ABE33225C94AC5C23080C9566EBEC766526A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

1f:bd:3c:37:bf:5a:59:94:d1:54:ab:cc:15:5b:82:5c:e6:ed:c6:6c:64:1d:53:8b:ab:35:72:8d:33:0c:83:a9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Infatica Pte. Ltd.,O=Infatica Pte. Ltd.,ST=Central Singapore,C=SG

Chains

Oct 31, 2025

Minor OS version

1

Major OS version

6

Entry point

5153376

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

$_2_/DiagnosticsNET/win64/network_agent.dll

SHA256 6ef76a6dae246d7956eb401f621034f1ec14ac7721cbd6175e50f2b715ab789d
MD5 47f65650ad1a22539c33dd6605fdac45
SHA1 e045e3dcf545f58bb1b063f04365525355b6a0c7
SHA512 4e5ed7b710c4e0db36a125c1e826f9275ee9314b51beef9459444c30dc9cdc789a712c412d5c876405f9f2db65d52a46f1577c0362e2c5ddbf9dff8bc006b06a
SSDEEP 24576:ItnDqJk/7SWplFZtQs8TfQD5RqJojuc7sIZMAmSRNB4AmXx1WMc99zyKZiGuwj:wV/+WpQ9fQDPitcoIZMAmWvbAQM2zyro
TLSH
T1897533E99C5AE1B0EE62E2BC74BA322046C024235912DEF553D8D53B0F7E745E82DF91
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

9d:f9:bb:2c:a1:eb:17:af:bc:ab:71:c5:d8:d9:c9:9e:16:cd:29:09:0c:34:40:8f:0b:43:f6:4e:a2:97:b2:1a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Infatica Pte. Ltd.,O=Infatica Pte. Ltd.,ST=Central Singapore,C=SG

Chains

Oct 31, 2025

Minor OS version

1

Major OS version

6

Entry point

6089824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

$_2_/Features/update.tmp

SHA256 ee50f0f2f925cc1221c2d9f0582b3c35f2520ff191d9c55b652b3342a5c73d6d
MD5 a27e6fa62fe9a021ea9b8743ac1c4f25
SHA1 5ffbf5e69895916e94bfb6bed0542b9660c68a5a
SHA512 f9e3913fa529104ff7e169abf39239a8e88c837f20ede5a904301848be8893fc6c7638079a233e0d4e5a2f13f0f47cad2a28edd91b73e3dc5fe8a526d88a77d6
TLSH
T1CF312503F44088E691729F69B6C6164AFE59057F820A13017FBCC34F6FB083E9BD9968
MD5 SHA1 SHA512 TLSH

$_2_/Features/x/_locales/en/messages.json

SHA256 3d1f24feae65b13919ce27d72dbf37d2445ebba4c485b1d2f4582bc1858a34ed
MD5 e7909dcc8014f623d623ff3d8535c7d7
SHA1 2e8dc1d113df9aabcfba5bfcc6bd66e0bf688567
SHA512 e3a249608313f832125f7842a42914afaca276bb62a0c25a44f6c2eefa867a1748a608180aa6e79379daa0dffdcd34a45c3744776a7628373fceb11b18511bfb
TLSH
T1F9A00294D0B52D2B034F12BF30ED7004B6F04BE240583C6FF2BA091D6B99C5105EE398
MD5 SHA1 SHA512 TLSH

$_2_/Features/x/icon.png

SHA256 481b23eeff4060874cbc24281dad4f42b5326ded9e06a5b547c9b6dbc63d6245
MD5 5f62e1708f9891439ed643945fd4752f
SHA1 d9f8adccc718e9555dbf968912d53db909479679
SHA512 34206a35f31e2496caa1ec05a41e2c7b12d7572c9433f6dc099a1da9e489250a3dcc84c3960da8fb97fe5e1df199a59af40b4b8709bf181ca0bf966e0894ac7d
TLSH
T165511DD64170DB9CCB63D766876A335A4730F5FBC941125E819F957924C116D330EC17
MD5 SHA1 SHA512 TLSH

Password

infected

$_2_/Features/x/icon2.png

SHA256 38e9c3c929f36ec22beb6a7562a6272816d226c1dff2818499413a91912ab55d
MD5 2c9317bbdf91f7e4fe7d785e45f47210
SHA1 02e2166007e5d8628310800854121b9afbe95723
SHA512 56d9ea681353eafebf1ad9f0d3f7ceaaf5ba56fef58f6020b7cb743edaa0d903ed760169d29ced849c1cc0fd7e2cb766eccf89e2f8af4d251cf92c40177d05e5
SSDEEP 96:WS/knmWIePPOfnNVHNOuH+AEgdixP8nW1NxfnbvQc:WS/knsnNVt11EgK8wLvbvQc
TLSH
T10B915B266E552D9191CCF92239E38647573393D8DEC2968FECCE4C472834231B8AD4E3
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

$_2_/Features/x/interface.html

SHA256 75c49ec78f92a8c7e1f98c579f693bb1a3a2fb1c4e695a1ed5912bfbb33f5a86
MD5 654bd04df4f45643537d9c5e0fd3d351
SHA1 ad180ca3831f29284c647096de0ddd632f8bb102
SHA512 e71017186ba40e1b7a732d1bd3b876344d90a48779e09e92decc250a79e6ee5387bea8ca17fa77a193e60ec23163026d56b18c149949b960c36588c8ef571584
TLSH
T14F21C00695C02803707BC37887A18211FFB60107C3021239799DF26B0FB7550C9DBBA8
MD5 SHA1 SHA512 TLSH

$_2_/Features/x/interface.js

SHA256 7f9c676741a178b703e32515abbffc422f7d0e58a745e97b2c05e0f0717cbed5
MD5 833ef87f0265c87a2cdb6600a0ed39cb
SHA1 c10cccff915578b9d85687a97df4b834f395e7c7
SHA512 fd47d272d0d8503c4d351fd538729113438d06dd57774a3c8bbd4ce9376ab3296be476bf7e2d018f57e60a54e7a433c5847c5465bc9a8691f020b85d86a5372d
TLSH
T1DD219C5A7141313A8AF7626157938C66FF3910C768420A22319CD5450F375C4C1FBEEF
MD5 SHA1 SHA512 TLSH

$_2_/Features/x/manifest.json

SHA256 b4cbc6bc3025a41fb8003f4f8f8d859576f009827554cb99d07c892572e7b2c1
MD5 eb905bf14a8a0c383e50c8422fbf3d60
SHA1 d678e59cec2ed35357a82a84186005479b1b27ab
SHA512 c60ffe336c0439080477828a78399fb6d3682daf29f7fb74e40f70581fed1795745c13015400b0f91c9bc4b03e6d38fe346842f9fdd714eca7e1021e3f1141a3
SSDEEP 48:/sVzydyu6F0TiqB4IZffZHHjpdOES8ylgkcr:/Tjd5/9U+
TLSH
T14AF112EBAA18892612E4C5F0A431B31CB72315CFACC875C6BB4D88795FA8DEF00655DD
MD5 SHA1 SHA512 SSDEEP TLSH

$_2_/Features/x/script.js

SHA256 90fd9b7f029dd2968c69a03d98fd8f86dd529b0c507898e687abf39807eaed2e
MD5 5c38641814eaf858f45080f8d3bb0a0a
SHA1 f11cd28229415a4f868832abc57ab276bdb5e561
SHA512 1f3f862c40cc06ea6a5f1687c9776838c0b771167e44dcef38d1dacd01f01006c871fbd8951b8121225efa0175b168e5767f69c65c4615fd276bf56db064398f
TLSH
T1F7E0C23F59675A344E2301867531E6D43D7A10261163E61E688CE81D9F18FC50C28D90
MD5 SHA1 SHA512 TLSH

$_2_/Features/x/security.js

SHA256 b63078647279770a6ee5e73c5b78f6958acfa5cca56951dc2807f2ddf601f9db
MD5 b4020d683acf7468ba58f0025848891b
SHA1 2b377ef71fd3cc6840d4f72d3e31dd9976246a42
SHA512 f7eb1f2483f6e6cfaf332ddd0342f613e245b2fff51316ed0c8fdbdddaa63da159e3cab0ab57f94b4569477e36e3710a73f7da55a083028afcad2f4640c865b9
SSDEEP 768:GHqX3W5r4SL+7OFEKNkEpTyWJezPSyngKyCE:GKcrm+k1WwzKf
TLSH
T1BCE2736A25F7183609A7706DBB5BB0413230E01B3589CC9C7E4EA6506F4C6798AB4FEC
MD5 SHA1 SHA512 SSDEEP TLSH

$_2_/Features/x/web_accessible_resource.js

SHA256 2a6ad4faebce67af0c5751780e10bb5ff676195445e0418a20174b6033a2638d
MD5 dcc592cf6d40300bd8e61e650438dcda
SHA1 d2b2627dfe836c838f7143e8bad4b7da3a160454
SHA512 9600aa79fb92fe6d3a5f01972c2aa43022f300b193cd6ab430a5ce67589594d0242c22262c7e6355a86efde8be827eacdfe459523d595583c5ccf9ab4a0d1164
TLSH
T14031AC781C2B853259BB366E5A36F20DFB5621272451E3563ECC840C1FB4F924C45EC8
MD5 SHA1 SHA512 TLSH

$_2_/GameSavings/Windows/win_libraries/32/dll/hopmn.dll

IMPHASH 8d81612ae2c80304c89e22b8da97c6f1
SHA256 5b7da7053c496c6285b3429128bef5bed0337f9fabe577cdd5f95ecd3a30f644
MD5 50d8a6229348bcba5082635a3ff9236b
SHA1 30d68296ab18130a8c50c7829e7d0a898c736930
SHA512 a0be8bee83389aa2499eaeba990db4b0d0c93ed88f95532c643f15e83030b37dc7a3fde86ab1638b3ae9a2915d9acfd33846af5f5132d3cf9aa24894ce2131b0
SSDEEP 12288:LTCh3/GDNmB2bBTQdD7YJaAIPMU2+kSpeKR6muX2DLXc0fXbMvWz1VgjdRD8yqq2:LTLx0DM4AIPMQkSpeKR62DLLMvY3gjvb
TLSH
T1D1F48D52F990D0F1E2DA00B421BA5B7B0E39A1149720E9D3D7D4B9B59D203E1A73F39E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

6

Entry point

445065

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\source\repos\hopmn\Release\hopmn.pdb

ws2_32

ioctlsocket setsockopt sendto freeaddrinfo getaddrinfo select __WSAFDIsSet WSAIoctl WSASetLastError accept WSACleanup WSAStartup socket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent gethostname ntohs bind closesocket gethostbyname ntohl shutdown listen WSAAccept getpeername getsockname send connect recvfrom WSASocketA recv getsockopt htonl htons WSAPoll WSAGetLastError

advapi32

RegisterServiceCtrlHandlerA SetServiceStatus StartServiceCtrlDispatcherA CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt CryptAcquireContextW CryptReleaseContext

kernel32

CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringW SetStdHandle HeapReAlloc SetEndOfFile FlushFileBuffers GetTimeZoneInformation GetCurrentDirectoryW FindClose EnterCriticalSection LeaveCriticalSection FindFirstFileExW CloseHandle WaitForSingleObject CreateThread InitializeCriticalSection DeleteCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx QueryPerformanceFrequency SleepEx QueryPerformanceCounter GetTickCount GetFullPathNameW MultiByteToWideChar WideCharToMultiByte GetLastError SetLastError MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetModuleHandleA GetProcAddress GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW FormatMessageW CreateFileW GetFileSizeEx HeapAlloc FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW DecodePointer SetEnvironmentVariableW GetProcessHeap DeleteFileW GetStringTypeW WriteConsoleW HeapSize GetFileAttributesExW CreateProcessW GetExitCodeProcess HeapFree Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetConsoleMode ReadConsoleW GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteFile GetConsoleOutputCP SetFilePointerEx ExitProcess GetModuleFileNameW

crypt32

PFXImportCertStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CertFreeCertificateContext CryptStringToBinaryW CertAddCertificateContextToStore CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindCertificateInStore CertFindExtension

bcrypt

BCryptGenRandom

secur32

InitSecurityInterfaceW

iphlpapi

if_nametoindex

Name

.text

Size

578KB

Virtual Size

578KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_2_/GameSavings/Windows/win_libraries/64/dll/hopmn.dll

IMPHASH 7acb33d823f3a3a803f5090d3476cf91
SHA256 bb5a48546d4f55e2cd6357bea35ea7857d7d6348b1893d657e6deeea608b25cc
MD5 1610b012e6aea9f19e9751d52b52fb5c
SHA1 4b01ca5d28cfa71e4b6875713347597cd46aaf9b
SHA512 efdc2a04ad94c03d394c60c10074c5303ba867dd12f360ca475cdf4e1ba3b7afd4c9ae1251aeeb0ec5e88515ce056acaab2f4b2b54d48adf09fbf09d0be49935
SSDEEP 24576:3k0YyhI3vxnHiHFDfpzqDTPyb0S/3PXl70dynso:3kRyW3RHSfpzqnPyb0S/vqT
TLSH
T115158D66A3B811B9D1ABC13CC6535207E7B2B456172097DF02B48ABA3F13BE2573E750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

6

Entry point

486964

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\source\repos\hopmn\x64\Release\hopmn.pdb

ws2_32

__WSAFDIsSet WSAIoctl accept WSACleanup WSAStartup WSASetLastError getaddrinfo WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent select socket freeaddrinfo setsockopt gethostname ntohs bind closesocket gethostbyname ntohl shutdown listen WSAAccept getpeername getsockname send connect recvfrom WSASocketA recv getsockopt htonl htons WSAPoll sendto ioctlsocket WSAGetLastError

advapi32

CryptEncrypt CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW CryptImportKey StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA

kernel32

CloseHandle Sleep CreateThread InitializeCriticalSection DeleteCriticalSection SetEnvironmentVariableW LeaveCriticalSection EnterCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetCurrentDirectoryW GetTimeZoneInformation FlushFileBuffers SetEndOfFile HeapReAlloc SetStdHandle GetProcessHeap DeleteFileW GetStringTypeW WriteConsoleW HeapSize WaitForSingleObject IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx QueryPerformanceFrequency SleepEx QueryPerformanceCounter GetTickCount GetFullPathNameW MultiByteToWideChar WideCharToMultiByte GetLastError SetLastError MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetModuleHandleA GetProcAddress GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW FormatMessageW CreateFileW GetFileSizeEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess RtlUnwind GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetConsoleMode ReadConsoleW GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteFile GetConsoleOutputCP SetFilePointerEx ExitProcess GetModuleFileNameW HeapFree GetExitCodeProcess CreateProcessW GetFileAttributesExW HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW

iphlpapi

if_nametoindex

secur32

InitSecurityInterfaceW

crypt32

CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateContext CryptStringToBinaryW CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension

bcrypt

BCryptGenRandom

Name

.text

Size

639KB

Virtual Size

639KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_2_/GameSavings/Windows/win_libraries/update.tmp

SHA256 67c0081a99cc2f2bccd00a5b0df92460ddb0843bd7bddb1d8c90a89a08d2ab42
MD5 84b4ed0b6882be985d81dfceff59a9bc
SHA1 33dfd51b594d5f9e131f611ede57a735b0ee0cbd
SHA512 981b7279aedb6dbde018e154665f352ef0941f86c15ebbd29518cfad441867296c84552a5cc79bbe1e03afa00fcb4c69d04a62d30b68bcc12b78590285cd0a3d
TLSH
T176F0F995BD8AE631B4568B0A4276C5AD074501D9631AE4283BC557C87C26F889FF43CA
MD5 SHA1 SHA512 TLSH

$_2_/GameSavings/Windows/win_libraries/updater.tmp

SHA256 aef643e21ad31250a5047833d3529a48729d01b9a7de30aea706167cca2b681b
MD5 7179c771ffe4d3c34ef3e384611282c8
SHA1 2b6d20f952914774f914b1e3cdbbc61cda82de83
SHA512 5de5c2e355729d60e440071832d89994730a13d10b49d93d4a23d9d6e47e5a9597f45b24b5f49315ed44bc92ec9c7ea1a51e56b7d782fe3c61cad5efa98979dc
TLSH
T1D37134187A8B695508B71B35ECD685A8FE06513F427E2800FADD56E0BFF6428967CF0C
MD5 SHA1 SHA512 TLSH

$_2_/SdkWin/C#(.NET)/4.5/net_diagn.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f7487be70a63f129f02b0ac42c0f21bdb85f247e305498e6bd34f3696504ee04
MD5 05abe471c15189b07d190fbd2d50545a
SHA1 ba70aee2688a88539476a5d49fce3ffdbb893c22
SHA512 c2c74c6a5859d5050376f7f6cb7ed68271ff35470f629c2505d3300708d321ccbb508f447255bf233eb1f0deab71fbc49a427916a56a0cb85e84f3dc39a30f28
SSDEEP 1536:9eY+FtVCwJSEdvwSUI1uSuTmG6jztRQshfw2wYoLP+cS3:9eYoVCwJSEV3rRvXQ4voLY3
TLSH
T17D439E04136E8617F76F4EFD65A0129742B2E6A6A571F78DACCCE0F424823C489827DF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

61406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_2_/SdkWin/C#(.NET)/9.0/net_diagn.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0e7efca312cb6618205833f6fd24e4db9a1315c5d4d17ae55f21c1d8f26c1096
MD5 96607a997a31f5e9ba333708f601b33b
SHA1 54453d250359e55c8ddb075d99b46b55273e51f4
SHA512 47eb8b9537ba4b02dd3f106c80c4b2561863a6ff5bff7a415f21ad1c33139d3350014d7ff7227a03ab6a4413b2e8b9bd23c6e2c767daf2ff8dd1f01af0ca02d5
SSDEEP 6144:9BFZKOU8DGBUfms25IPoOloUz/psEcc7tDpNNdG3:9vYOJjms25I6UdBcc7F
TLSH
T12D6412082B4DCA1BCF1F0CFD61A5351747B266542946E30EA8DEE0F918933C6AD593EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

332910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_2_/SdkWin/update.tmp

SHA256 84b1661621ebe8992cab26c32b67d83d42f6d74e9926b69ed347b83185895278
MD5 43e825f9f6cfe537a3e623343b2a7d5b
SHA1 f0f33f66637f30f992797973a80d8063f6687869
SHA512 5a136ce51087e044c84521d63a69db91c754b9ef9c207992c5a739fa4ab09b8baf690eccaddb04dd9e9810fdbb0b2aa4796caa2f249949e67db3a9701f4663e2
TLSH
T15E410C266966647944B36739E8B24004FF2A112B4ABD0002B8AC41D97FF0DB5D379FAE
MD5 SHA1 SHA512 TLSH

$_2_/SdkWin/updater.tmp

SHA256 51e30dfc40b2b4627c447471d8ab53ba3cb7bb8215afc6277bf92943e40a4d0d
MD5 fd8d3308a986f6d8b9e4c12d456a9d78
SHA1 02c1a64cf15b0836694ac87e0e477266ec13cde7
SHA512 eb65c7cefb4ea30515e6fdced698f23014fb02636b05c412d57ef597b3ab4e7ea262607c4ac7e8ac19adbc3f4ec19425479878c118fed1388e77113adc745e93
TLSH
T14CF0F995BD8AE231B4568B1A4276C5AD074501D9631AE4283BC557C47C26F889FF43CA
MD5 SHA1 SHA512 TLSH

$_2_/UpdatesWin/update.tmp

SHA256 12936009703fa8a7ada0700fcbd138db700b2a46a0108e1580b375f291a0d376
MD5 61dc418765d441f7232b00730315b1e2
SHA1 525fd9916c49301fcf7ddca2315dd6428f50dda5
SHA512 588f0e0f9ba4bca50b8e9d06a5d85dc8da75bc7ebf15489eb17bbdf2ef5bb0529180fca567766d0f9d665847494ff1330a294927359d52b545bee0e36782070b
TLSH
T10151412B691A6125D37223B1D6966418EE3BC01F9E59404070DDE589FFB067443FDFE1
MD5 SHA1 SHA512 TLSH

$_2_/UpdatesWin/updater.tmp

SHA256 8345cf16434236ab88e012de3006b20f81fb2f0e5f6452cb3942e792e2b1aef1
MD5 67191b1c8799ed6712c59f0f0d626e9c
SHA1 0cef5b0472ea9608f6af457a73abf82700a1a9d1
SHA512 ff251471395547180f50761288df2d3d9c044263fef4cc26a987a06efc2ca01d701e55664a5e6a25af082137184b768910f081afdbf64845d82afb81d0580a63
TLSH
T1915114499A13512042B3D37E95B2D278EB3F811F021A0114B1FC62823F31A7C4BDAFE8
MD5 SHA1 SHA512 TLSH

$_2_/WinPackages/update.tmp

SHA256 67c0081a99cc2f2bccd00a5b0df92460ddb0843bd7bddb1d8c90a89a08d2ab42
MD5 84b4ed0b6882be985d81dfceff59a9bc
SHA1 33dfd51b594d5f9e131f611ede57a735b0ee0cbd
SHA512 981b7279aedb6dbde018e154665f352ef0941f86c15ebbd29518cfad441867296c84552a5cc79bbe1e03afa00fcb4c69d04a62d30b68bcc12b78590285cd0a3d
TLSH
T176F0F995BD8AE631B4568B0A4276C5AD074501D9631AE4283BC557C87C26F889FF43CA
MD5 SHA1 SHA512 TLSH

$_2_/WinPackages/updater.tmp

SHA256 d95edae2c06c2b95acee8d185dcf9893927844cce7fded48a8be79f06d12aa7b
MD5 5e5e4d02fe7c654034d3162a025d2253
SHA1 948eac93af9d2193b9c5496339bb365c35a6105e
SHA512 42aca00445db83bc893e8b1a3d112ca3db17bf4916955af0f2bac130f807db62fecb91632a65976c5b4d3eca9d404f9227aa49029b64856366427857632efa29
SSDEEP 96:5XVekJrC7j9JXaPzBcZLDN4N1jFOXHB/Jw/z9WYgW9vylVL11THroqNCdEa4XUTW:5XV9J2V9N4NNFeHB/2/w7Vx1TtgEaHTW
TLSH
T198B1D6A1321EE534A66094129DC3D648FF366622436D99F4F48CDA01FFF540DC279EA6
MD5 SHA1 SHA512 SSDEEP TLSH

$_3_/Game.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d77741a4dbc562e2ac98adf2d4aa036feb7736ce0fe1aecf48ac247de783df9d
MD5 c2f26dcf03ce79d120884cb0ec4b8090
SHA1 4171105b1ebb52591129e8389831fe3083e9083e
SHA512 3459d0d31fbe789a47ca2a38e126cdf4802e247bab564ab7b40b1f9ec52c4bf0f63e377a9eec0b2c95bd8d0748538c6cad996f99d0a2ed73c9211bcd8074e78c
SSDEEP 1536:v0RG7xBqKIlsDbULGXBgVP6n/7brxxi483zK:v0RG7xBtpBoyn/vrQ32
TLSH
T142735C9163AC4C17C4BF567DA6B0922207F1F7832660FBAA1DC8A4C906E77D197503AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Digest

f7:8c:ae:0f:8e:fa:73:f5:ad:00:7d:e9:a6:7f:1d:c4:9a:79:d5:30:29:ac:fd:c8:19:01:cd:71:fd:d0:68:22

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 26, 2024

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

f7:8c:ae:0f:8e:fa:73:f5:ad:00:7d:e9:a6:7f:1d:c4:9a:79:d5:30:29:ac:fd:c8:19:01:cd:71:fd:d0:68:22

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

Chains

Mar 9, 2024

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

Serial Number

02:22:a8:d6:0b:06:b0:4f:af:fb:da:53:ef:fd:57:95

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 19, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:08:e2:33:7a:56:70:40:c0:d5:00:00:00:00:01:08

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 14, 2023 - Sep 4, 2024

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ee:05:d3:02:30:b2:9a:9d:a7:00:01:00:00:01:ee

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

61310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\agent\_work\171\s\hallasan-smart-printerdriver\Source\V4\UI\PrinterExtension\obj\x86\Release\HP.OneDriver.V4.PrinterExtension.pdb

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Game.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$TEMP/temp_cleanup.ico

$TEMP/tidy.bat

$_2_/DiagnosticsNET/configuration.tmp

$_2_/DiagnosticsNET/update.tmp

$_2_/DiagnosticsNET/win32/network_agent.dll

PE Signature issue

generic

$_2_/DiagnosticsNET/win64/network_agent.dll

PE Signature issue

generic

$_2_/Features/update.tmp

$_2_/Features/x/_locales/en/messages.json

$_2_/Features/x/icon.png

$_2_/Features/x/icon2.png

$_2_/Features/x/interface.html

$_2_/Features/x/interface.js

$_2_/Features/x/manifest.json

$_2_/Features/x/script.js

$_2_/Features/x/security.js

$_2_/Features/x/web_accessible_resource.js

$_2_/GameSavings/Windows/win_libraries/32/dll/hopmn.dll

ws2_32

advapi32

kernel32

crypt32

bcrypt

secur32

iphlpapi

generic

$_2_/GameSavings/Windows/win_libraries/64/dll/hopmn.dll

ws2_32

advapi32

kernel32

iphlpapi

secur32

crypt32

bcrypt

generic

$_2_/GameSavings/Windows/win_libraries/update.tmp

$_2_/GameSavings/Windows/win_libraries/updater.tmp

$_2_/SdkWin/C#(.NET)/4.5/net_diagn.dll

mscoree

dotnet

$_2_/SdkWin/C#(.NET)/9.0/net_diagn.dll

mscoree

dotnet

$_2_/SdkWin/update.tmp

$_2_/SdkWin/updater.tmp

$_2_/UpdatesWin/update.tmp

$_2_/UpdatesWin/updater.tmp

$_2_/WinPackages/update.tmp

$_2_/WinPackages/updater.tmp

$_3_/Game.exe

mscoree

dotnet