Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI.rar
- SHA256 f28ec304a07d51cfd9cc4a7cdf2ca6081bcb343ffa6f96225a75d532be94463c
Overview
overview
7Static
static
5Resident.E...RI.rar
windows11-21h2-x64
7ColdClientLoader.ini
windows11-21h2-x64
3EfiGuard/E...xe.dll
windows11-21h2-x64
1EfiGuard/E...ol.exe
windows11-21h2-x64
EfiGuard/E...64.exe
windows11-21h2-x64
EfiGuard/E...er.dll
windows11-21h2-x64
1EfiGuard/E...ix.exe
windows11-21h2-x64
1KIRIGIRI.dll
windows11-21h2-x64
1READNFO-MK...AM.txt
windows11-21h2-x64
3SimpleSvm.sys
windows11-21h2-x64
1amd_ags_x64.dll
windows11-21h2-x64
1amd_ags_x64.dll
windows11-21h2-x64
1coldclient...64.dll
windows11-21h2-x64
1coldclient...pp.ini
windows11-21h2-x64
3coldclient...in.ini
windows11-21h2-x64
3coldclient...er.ini
windows11-21h2-x64
3coldclient...id.txt
windows11-21h2-x64
3coldclient...es.txt
windows11-21h2-x64
3coldclient...nt.dll
windows11-21h2-x64
3coldclient...64.dll
windows11-21h2-x64
1hyperevade.dll
windows11-21h2-x64
1hyperhv.dll
windows11-21h2-x64
1hyperkd.sys
windows11-21h2-x64
1hyperlog.dll
windows11-21h2-x64
1hyperlog.inf
windows11-21h2-x64
3kdserial.dll
windows11-21h2-x64
1steamclien...64.exe
windows11-21h2-x64
1watchdog.exe
windows11-21h2-x64
1Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI.rar
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral2
Sample
ColdClientLoader.ini
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
EfiGuard/EFI/Boot/EfiGuardDxe.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
EfiGuard/EFI/Boot/HashTool.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
EfiGuard/EFI/Boot/bootx64.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
EfiGuard/EFI/Boot/loader.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
EfiGuard/EfiDSEFix.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
KIRIGIRI.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
READNFO-MKDEV TEAM.txt
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral10
Sample
SimpleSvm.sys
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
amd_ags_x64.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
amd_ags_x64.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
coldclient/GameOverlayRenderer64.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
coldclient/steam_settings/configs.app.ini
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral15
Sample
coldclient/steam_settings/configs.main.ini
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral16
Sample
coldclient/steam_settings/configs.user.ini
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral17
Sample
coldclient/steam_settings/steam_appid.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral18
Sample
coldclient/steam_settings/steam_interfaces.txt
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral19
Sample
coldclient/steamclient.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral20
Sample
coldclient/steamclient64.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
hyperevade.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
hyperhv.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
hyperkd.sys
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral24
Sample
hyperlog.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
hyperlog.inf
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral26
Sample
kdserial.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral27
Sample
steamclient_loader_x64.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral28
Sample
watchdog.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
General
- Target Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI.rar
- Size 13.2MB
- Sample260308-vysfzset3p
- SHA256 f28ec304a07d51cfd9cc4a7cdf2ca6081bcb343ffa6f96225a75d532be94463c
- MD5 68340e026e713f23131abf0b68cc3aed
- SHA1 12aa4b349056217704600337a3b2e19ab1afaf5b
- SHA512 0a705dcdd436092d2e2b29f2745dcb23131ef3bed8f0d997fbc6af5341a2207024ff3d68e5de05568b95f4b60975334bb0f9b6b5b8b6b646e7ab2f47105a5789
- SSDEEP 196608:aqdCtViS27cyB+BS4+ZdeQQys5dP142bIHVnRdQIlQX7v6nuyQmmo6mUEBe2M/Oz:4IXcXo3Qj3e2boBlCDypB6jvGTS5jQ
- TLSH T1B5E633BE7BEE7757E1B12592F475270D46C0B2046C1C98274444F2ABBDE93BDAE2C026
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/steamclient_loader_x64.exe - Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/EfiGuard/EFI/Boot/EfiGuardDxe.efi unpack001/EfiGuard/EFI/Boot/loader.efi unpack001/EfiGuard/EfiDSEFix.exe unpack001/KIRIGIRI.dll unpack001/amd_ags_x64.dll unpack001/watchdog.exe - Untrusted Codesign Signers 11 IoCs
Codesigned binary was signed by an untrusted entity.
resource unpack001/EfiGuard/EFI/Boot/HashTool.efi unpack001/EfiGuard/EFI/Boot/bootx64.efi unpack001/SimpleSvm.sys unpack001/coldclient/GameOverlayRenderer64.dll unpack001/coldclient/steamclient.dll unpack001/coldclient/steamclient64.dll unpack001/hyperevade.dll unpack001/hyperhv.dll unpack001/hyperkd.sys unpack001/hyperlog.dll unpack001/kdserial.dll
File Explorer
-
Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI.rar.rar 13.2MB
-
ColdClientLoader.ini2KB
-
EfiGuard/EFI/Boot/EfiGuardDxe.efi.dll 352KB
-
EfiGuard/EFI/Boot/HashTool.efi.exe 98KB
-
EfiGuard/EFI/Boot/bootx64.efi.exe 98KB
-
EfiGuard/EFI/Boot/loader.efi.dll 48KB
-
EfiGuard/EfiDSEFix.exe.exe 21KB
-
KIRIGIRI.dll.dll 33KB
-
READNFO-MKDEV TEAM.txt6KB
-
SimpleSvm.sys.sys 17KB
-
amd_ags_x64.dll.dll 166KB
-
amd_ags_x64.org.dll 175KB
-
coldclient/GameOverlayRenderer64.dll.dll 1.9MB
-
coldclient/steam_settings/configs.app.ini410B
-
coldclient/steam_settings/configs.main.ini1KB
-
coldclient/steam_settings/configs.user.ini220B
-
coldclient/steam_settings/steam_appid.txt7B
-
coldclient/steam_settings/steam_interfaces.txt629B
-
coldclient/steamclient.dll.dll 15.3MB
-
coldclient/steamclient64.dll.dll 17.1MB
-
hyperevade.dll.dll 6KB
-
hyperhv.dll.dll 520KB
-
hyperkd.sys.sys 11KB
-
hyperlog.dll.dll 13KB
-
hyperlog.inf1KB
-
kdserial.dll.dll 29KB
-
steamclient_loader_x64.exe.exe 342KB
-
watchdog.exe.exe 65KB
ColdClientLoader.ini
- SHA256 44e451d5e560b541a98ca186f8617520f23e99def31b5a861e94877b3cdce2a4
- MD5 915d5bdc21d829e44b4d6ae242585cd2
- SHA1 8509e40b9b810ec427a0c97f5a60409a3bf84f13
- SHA512 243cbb115cf5ac1b60e32247ca3a28a811e55037b04e41ee43a7b4730d88ec495cf8a23ec77cb293b62fafe73d3450a127413918a88f1af46a186b307a43515f
- TLSH T1345163426B5853B5D262D208F54EACD4C32EC4DF123654A06038D12D6290EFEE37E9DB
- MD5 SHA1 SHA512 TLSH
EfiGuard/EFI/Boot/EfiGuardDxe.efi
- SHA256 6a62ecdfad0cb6e4fa3f4d620b2c802a6805f4c553bfa4d7d7cb1b445c9d1f3d
- MD5 3b18d64d616e0eb923696c5dcc21cb4c
- SHA1 22978671e9163d7566393e6ee8245123e4c0a08b
- SHA512 ac6bfdbf0504cf00f7bc63df2ac1d09c81b41e711d1b2a8207b53441f3640a4f2b351b3c0d532f0beac4f259aa5db050355788c5579ea3b3f00add7d21401637
- SSDEEP 3072:IA8YlaeSRPFX5eQJ0I5usI/hfKdgt1qT4VZ0pfiy/MDu54yWc:6YliFBPoKqnGGuzj
- TLSH T1577440B3E955587BF47459309DE603A6327BA5D0C7B2C24B2A4C613E2E927902F36FC4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
0
Entry point
4552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
EfiGuardDxe.pdb
Name
.text
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
272KB
Virtual Size
285KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
EfiGuard/EFI/Boot/HashTool.efi
- SHA256 919f3561eea5cb20681d90986b1ced7b627aead09496194325f681c7ccc14468
- MD5 45639d23aa5f2a394b03a65fc732acf2
- SHA1 860064a8509bdbd2c58557483aba97f11c809a9f
- SHA512 a51ce176c93417e53ec6d78c16afa5e8b9545e623d98d4fc55fc3762f33cd942ea1dce1211b2ed80703df08fe4fed84aff1fa86063c27b08413b3882019c4afd
- SSDEEP 1536:zYWOT4K6ju2aDeGj8jucuSAJAg+2Fut5meMRMimS5:z0T4Kh2aOjuVJ+J5FFS5
- TLSH T18BA35C03D6D218FEE1FAD37016EA55327B75B8281B72AB272344D5323D21FA45F29B60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
3c:73:64:06:d0:51:96:32:ff:6f:e8:26:94:a0:64:55:ee:f9:67:4d:7d:f9:a0:ef:b5:e5:eb:8d:4a:f0:52:53
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows UEFI Driver Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 6, 2013
Subject
CN=Microsoft Windows UEFI Driver Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:1e:b1:7e:9c:15:fc:83:7a:00:01:00:00:00:08
Issuer
CN=Microsoft Corporation UEFI CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 2, 2012 - Oct 2, 2013
Subject
CN=Microsoft Corporation UEFI CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:08:d3:c4:00:00:00:00:00:04
Issuer
CN=Microsoft Corporation Third Party Marketplace Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 27, 2011 - Jun 27, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
0
Entry point
16384
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_EFI_APPLICATION
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
10B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.dynamic
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rela
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.dynsym
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
EfiGuard/EFI/Boot/bootx64.efi
- SHA256 50906114c5a3f93c10102829d057206e3c32bedff4aed3f89a576de1c9e9e5aa
- MD5 4f7a4f566781869d252a09dc84923a82
- SHA1 f9eff9ca458f7d3f47c7d7c56752ec208416f4b1
- SHA512 c73583439ad989f5eb3a68753df56a06dc2f04b637415e3c515c74654651e0991a1d5f0ab84da4cd1d681d29a35271ff584a5b988b28ce1b810f94c0d0a57aff
- SSDEEP 1536:SXORuaKsUT4K6ju2aDeGjlfYFOYg+25dKM278vMhmSc:SXfgUT4Kh2a3fYK+JMSc
- TLSH T1BCA36C17D7D218FED1FAD23046A656327B75F8582762EB272340C6323E22F946F29B50
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
ae:8b:2a:05:ee:e4:56:f8:53:b3:c0:64:5f:9f:3a:ce:6c:0e:11:dd:cb:df:86:db:f2:26:92:d6:99:06:3b:8c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows UEFI Driver Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 6, 2013
Subject
CN=Microsoft Windows UEFI Driver Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:1e:b1:7e:9c:15:fc:83:7a:00:01:00:00:00:08
Issuer
CN=Microsoft Corporation UEFI CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 2, 2012 - Oct 2, 2013
Subject
CN=Microsoft Corporation UEFI CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:08:d3:c4:00:00:00:00:00:04
Issuer
CN=Microsoft Corporation Third Party Marketplace Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 27, 2011 - Jun 27, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
0
Entry point
16384
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_EFI_APPLICATION
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
10B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.dynamic
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rela
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.dynsym
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
EfiGuard/EFI/Boot/loader.efi
- SHA256 ee3b8e01662216fe6b1b5ab1552484594f86c095d46346413b0964e1f19303e5
- MD5 528fd99a25e499e0dc99d6d24c1263ac
- SHA1 78c1975eb61657d8468ce6fc2c8fe41874b9b6bf
- SHA512 649dd5a26d4a0d24330ef23beb2a61dde93133d6ac80207141424073315bd4fd91249eca36c913d6ac8bbef3fdcf17eccdee1d791e5d044c90967002fab7f484
- SSDEEP 768:bOaXcWKc3r9e8LUHeph22u4Hel5cuNIaadw+HFYyy/hkqCXjT:bZPKc78B+/wtlkaavlYmj
- TLSH T1D823296663E80128F173EB78CDB6465BD7F27846757483CE13A081CE6FBBD205A18762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
0
Entry point
4288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_EFI_APPLICATION
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Loader.pdb
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
EfiGuard/EfiDSEFix.exe
- IMPHASH be0725db276d8e3aa264fbca03b01ff3
- SHA256 923ccf2257bfcb6e0a386977f4ce79f4a1a9a9a7c58620979d691e8a20cb68b4
- MD5 210d874edc49f624ce78eb7ec9f0b73f
- SHA1 56ad197f3683d9427e3fde0fa257ad7e966fd266
- SHA512 cb4533d97849860d58f2fc589a51aa53e59b79d24c80b40bc0f62ac35799be598f92f49fcd505f36d287d2746c1bc1ddb660baf3119005bf6b2e461a882cf347
- SSDEEP 192:ve7MmoiTlnU9OmnKkTkBh0zKkfpuptOAbm4biRA4ojGnN/2XnkG5G67KjYsH:vegmxiQoKokBhsuLLi6jG92XjPkYK
- TLSH T183A2A59173ED619CF1B73B75AFB6C1565B36BC816232CA5F3090822E29F29805D31B36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
EfiDSEFix.pdb
ntdll
RtlNormalizeProcessParams
wcstoul
RtlAdjustPrivilege
NtTerminateProcess
wcsncmp
NtQuerySystemInformation
_snwprintf
RtlImageNtHeader
NtSetSystemEnvironmentValueEx
RtlAllocateHeap
RtlFreeHeap
NtUnmapViewOfSection
NtCreateSection
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlReleaseRelativeName
NtClose
strncmp
NtCreateFile
NtMapViewOfSection
_stricmp
_vsnwprintf
strcmp
kernel32
WriteConsoleW
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=30795,
count=3, id=257, productName=VS2017 v15.9.7 build 27027, version=27027,
count=23, id=1, productName=Unmarked objects,
count=5, id=264, version=32825,
count=1, id=255, version=32825,
count=1, id=258, version=32825,
KIRIGIRI.dll
- IMPHASH 0bd61aeeb19ac6ef39fbf8af285137f7
- SHA256 eb246d275a07d4e4f44579b9c6879f1a52382f22b4fe2440583ed217d4ec4c70
- MD5 1098656bfcadd7ae22a3d3647926307c
- SHA1 d9e3b0a45c50085e74d08385f8ab66d2b8936b91
- SHA512 ee89c2cd4190e9c4c321fa7b4f4163074fd05a070b7c400ee66de118f5545886d9730b6d710371efef02a62ba29d27d429a3e9c01b5167d52c40567ccebafa2b
- SSDEEP 768:w+jDQXKR2l4kZ0nT900BlBONhecXnt0PJUZtVlvVD:wvKRaZWJZBqbnkUXpD
- TLSH T11CE26C64A3E90FDEE5FAE7BADA71A121467A3E139730D2CF0424169A0DB16D06D34F13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12403
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntdll
NtClose
NtCreateFile
NtCreateSection
NtMapViewOfSection
NtQuerySystemInformation
NtSetSystemEnvironmentValueEx
NtUnmapViewOfSection
RtlAdjustPrivilege
RtlAllocateHeap
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlFreeHeap
RtlImageNtHeader
RtlReleaseRelativeName
kernel32
CloseHandle
CreateFileW
CreateProcessW
DisableThreadLibraryCalls
ExitProcess
FormatMessageW
GetCurrentProcessId
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetSystemInfo
LocalFree
Sleep
VirtualAlloc
VirtualProtect
VirtualQuery
WriteFile
user32
MessageBoxW
shlwapi
PathAppendW
PathRemoveFileSpecW
advapi32
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegQueryValueExA
StartServiceW
msvcrt
_snwprintf
_stricmp
_ultow_s
_wcsnicmp
memcpy
memset
strcmp
strncmp
wcscat_s
wcscpy_s
wcsstr
KIRIGIRI
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
READNFO-MKDEV TEAM.txt
- SHA256 0bc1f0dc2dd71ef5d667987850519554bac5f1fe175b63f1978575976518d61e
- MD5 9944fdf2d5cf90414cdc941f32addcec
- SHA1 ef9039acd04269cf51f2aaa9426d21bb68173939
- SHA512 c271ca9777af919af4d0e030daf34cda968733c950d4206271541320116e2478dfc0a08d5df489493c072c5cbb2aabfeef3cc979d09d69e36996f4ac19309e97
- SSDEEP 192:UA8e5f4c7RaXLkNd8YlG1nAxfkaZ5x0FO/KEb:ue5f4c7RWLgd8iG1nAxfkaZ70FbEb
- TLSH T18DD1ADD2FD71EB1063A3D98E0A01BE18EE874C040FDBC9B9E4FC45B8E1D2CA6A55E154
- MD5 SHA1 SHA512 SSDEEP TLSH
SimpleSvm.sys
- IMPHASH 0ed2dbf2765b337d44d2a494d122e854
- SHA256 a58d017166617156729a3e380ed49e7a768af871f3b2eda0d57d09bece90ad92
- MD5 453df07cc26ac3a5f3011f655fcc8c78
- SHA1 1ed2c33162d45be1d93048c3765efc398f679bb0
- SHA512 05bc81de901f02666317317cb18db9f5c19c7dfed9aba02720e4dfa19244b026dbb6da2f0da8a22904265898a08d1eb73222c9dfbc605c4052fd5c80ab33a6ad
- SSDEEP 384:vY69M3IsgHvLzSy3CTxjCpStwLFCztxSFcK:vX9M3dgzz33qCpStbzyFcK
- TLSH T14B827DA0774D64F4C96181BDA6965B13E8B1B0650B62EBDF807081142F6FBE1AF3D712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
e2:e8:a7:0b:68:b7:b9:29:e6:e9:36:4b:20:b4:f9:df:cd:ff:11:d9:dc:1f:7b:0c:84:fe:99:f6:80:ba:1a:2a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Denuvo GmbH
Chains
Mar 2, 2026
Subject
CN=Denuvo GmbH
Serial Number
56:08:b4:6b:fb:ba:cf:95:47:ed:83:e7:33:de:0c:17
Issuer
CN=Denuvo GmbH
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 26, 2026 - Feb 26, 2027
Minor OS version
0
Major OS version
10
Entry point
28672
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ntoskrnl.exe
vDbgPrintExWithPrefix
RtlInitializeBitMap
RtlClearAllBits
RtlSetBits
RtlGetVersion
KeGetCurrentIrql
KeLowerIrql
KfRaiseIrql
KeDelayExecutionThread
KeSetSystemGroupAffinityThread
KeRevertToUserGroupAffinityThread
KeWaitForSingleObject
KeQueryActiveProcessorCountEx
KeGetProcessorNumberFromIndex
ExAllocatePool2
ExFreePoolWithTag
ExCreateCallback
ExRegisterCallback
ExUnregisterCallback
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocateContiguousNodeMemory
MmFreeContiguousMemory
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateMdl
IoGetCurrentProcess
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
KeBugCheck
MmGetPhysicalAddress
MmGetVirtualForPhysical
PsSetCreateProcessNotifyRoutine
RtlCaptureContext
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
PsAcquireProcessExitSynchronization
PsReleaseProcessExitSynchronization
strcmp
KdDebuggerNotPresent
PsThreadType
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33145,
count=45, id=1, productName=Unmarked objects,
count=4, id=259, version=33145,
count=8, id=260, version=33145,
count=1, id=259, version=35223,
count=1, id=261, version=35223,
count=1, id=258, version=35223,
amd_ags_x64.dll
- SHA256 3ff29dcbb7267ac98455c7661f9a07f07672f4232723dbc7e6af62811962d746
- MD5 f2460940c72fee2c051ea594fd495712
- SHA1 056e2954f3659742e5f0d740c28862a65bf653f7
- SHA512 94a9abed4fbf1e28c5cb20b31733d6aff1440e1a9c5192843026ba1eec900a0542f08697f904cfb991899457ee2c1c5378a2d18ef934d87cafbe617864a51ef1
- SSDEEP 3072:v4qOjrlq994NtUbhut1yDwqQ/ps4J/qKriVb:AjjrlEKNtUbhuEwqQBbr0
- TLSH T120F37E0777A400BAE5A7C238C9674752E7B2B851172197DF03A0437A6F7B3A19D3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
28432
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
agsCheckDriverVersion
agsDeInitialize
agsDriverExtensionsDX11_BeginUAVOverlap
agsDriverExtensionsDX11_CreateBuffer
agsDriverExtensionsDX11_CreateDevice
agsDriverExtensionsDX11_CreateTexture1D
agsDriverExtensionsDX11_CreateTexture2D
agsDriverExtensionsDX11_CreateTexture3D
agsDriverExtensionsDX11_DestroyDevice
agsDriverExtensionsDX11_EndUAVOverlap
agsDriverExtensionsDX11_GetMaxClipRects
agsDriverExtensionsDX11_IASetPrimitiveTopology
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirect
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirectCountIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirectCountIndirect
agsDriverExtensionsDX11_NotifyResourceBeginAllAccess
agsDriverExtensionsDX11_NotifyResourceEndAllAccess
agsDriverExtensionsDX11_NotifyResourceEndWrites
agsDriverExtensionsDX11_NumPendingAsyncCompileJobs
agsDriverExtensionsDX11_SetClipRects
agsDriverExtensionsDX11_SetDepthBounds
agsDriverExtensionsDX11_SetDiskShaderCacheEnabled
agsDriverExtensionsDX11_SetMaxAsyncCompileThreadCount
agsDriverExtensionsDX11_SetViewBroadcastMasks
agsDriverExtensionsDX11_WriteBreadcrumb
agsDriverExtensionsDX12_CreateDevice
agsDriverExtensionsDX12_CreateFromDevice
agsDriverExtensionsDX12_Destroy
agsDriverExtensionsDX12_DestroyDevice
agsDriverExtensionsDX12_PopMarker
agsDriverExtensionsDX12_PushMarker
agsDriverExtensionsDX12_SetMarker
agsGetGPUInfo
agsGetVersionNumber
agsInitialize
agsSetDisplayMode
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=5, id=259, version=30795,
count=142, id=261, version=30795,
count=10, id=260, version=30795,
count=9, id=259, version=34321,
count=15, id=260, version=34321,
count=33, id=261, version=34321,
count=5, id=257, version=30795,
count=94, id=1, productName=Unmarked objects,
count=8, id=261, version=34809,
count=1, id=256, version=34809,
count=1, id=255, version=34809,
count=1, id=151,
count=1, id=258, version=34809,
amd_ags_x64.org
- IMPHASH 3ec60295c941110bbb68a54f3e23aa56
- SHA256 b27b070ca39dc37984fb3dde0187515d36094e72cb881d7a99bd1055befd8da2
- MD5 9352802fae8e6ff020afd9257f33af23
- SHA1 4f80ec7d8174a31a1fa75036c8ae0923b5ef262b
- SHA512 257eea97f8b526b2bb5888074bfdec048acf0c2c2bacb08fb29138f6f796bf440c8f327ed7dd2b86caa7c6a39693e6f2f119a1c01ecc281a24b86626e7289ecd
- SSDEEP 3072:viqOjrlq994NtUbhut1yDwqQ/ps4J/qKriVbDemA:ajjrlEKNtUbhuEwqQBbr0P7A
- TLSH T1F8048E0777B400BBE4A7C638C9974B12D7B2B851172197DF03A4437A6F6B3A19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6b:47:f8:41:b5:96:de:91:c2:b9:bb:de:9b:41:44:76:3f:e5:ea:2b:58:ba:66:f0:34:e2:7d:88:d2:ea:4e:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Advanced Micro Devices,O=Advanced Micro Devices,ST=California,C=US
Chains
May 16, 2025
CN=Advanced Micro Devices,O=Advanced Micro Devices,ST=California,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Advanced Micro Devices,O=Advanced Micro Devices,ST=California,C=US
Serial Number
a5:ad:09:b4:ca:dc:93:29:eb:fe:45:23:43:cf:42:5f
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 26, 2024 - Apr 26, 2027
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
28432
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
FreeLibrary
GetProcAddress
LoadLibraryW
SetEnvironmentVariableW
WriteConsoleW
CreateFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CloseHandle
user32
EnumDisplayDevicesA
agsCheckDriverVersion
agsDeInitialize
agsDriverExtensionsDX11_BeginUAVOverlap
agsDriverExtensionsDX11_CreateBuffer
agsDriverExtensionsDX11_CreateDevice
agsDriverExtensionsDX11_CreateTexture1D
agsDriverExtensionsDX11_CreateTexture2D
agsDriverExtensionsDX11_CreateTexture3D
agsDriverExtensionsDX11_DestroyDevice
agsDriverExtensionsDX11_EndUAVOverlap
agsDriverExtensionsDX11_GetMaxClipRects
agsDriverExtensionsDX11_IASetPrimitiveTopology
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirect
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirectCountIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirectCountIndirect
agsDriverExtensionsDX11_NotifyResourceBeginAllAccess
agsDriverExtensionsDX11_NotifyResourceEndAllAccess
agsDriverExtensionsDX11_NotifyResourceEndWrites
agsDriverExtensionsDX11_NumPendingAsyncCompileJobs
agsDriverExtensionsDX11_SetClipRects
agsDriverExtensionsDX11_SetDepthBounds
agsDriverExtensionsDX11_SetDiskShaderCacheEnabled
agsDriverExtensionsDX11_SetMaxAsyncCompileThreadCount
agsDriverExtensionsDX11_SetViewBroadcastMasks
agsDriverExtensionsDX11_WriteBreadcrumb
agsDriverExtensionsDX12_CreateDevice
agsDriverExtensionsDX12_CreateFromDevice
agsDriverExtensionsDX12_Destroy
agsDriverExtensionsDX12_DestroyDevice
agsDriverExtensionsDX12_PopMarker
agsDriverExtensionsDX12_PushMarker
agsDriverExtensionsDX12_SetMarker
agsGetGPUInfo
agsGetVersionNumber
agsInitialize
agsSetDisplayMode
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=142, id=261, version=30795,
count=10, id=260, version=30795,
count=9, id=259, version=34321,
count=15, id=260, version=34321,
count=33, id=261, version=34321,
count=5, id=257, version=30795,
count=94, id=1, productName=Unmarked objects,
count=8, id=261, version=34809,
count=1, id=256, version=34809,
count=1, id=255, version=34809,
count=1, id=151,
count=1, id=258, version=34809,
coldclient/GameOverlayRenderer64.dll
- IMPHASH 3613ece7dd992c620b2991e90d76879e
- SHA256 ed41c49b18b9f29427b1d4330d3f1a743a460ea722fd33cf5f389301a19e3925
- MD5 bdb340f609a136b0d81e486d6e8b7be2
- SHA1 b0aaf60b730b343a0cf1f4ddd56a36c0dbc1eb8f
- SHA512 f0aac950abe240c249baab393e31b9d274af2402306310a6e26c5821d788ac4c9f8937282dde6eda5dc0b47577e624dd8bf048208fba27bcadeec1b387a2819d
- SSDEEP 1536:IFnIxKVEWneqdJJfeATHaSHWB2A7gAhmkdOwPnsWpdi9dlg3VlPGq5HE:Isrrcfes6wWB2YkNaFyGlleq5HE
- TLSH T1B4952854B6E930B8E076C3788B773A47D57678100751AAEF0360425A2EE3FD2C579FA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
49:1a:f7:58:d9:e3:c4:92:1a:b5:1a:ce:a7:16:d7:7b:a8:da:93:64:be:b6:63:63:1e:37:00:1f:31:6d:91:8b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=GSE,OU=GSE,O=GSE,C=UK
Chains
Mar 2, 2026
Subject
CN=GSE,OU=GSE,O=GSE,C=UK
Serial Number
0c:33:2c:42:ae:c5:c0:f5:9d:af:42:aa:3d:52:5b:ed:0e:0e:60:4f
Issuer
CN=GSE,OU=GSE,O=GSE,C=UK
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 19, 2026 - Apr 6, 2041
Minor OS version
0
Major OS version
6
Entry point
5048
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW
BOverlayNeedsPresent
IsOverlayEnabled
OverlayHookD3D3
SetNotificationInset
SetNotificationPosition
SteamOverlayIsUsingGamepad
SteamOverlayIsUsingKeyboard
ValveHookScreenshots
ValveIsScreenshotsHooked
VulkanSteamOverlayGetScaleFactors
VulkanSteamOverlayPresent
VulkanSteamOverlayProcessCapturedFrame
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
coldclient/steam_settings/configs.app.ini
- SHA256 51de7a34d85f958880f1d6787143e6b157d70fc81842d726c026e962d302bf43
- MD5 7f43980c384fa5cf5fa0d1a421031135
- SHA1 483439b030015b92fe79548e97fa70392167a367
- SHA512 f9502424b2c53490d18aabebf6f0878a9e4cc238881558b9b1769ddf6c1ecf2ec7ea38d5f48c737415eb7c601cb34e0469a000a027abe6932397f10b005fe2c1
- TLSH T12EE0AB8127C51568332B10A1F606B6DEB62581304721F84BB0DFE2500614806C237EF3
- MD5 SHA1 SHA512 TLSH
coldclient/steam_settings/configs.main.ini
- SHA256 5dd219df4b0bb37c07ecd90ccf5215ed182e229d5d7d24b6ba31429ce46c91d4
- MD5 47a31fc4b75a0642c7cc5675fe8fb4f1
- SHA1 9f3da1ad357117ddbc2dd63ebb3193831a7270a9
- SHA512 58101904058e74010df8c1976c1379ddf88518b16df611f15ebe27f92ecd09429b0dbafa87a35898ed30d640e5cde326da3e4aafba64ef90fcbae692d2cb67de
- TLSH T1DB2112235271F035063720651F2FEAD177A4D4B62312345860E45DDA6B2191A362AADC
- MD5 SHA1 SHA512 TLSH
coldclient/steam_settings/configs.user.ini
- SHA256 6910fa848124f4858c8a3c97f0348556be9f46360845a39046ed337288dcdea3
- MD5 9026ea52b22c80bf7c6e5fb4dda04324
- SHA1 5a07926d7a5e9f4ec538b48315b56d0130540c21
- SHA512 4f8d8746c0926419e38c893aae78d988f9ffba45dcbe52da3470fe0640f966078a88636b084e2d87c4471f78dc056a7c0eb78cf0d97a1812c1bda3d7af8da52e
- TLSH T1D4D0228E0E0002A22FB3038832E8C3EF0B0EC2E88C800AFE28E2A3820020CC00028B00
- MD5 SHA1 SHA512 TLSH
coldclient/steam_settings/steam_appid.txt
- SHA256 c0d7c219dd57927835839c3a3bddb73e2e81c17687d2d7697813dcc7c17f38fd
- MD5 dbe81a5523f97f0feb305a325b505c5f
- SHA1 28c0eb193d9e8e76280e8490d63b9659fdd3a06d
- SHA512 5eddb9d76f8abc16273a0f08fad2b3456961119f3ecfcbdd58a636721b05c2c93d19e85d8cffa114e63157a7b6c2406032bdf51fea76b44b83235178214bef76
- MD5 SHA1 SHA512
coldclient/steam_settings/steam_interfaces.txt
- SHA256 f851b4bd9af4ca83f9374a9cec31079327628876d854606e9ef9cfe78cfdbb7b
- MD5 b160e3f00eefc9ab4ddeedaed51266e0
- SHA1 f3733fbdfaeb37b877cc1540ebb24df49415f25f
- SHA512 005ffd586975b903032cee5b16ff9402c59c6d378ff66d913cbd54b5c5d5d706c6afa803947c4850c6f5244398eb5b08b83eb844c2a3bda6c30f73c72861c6c3
- TLSH T100F0491B75213D794F28B4EA01F2B923E198366796C0D8FDDEC7B7C10364A1413AEA01
- MD5 SHA1 SHA512 TLSH
coldclient/steamclient.dll
- IMPHASH 22a51e94d76a95121f7e33195e039ef0
- SHA256 e29aedac4769e51862e96116063419bac6b27a3b687e773813248460d5b66d1c
- MD5 fce3578d6ab6b1ebde776765e7249956
- SHA1 b2dd38753d1a33f8d63c72ae577adfd3632bfcc1
- SHA512 e07aa4e7f9fe26b71fa17b93cfb8d572ececa2e2ba74577c87f2c07b839b89acae45f7422bd596ebe7f86cc5980447af61c2ec067aab3a431672f38f4987a13d
- SSDEEP 196608:S16MBSDCj3mu06WW4+6jIk9DQX9b7YFLbANKkx6hFeFwB7wciZgA72D8Uyaew:7y+lI7YFLbANKkpwlwcIgA72Wa1
- TLSH T19EF6BE02E655D035FBB701F68BFA06BA5B3C9F70271142EB72C075598A66AD0FE31623
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
f7:e9:00:9e:9f:8c:be:8a:99:3b:71:7a:34:d7:8f:54:14:9d:7f:73:16:2d:f1:7b:5d:60:8d:2c:88:91:d7:c1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=GSE,OU=GSE,O=GSE,C=UK
Chains
Mar 2, 2026
Subject
CN=GSE,OU=GSE,O=GSE,C=UK
Serial Number
eb:95:f8:1c:9d:09:2b:7d:ac:25:8c:41:d5:24:12:05:b0:54:88
Issuer
CN=GSE,OU=GSE,O=GSE,C=UK
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 19, 2026 - Apr 6, 2041
Minor OS version
0
Major OS version
6
Entry point
5853577
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ws2_32
getsockname
getpeername
WSACleanup
WSAWaitForMultipleEvents
__WSAFDIsSet
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSAGetLastError
select
connect
WSAIoctl
gethostname
inet_pton
inet_ntop
freeaddrinfo
getaddrinfo
WSAStartup
socket
setsockopt
send
recvfrom
recv
ntohs
listen
htons
htonl
getsockopt
ioctlsocket
closesocket
bind
accept
InetPtonW
WSAConnect
WSASetLastError
sendto
ntohl
WSASetEvent
iphlpapi
GetAdaptersInfo
winmm
timeGetDevCaps
waveInMessage
waveInReset
waveInStart
waveInAddBuffer
waveInUnprepareHeader
waveInPrepareHeader
waveInClose
waveInOpen
waveInGetErrorTextW
waveInGetDevCapsW
waveInGetNumDevs
waveOutMessage
timeBeginPeriod
waveOutReset
waveOutRestart
waveOutPause
waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
waveOutGetErrorTextW
waveOutGetDevCapsW
waveOutGetNumDevs
timeGetTime
PlaySoundA
waveOutGetPosition
timeEndPeriod
bcrypt
BCryptGenRandom
dbghelp
SymCleanup
StackWalk
SymGetModuleBase
SymInitialize
SymGetSymFromAddr
SymSetOptions
SymFromAddr
SymFunctionTableAccess
xinput1_4
ord2
ord3
gdi32
DeleteObject
CreateRectRgn
GetDeviceCaps
dwmapi
DwmGetColorizationColor
DwmIsCompositionEnabled
DwmEnableBlurBehindWindow
kernel32
DeleteFileW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
CreateThread
TlsSetValue
TlsGetValue
TlsAlloc
GetConsoleMode
TlsFree
ExitThread
FreeLibraryAndExitThread
InterlockedFlushSList
ReadConsoleW
OutputDebugStringA
GetLogicalProcessorInformation
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetEndOfFile
WriteConsoleW
SetFilePointerEx
InitializeCriticalSectionAndSpinCount
DuplicateHandle
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentThread
GetEnvironmentVariableW
SetEnvironmentVariableW
Sleep
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryW
SetLastError
CreateDirectoryW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
MultiByteToWideChar
GetEnvironmentVariableA
OutputDebugStringW
CloseHandle
GetLastError
WaitForSingleObject
ExitProcess
TerminateProcess
ResumeThread
VirtualAllocEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
WriteFile
GetModuleHandleW
LoadLibraryExA
LoadLibraryExW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
GetConsoleOutputCP
GetSystemDirectoryW
LoadLibraryA
CreateEventA
SwitchToThread
GetCurrentProcessId
VerSetConditionMask
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocaleInfoA
GetCommandLineW
GetProcessId
GetTickCount64
GetModuleHandleExW
LocalFree
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
GetSystemInfo
FormatMessageA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetTickCount
GetFullPathNameW
MoveFileExW
WaitForSingleObjectEx
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
VerifyVersionInfoW
FormatMessageW
ReleaseMutex
CreateMutexW
GetSystemTimeAsFileTime
MoveFileExA
SetEvent
ResetEvent
CreateEventW
SetThreadPriority
SetWaitableTimer
CancelWaitableTimer
LocalAlloc
CreateWaitableTimerA
CreateFileW
DeviceIoControl
WaitForMultipleObjectsEx
TerminateThread
GetExitCodeThread
GetPriorityClass
SignalObjectAndWait
GetThreadPriority
GetCurrentDirectoryW
InitializeSRWLock
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableSRW
GetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
SetCurrentDirectoryW
GetLocaleInfoEx
AreFileApisANSI
CopyFileW
GetFileInformationByHandleEx
TryAcquireSRWLockExclusive
WakeAllConditionVariable
RaiseException
InitOnceBeginInitialize
InitOnceComplete
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
IsProcessorFeaturePresent
GetStringTypeW
EncodePointer
DecodePointer
LCMapStringEx
RtlUnwind
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
WideCharToMultiByte
GetDateFormatW
GetFileSizeEx
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
UnhandledExceptionFilter
GetCPInfo
user32
MonitorFromWindow
LoadCursorA
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
ReleaseDC
GetDC
IsWindowUnicode
SetProcessDPIAware
GetMessageExtraInfo
TrackMouseEvent
GetKeyboardLayout
GetWindowThreadProcessId
GetDesktopWindow
ScreenToClient
GetClientRect
IsIconic
IsWindowVisible
WindowFromDC
DestroyWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
DefWindowProcW
PeekMessageW
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
MessageBoxA
EnumWindows
GetKeyState
GetForegroundWindow
advapi32
RegQueryValueExW
RegCloseKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegOpenKeyExA
RegQueryValueExA
shell32
SHGetKnownFolderPath
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteA
ole32
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
PropVariantClear
CoInitialize
setupapi
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceAlias
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInterfaceRegKey
Breakpad_SteamMiniDumpInit
Breakpad_SteamSendMiniDump
Breakpad_SteamSetAppID
Breakpad_SteamSetSteamID
Breakpad_SteamWriteMiniDumpSetComment
Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
CreateInterface
Steam3_BConnected
Steam3_BGetCallback
Steam3_BLoggedOn
Steam3_BMainLoop
Steam3_ConnectToGlobalInstance
Steam3_CreateLocalInstance
Steam3_FreeLastCallback
Steam3_GSSendDisconnect
Steam3_GSSendLogonRequest
Steam3_GSSendStatusResponse
Steam3_GSSendUserConnect
Steam3_GSSendUserDisconnect
Steam3_GSSendUserStatusResponse
Steam3_GSSetStatus
Steam3_GetSteamTicket
Steam3_Init
Steam3_LogOff
Steam3_LogOn
Steam3_ReleaseInstance
Steam3_SetLocalIPBinding
Steam_BConnected
Steam_BGetCallback
Steam_BLoggedOn
Steam_BReleaseSteamPipe
Steam_ConnectToGlobalUser
Steam_CreateGlobalUser
Steam_CreateLocalUser
Steam_CreateSteamPipe
Steam_FreeLastCallback
Steam_GSBLoggedOn
Steam_GSBSecure
Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient
Steam_GSGetSteamGameConnectToken
Steam_GSGetSteamID
Steam_GSLogOff
Steam_GSLogOn
Steam_GSRemoveUserConnect
Steam_GSSendSteam2UserConnect
Steam_GSSendSteam3UserConnect
Steam_GSSendUserDisconnect
Steam_GSSendUserStatusResponse
Steam_GSSetServerType
Steam_GSSetSpawnCount
Steam_GSSetStatus
Steam_GSUpdateStatus
Steam_GetAPICallResult
Steam_GetGSHandle
Steam_InitiateGameConnection
Steam_IsKnownInterface
Steam_LogOff
Steam_LogOn
Steam_NotifyMissingInterface
Steam_ReleaseThreadLocalMemory
Steam_ReleaseUser
Steam_SetLocalIPBinding
Steam_TerminateGameConnection
Name
.text
Size
6.0MB
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8.3MB
Virtual Size
8.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
765KB
Virtual Size
843KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
224KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
coldclient/steamclient64.dll
- IMPHASH 9b27edfa3d2ff4505d5b4c2527a54dfb
- SHA256 ca54cad7913279985734945907973f5b37c957d69fdaaf46a058470de12aa55b
- MD5 8c4a558f0a3ddc511c4da97dfb304392
- SHA1 3d967440a8717ec3194d40aa80bcdce23abdc2bd
- SHA512 da41efb09bb52694447d0cb6dbff266c6e1bfaeeb4cb524c2ab3edf1b33e0f27a0d8ee3493f13bdf99bbd94cac5d969efc4e6bc45c481f3e9fc6cd68460dc1be
- SSDEEP 98304:1I4XLEuJspu8NX3OYuq2m5j6nrZpGyq2j71y+4AxYZgAE6EZDi7QZakOoVwj+Ju:lv8NTrSrn9N7wciZgA72D8U7OKu
- TLSH T12A076B47E7BB12E5D6B6C03896B36227FA717499833097D7AAC056064F62BE0DD3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
fd:8c:db:de:94:7c:d8:fb:8a:b2:c4:69:7b:1b:ad:f6:1f:50:c1:b5:1b:7b:6e:1a:0e:86:0a:6a:26:b1:f1:eb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=GSE,OU=GSE,O=GSE,C=UK
Chains
Mar 2, 2026
Subject
CN=GSE,OU=GSE,O=GSE,C=UK
Serial Number
25:5a:6d:0f:73:4d:10:1a:87:05:1e:92:18:fe:3c:2b:f6:bf:9e:5c
Issuer
CN=GSE,OU=GSE,O=GSE,C=UK
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 19, 2026 - Apr 6, 2041
Minor OS version
0
Major OS version
6
Entry point
7196112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
WSAIoctl
getsockname
getpeername
WSACleanup
select
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSAGetLastError
ntohl
sendto
WSASetLastError
WSAConnect
InetPtonW
accept
connect
bind
closesocket
gethostname
ioctlsocket
getsockopt
htonl
htons
listen
ntohs
recv
recvfrom
send
setsockopt
socket
WSAStartup
getaddrinfo
freeaddrinfo
inet_ntop
inet_pton
__WSAFDIsSet
WSAWaitForMultipleEvents
iphlpapi
GetAdaptersInfo
winmm
timeBeginPeriod
timeGetDevCaps
waveInMessage
waveInReset
waveInStart
waveInAddBuffer
waveInUnprepareHeader
waveInPrepareHeader
waveInClose
waveInOpen
waveInGetErrorTextW
waveInGetDevCapsW
waveInGetNumDevs
waveOutMessage
waveOutGetPosition
waveOutReset
waveOutRestart
waveOutPause
waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
waveOutGetErrorTextW
waveOutGetDevCapsW
waveOutGetNumDevs
timeGetTime
timeEndPeriod
PlaySoundA
bcrypt
BCryptGenRandom
dbghelp
SymInitialize
SymGetSymFromAddr64
SymSetOptions
StackWalk64
SymFunctionTableAccess64
SymCleanup
SymGetModuleBase64
SymFromAddr
xinput1_4
ord2
ord3
gdi32
DeleteObject
CreateRectRgn
GetDeviceCaps
dwmapi
DwmEnableBlurBehindWindow
DwmIsCompositionEnabled
DwmGetColorizationColor
kernel32
SetStdHandle
GetFileSizeEx
FlushFileBuffers
EnumSystemLocalesW
HeapReAlloc
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetUserDefaultLCID
GetTimeZoneInformation
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
DuplicateHandle
SetFilePointerEx
SetEndOfFile
IsValidCodePage
GetTimeFormatW
GetACP
WriteConsoleW
FreeLibraryAndExitThread
ExitThread
CreateThread
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentThread
GetEnvironmentVariableW
SetEnvironmentVariableW
Sleep
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryW
SetLastError
CreateDirectoryW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
MultiByteToWideChar
GetEnvironmentVariableA
OutputDebugStringW
CloseHandle
GetLastError
WaitForSingleObject
ExitProcess
TerminateProcess
ResumeThread
VirtualAllocEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
WriteFile
GetModuleHandleW
LoadLibraryExA
LoadLibraryExW
GlobalAlloc
GlobalUnlock
GlobalLock
GetOEMCP
WideCharToMultiByte
GetSystemDirectoryW
LoadLibraryA
CreateEventA
SwitchToThread
GetCurrentProcessId
VerSetConditionMask
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocaleInfoA
GetCommandLineW
GetProcessId
GetTickCount64
GetModuleHandleExW
LocalFree
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
GetSystemInfo
FormatMessageA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetTickCount
GetFullPathNameW
MoveFileExW
WaitForSingleObjectEx
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
VerifyVersionInfoW
FormatMessageW
ReleaseMutex
CreateMutexW
GetSystemTimeAsFileTime
MoveFileExA
SetEvent
ResetEvent
CreateEventW
SetThreadPriority
SetWaitableTimer
CancelWaitableTimer
LocalAlloc
CreateWaitableTimerA
CreateFileW
DeviceIoControl
WaitForMultipleObjectsEx
TerminateThread
GetExitCodeThread
GetPriorityClass
SignalObjectAndWait
GetThreadPriority
GetCurrentDirectoryW
InitializeSRWLock
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableSRW
GetFileInformationByHandleEx
CopyFileW
AreFileApisANSI
GetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
SetCurrentDirectoryW
GetLocaleInfoEx
TryAcquireSRWLockExclusive
WakeAllConditionVariable
RtlPcToFileHeader
RaiseException
InitOnceBeginInitialize
InitOnceComplete
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
IsProcessorFeaturePresent
GetStringTypeW
EncodePointer
DecodePointer
LCMapStringEx
DeleteFileW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
GetLogicalProcessorInformation
OutputDebugStringA
GlobalFree
RtlUnwind
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
user32
MonitorFromWindow
LoadCursorA
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
ReleaseDC
GetDC
GetForegroundWindow
IsWindowUnicode
SetProcessDPIAware
GetMessageExtraInfo
TrackMouseEvent
GetKeyboardLayout
GetDesktopWindow
EnumWindows
ScreenToClient
GetClientRect
IsIconic
IsWindowVisible
WindowFromDC
DestroyWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
DefWindowProcW
PeekMessageW
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
MessageBoxA
GetWindowThreadProcessId
GetKeyState
advapi32
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
shell32
SHGetKnownFolderPath
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteA
ole32
CoGetInterfaceAndReleaseStream
CoCreateInstance
PropVariantClear
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoTaskMemFree
CoInitializeEx
setupapi
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceAlias
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInterfaceRegKey
Breakpad_SteamMiniDumpInit
Breakpad_SteamSendMiniDump
Breakpad_SteamSetAppID
Breakpad_SteamSetSteamID
Breakpad_SteamWriteMiniDumpSetComment
Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
CreateInterface
Steam3_BConnected
Steam3_BGetCallback
Steam3_BLoggedOn
Steam3_BMainLoop
Steam3_ConnectToGlobalInstance
Steam3_CreateLocalInstance
Steam3_FreeLastCallback
Steam3_GSSendDisconnect
Steam3_GSSendLogonRequest
Steam3_GSSendStatusResponse
Steam3_GSSendUserConnect
Steam3_GSSendUserDisconnect
Steam3_GSSendUserStatusResponse
Steam3_GSSetStatus
Steam3_GetSteamTicket
Steam3_Init
Steam3_LogOff
Steam3_LogOn
Steam3_ReleaseInstance
Steam3_SetLocalIPBinding
Steam_BConnected
Steam_BGetCallback
Steam_BLoggedOn
Steam_BReleaseSteamPipe
Steam_ConnectToGlobalUser
Steam_CreateGlobalUser
Steam_CreateLocalUser
Steam_CreateSteamPipe
Steam_FreeLastCallback
Steam_GSBLoggedOn
Steam_GSBSecure
Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient
Steam_GSGetSteamGameConnectToken
Steam_GSGetSteamID
Steam_GSLogOff
Steam_GSLogOn
Steam_GSRemoveUserConnect
Steam_GSSendSteam2UserConnect
Steam_GSSendSteam3UserConnect
Steam_GSSendUserDisconnect
Steam_GSSendUserStatusResponse
Steam_GSSetServerType
Steam_GSSetSpawnCount
Steam_GSSetStatus
Steam_GSUpdateStatus
Steam_GetAPICallResult
Steam_GetGSHandle
Steam_InitiateGameConnection
Steam_IsKnownInterface
Steam_LogOff
Steam_LogOn
Steam_NotifyMissingInterface
Steam_ReleaseThreadLocalMemory
Steam_ReleaseUser
Steam_SetLocalIPBinding
Steam_TerminateGameConnection
Name
.text
Size
7.3MB
Virtual Size
7.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8.6MB
Virtual Size
8.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
801KB
Virtual Size
900KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
268KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
hyperevade.dll
- SHA256 0afad063e2bcb59871ef4232d733e4ca8b7b710ae63eef917a528040ddb30ce9
- MD5 0e156d2e7e3c3132171d4ac2711f9ba5
- SHA1 a4ccf2e440963d5eb0afd1774170a28ac4747972
- SHA512 232298dfc65d57bfe10ac71abf9a763156dc1cfe17b8706d4cc90cfc5ff0ca138be064ce8c59c394d563b9100fe497e153d0dcaaba6820494ea6bc246e0bcd06
- SSDEEP 48:afx0QNfTjK8ZCl/bnlF6NwJJCQUCeh2OHixiiIk9+CyhdtgXdD:OG+fa8k/jjMuNrezCEin9+RfgtD
- TLSH T198D1A4B29E16D4E2E51B06BC41EB4E19B376F35003524BEB2582840D2C8BFE87D34A0A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
2b:b9:38:4d:85:9e:b4:47:b0:e2:e1:e9:e2:95:ab:88:c0:d5:87:32:de:c5:6b:89:27:24:e6:d1:9a:b8:86:05
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Denuvo GmbH
Chains
Mar 2, 2026
Subject
CN=Denuvo GmbH
Serial Number
56:08:b4:6b:fb:ba:cf:95:47:ed:83:e7:33:de:0c:17
Issuer
CN=Denuvo GmbH
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 26, 2026 - Feb 26, 2027
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
DllInitialize
DllUnload
TransparentCallbackHandleAfterSyscall
TransparentCheckAndModifyCpuid
TransparentCheckAndModifyMsrRead
TransparentCheckAndModifyMsrWrite
TransparentCheckAndTrapFlagAfterVmexit
TransparentHandleSystemCallHook
TransparentHideDebugger
TransparentUnhideDebugger
Name
.text
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33145,
count=4, id=1, productName=Unmarked objects,
count=5, id=259, version=33145,
count=7, id=260, version=33145,
count=12, id=260, version=35223,
count=1, id=256, version=35223,
count=1, id=258, version=35223,
hyperhv.dll
- IMPHASH cd918df058e5b05261036d8c2acc8a94
- SHA256 0f8406c1332bc066bd6c592b654ff076ed067585c67d64ae0e4a31e94bca5063
- MD5 6f85cd3128f11226d4e3c914e2a9994e
- SHA1 c34f0bc4987fb6c857c97215ed50d1efbe44e9e8
- SHA512 4c4188f8adf10b142c1231757d47a588d94dc228e1593f2a80a2a87752c5fc23132ff3d0007d5618b0343a5ea4f8f6bfbdab591d2aef390e4118f1b8179a0f50
- SSDEEP 6144:UKCmpZVoltWepRWNKG23uuGurUqLcowsEZyv1wrrH1k:/Ckno43cuuGMUQokMk
- TLSH T11EB4A3B7EC0474B3EC30613489A707AB267BA580976287C71659362B9D937D42F37F88
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
cc:66:68:6f:85:04:4e:2e:be:f6:05:a7:d5:82:e6:04:4c:cf:7f:e1:a0:2f:89:e7:00:3d:9f:44:9f:a4:a4:e9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Denuvo GmbH
Chains
Mar 2, 2026
Subject
CN=Denuvo GmbH
Serial Number
56:08:b4:6b:fb:ba:cf:95:47:ed:83:e7:33:de:0c:17
Issuer
CN=Denuvo GmbH
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 26, 2026 - Feb 26, 2027
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntoskrnl.exe
KeSignalCallDpcDone
KeSignalCallDpcSynchronize
KfRaiseIrql
PsGetProcessImageFileName
MmMapIoSpace
MmUnmapIoSpace
PsGetCurrentProcessId
PsGetCurrentThreadId
__chkstk
MmGetPhysicalAddress
MmGetVirtualForPhysical
IoGetCurrentProcess
ObfDereferenceObject
PsLookupProcessByProcessId
KeGetCurrentProcessorNumberEx
MmMapIoSpaceEx
MmCopyMemory
KeStackAttachProcess
KeUnstackDetachProcess
MmAllocateMappingAddress
MmFreeMappingAddress
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
MmFreeContiguousMemory
KeBugCheckEx
KeDelayExecutionThread
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
PsTerminateSystemThread
IoAllocateMdl
IoFreeMdl
PsSetCreateProcessNotifyRoutine
PsAcquireProcessExitSynchronization
PsReleaseProcessExitSynchronization
__C_specific_handler
KeGetCurrentIrql
KeQueryActiveProcessorCount
KeSetTargetProcessorDpc
KeInsertQueueDpc
KeInitializeDpc
KeGenericCallDpc
MmAllocateContiguousMemory
ExFreePoolWithTag
PsInitialSystemProcess
ExAllocatePoolWithTag
hal
KeQueryPerformanceCounter
hyperevade
TransparentHideDebugger
TransparentHandleSystemCallHook
TransparentUnhideDebugger
TransparentCheckAndModifyCpuid
TransparentCheckAndModifyMsrRead
TransparentCheckAndModifyMsrWrite
BroadcastChangeAllMsrBitmapReadAllCores
BroadcastChangeAllMsrBitmapWriteAllCores
BroadcastDisableBreakpointExitingOnExceptionBitmapAllCores
BroadcastDisableDbAndBpExitingAllCores
BroadcastDisableEferSyscallEventsOnAllProcessors
BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores
BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores
BroadcastDisableMovDebugRegistersExitingAllCores
BroadcastDisableMovToControlRegistersExitingAllCores
BroadcastDisableMovToCr3ExitingOnAllProcessors
BroadcastDisableRdpmcExitingAllCores
BroadcastDisableRdtscExitingAllCores
BroadcastDisableRdtscExitingForClearingEventsAllCores
BroadcastEnableBreakpointExitingOnExceptionBitmapAllCores
BroadcastEnableDbAndBpExitingAllCores
BroadcastEnableEferSyscallEventsOnAllProcessors
BroadcastEnableMovControlRegisterExitingAllCores
BroadcastEnableMovDebugRegistersExitingAllCores
BroadcastEnableMovToCr3ExitingOnAllProcessors
BroadcastEnableRdpmcExitingAllCores
BroadcastEnableRdtscExitingAllCores
BroadcastIoBitmapChangeAllCores
BroadcastIoBitmapResetAllCores
BroadcastResetAllMsrBitmapWriteAllCores
BroadcastResetChangeAllMsrBitmapReadAllCores
BroadcastResetExceptionBitmapAllCores
BroadcastSetExceptionBitmapAllCores
BroadcastSetExternalInterruptExitingAllCores
BroadcastUnsetExceptionBitmapAllCores
BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores
CheckAccessValidityAndSafety
CheckAccessValidityAndSafetyByProcessId
CheckAddressMaximumInstructionLength
CheckAddressPhysical
CheckAddressValidityUsingTsx
ConfigureChangeIoBitmapOnSingleCore
ConfigureChangeMsrBitmapReadOnSingleCore
ConfigureChangeMsrBitmapWriteOnSingleCore
ConfigureDirtyLoggingInitializeOnAllProcessors
ConfigureDirtyLoggingUninitializeOnAllProcessors
ConfigureDisableEferSyscallEventsOnAllProcessors
ConfigureDisableMovToCr3ExitingOnAllProcessors
ConfigureEnableEferSyscallEventsOnAllProcessors
ConfigureEnableEferSyscallHookOnSingleCore
ConfigureEnableMovToControlRegisterExitingOnSingleCore
ConfigureEnableMovToCr3ExitingOnAllProcessors
ConfigureEnableMovToDebugRegistersExitingOnSingleCore
ConfigureEnableRdpmcExitingOnSingleCore
ConfigureEnableRdtscExitingOnSingleCore
ConfigureEptHook
ConfigureEptHook2
ConfigureEptHook2FromVmxRoot
ConfigureEptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks
ConfigureEptHookFromVmxRoot
ConfigureEptHookModifyInstructionFetchState
ConfigureEptHookModifyPageReadState
ConfigureEptHookModifyPageWriteState
ConfigureEptHookMonitor
ConfigureEptHookMonitorFromVmxRoot
ConfigureEptHookReservePreallocatedPoolsForEptHooks
ConfigureEptHookUnHookAllByHookingTag
ConfigureEptHookUnHookSingleAddress
ConfigureEptHookUnHookSingleAddressFromVmxRoot
ConfigureEptHookUnHookSingleHookByHookingTagFromVmxRoot
ConfigureExecTrapAddProcessToWatchingList
ConfigureExecTrapApplyMbecConfiguratinFromKernelSide
ConfigureExecTrapRemoveProcessFromWatchingList
ConfigureInitializeExecTrapOnAllProcessors
ConfigureModeBasedExecHookUninitializeOnAllProcessors
ConfigureSetEferSyscallOrSysretHookType
ConfigureSetExceptionBitmapOnSingleCore
ConfigureSetExternalInterruptExitingOnSingleCore
ConfigureUninitializeExecTrapOnAllProcessors
CounterThreadHandle
CounterUpdater
DirectVmcallChangeIoBitmap
DirectVmcallChangeMsrBitmapRead
DirectVmcallChangeMsrBitmapWrite
DirectVmcallDisableEferSyscallEvents
DirectVmcallDisableMov2CrExitingForClearingCrEvents
DirectVmcallDisableMov2DrExitingForClearingDrEvents
DirectVmcallDisableRdpmcExiting
DirectVmcallDisableRdtscExitingForClearingTscEvents
DirectVmcallEnableEferSyscall
DirectVmcallEnableExternalInterruptExiting
DirectVmcallEnableMov2DebugRegsExiting
DirectVmcallEnableMovToCrExiting
DirectVmcallEnableRdpmcExiting
DirectVmcallEnableRdtscpExiting
DirectVmcallInvalidateEptAllContexts
DirectVmcallInvalidateSingleContext
DirectVmcallPerformVmcall
DirectVmcallResetExceptionBitmapOnlyOnClearingExceptionEvents
DirectVmcallResetIoBitmap
DirectVmcallResetMsrBitmapRead
DirectVmcallResetMsrBitmapWrite
DirectVmcallSetDisableExternalInterruptExitingOnlyOnClearingInterruptEvents
DirectVmcallSetExceptionBitmap
DirectVmcallSetHiddenBreakpointHook
DirectVmcallTest
DirectVmcallUnhookSinglePage
DirectVmcallUnsetExceptionBitmap
DisassemblerLengthDisassembleEngine
DisassemblerLengthDisassembleEngineByProcessId
DisassemblerLengthDisassembleEngineInVmxRootOnTargetProcess
DisassemblerShowInstructionsInVmxNonRootMode
DisassemblerShowOneInstructionInVmxNonRootMode
DisassemblerShowOneInstructionInVmxRootMode
DllInitialize
DllUnload
GetGuestCr0
GetGuestCr2
GetGuestCr3
GetGuestCr4
GetGuestCr8
GetGuestCs
GetGuestDr0
GetGuestDr1
GetGuestDr2
GetGuestDr3
GetGuestDr6
GetGuestDr7
GetGuestDs
GetGuestEs
GetGuestFs
GetGuestGdtr
GetGuestGs
GetGuestIdtr
GetGuestLdtr
GetGuestRFlags
GetGuestRIP
GetGuestSs
GetGuestTr
LayoutGetCr3ByProcessId
LayoutGetCurrentProcessCr3
LayoutGetExactGuestProcessCr3
LstarHook
MemoryManagerReadProcessMemoryNormal
MemoryManagerWritePhysicalMemoryNormal
MemoryMapperCheckIfPageIsNxBitSetOnTargetProcess
MemoryMapperCheckIfPdeIsLargePageOnTargetProcess
MemoryMapperCheckPteIsPresentOnTargetProcess
MemoryMapperFreeMemoryOnTargetProcess
MemoryMapperGetPteVa
MemoryMapperGetPteVaByCr3
MemoryMapperGetPteVaOnTargetProcess
MemoryMapperGetPteVaWithoutSwitchingByCr3
MemoryMapperReadMemorySafe
MemoryMapperReadMemorySafeByPhysicalAddress
MemoryMapperReadMemorySafeFromVmxNonRootByPhysicalAddress
MemoryMapperReadMemorySafeOnTargetProcess
MemoryMapperReadMemoryUnsafe
MemoryMapperReserveUsermodeAddressOnTargetProcess
MemoryMapperSetExecuteDisableToPteOnTargetProcess
MemoryMapperSetSupervisorBitWithoutSwitchingByCr3
MemoryMapperWriteMemorySafe
MemoryMapperWriteMemorySafeByPhysicalAddress
MemoryMapperWriteMemorySafeFromVmxNonRootyPhysicalAddress
MemoryMapperWriteMemorySafeOnTargetProcess
MemoryMapperWriteMemoryUnsafe
NotifyRoutineActive
OrigLstar
PciReadCam
PciWriteCam
PhysicalAddressToVirtualAddress
PhysicalAddressToVirtualAddressByCr3
PhysicalAddressToVirtualAddressByProcessId
PhysicalAddressToVirtualAddressOnTargetProcess
PoolManagerCheckAndPerformAllocationAndDeallocation
PoolManagerFreePool
PoolManagerRequestAllocation
PoolManagerRequestPool
PoolManagerShowPreAllocatedPools
ProcessExitCleanup
ProcessExitNotifyRoutine
ReadPhysicalMemoryUsingMapIoSpace
SetDebugRegisters
SetGuestCr0
SetGuestCr2
SetGuestCr3
SetGuestCr4
SetGuestCr8
SetGuestCs
SetGuestCsSel
SetGuestDr0
SetGuestDr1
SetGuestDr2
SetGuestDr3
SetGuestDr6
SetGuestDr7
SetGuestDs
SetGuestDsSel
SetGuestEs
SetGuestEsSel
SetGuestFs
SetGuestFsSel
SetGuestGdtr
SetGuestGs
SetGuestGsSel
SetGuestIdtr
SetGuestLdtr
SetGuestRFlags
SetGuestRIP
SetGuestRSP
SetGuestSs
SetGuestSsSel
SetGuestTr
StopCounterThread
SwitchToCurrentProcessMemoryLayout
SwitchToPreviousProcess
SwitchToProcessMemoryLayout
SwitchToProcessMemoryLayoutByCr3
SyscallBypassMagic
TargetCR3
TargetProcessId
TargetSysHandler
TrackedProcessId
TransparentHideDebuggerWrapper
TransparentUnhideDebuggerWrapper
VirtualAddressToPhysicalAddress
VirtualAddressToPhysicalAddressByProcessCr3
VirtualAddressToPhysicalAddressByProcessId
VirtualAddressToPhysicalAddressOnTargetProcess
VmFuncApicStoreIoApicFields
VmFuncApicStoreLocalApicFields
VmFuncChangeIgnoreOneMtfState
VmFuncChangeMtfUnsettingState
VmFuncCheckAndEnableExternalInterrupts
VmFuncClearSteppingBits
VmFuncDisableExternalInterruptsAndInterruptWindow
VmFuncEnableAndCheckForPreviousExternalInterrupts
VmFuncEnableMtfAndChangeExternalInterruptState
VmFuncEventInjectBreakpoint
VmFuncEventInjectInterruption
VmFuncEventInjectPageFaultRangeAddress
VmFuncEventInjectPageFaultWithCr2
VmFuncGetCsSelector
VmFuncGetInterruptibilityState
VmFuncGetLastVmexitRip
VmFuncGetRflags
VmFuncGetRip
VmFuncIdtQueryEntries
VmFuncInitVmm
VmFuncInjectPendingExternalInterrupts
VmFuncInvalidateEptAllContexts
VmFuncInvalidateEptSingleContext
VmFuncNmiBroadcastInvalidateEptAllContexts
VmFuncNmiBroadcastInvalidateEptSingleContext
VmFuncNmiBroadcastRequest
VmFuncPerformRipIncrement
VmFuncQueryModeExecTrap
VmFuncReadExceptionBitmap
VmFuncRegisterMtfBreak
VmFuncSetExceptionBitmap
VmFuncSetExternalInterruptExiting
VmFuncSetInterruptWindowExiting
VmFuncSetInterruptibilityState
VmFuncSetLoadDebugControls
VmFuncSetMonitorTrapFlag
VmFuncSetMovControlRegsExiting
VmFuncSetMovDebugRegsExiting
VmFuncSetMovToCr3Vmexit
VmFuncSetNmiExiting
VmFuncSetNmiWindowExiting
VmFuncSetPmcVmexit
VmFuncSetRdtscExiting
VmFuncSetRflagTrapFlag
VmFuncSetRflags
VmFuncSetRip
VmFuncSetSaveDebugControls
VmFuncSetTriggerEventForCpuids
VmFuncSetTriggerEventForVmcalls
VmFuncSetTriggerEventForXsetbvs
VmFuncSmmPerformSmiOperation
VmFuncSuppressRipIncrement
VmFuncUnRegisterMtfBreak
VmFuncUninitVmm
VmFuncUnsetExceptionBitmap
VmFuncVmxBroadcastInitialize
VmFuncVmxBroadcastUninitialize
VmFuncVmxCompatibleMemcmp
VmFuncVmxCompatibleMicroSleep
VmFuncVmxCompatibleStrcmp
VmFuncVmxCompatibleStrlen
VmFuncVmxCompatibleStrncmp
VmFuncVmxCompatibleWcscmp
VmFuncVmxCompatibleWcslen
VmFuncVmxCompatibleWcsncmp
VmFuncVmxGetCurrentExecutionMode
VmFuncVmxVmcall
VmFuncWriteExceptionBitmap
WritePhysicalMemoryUsingMapIoSpace
Name
.text
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
383KB
Virtual Size
383KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=35223,
count=5, id=257, version=33145,
count=65, id=1, productName=Unmarked objects,
count=6, id=259, version=33145,
count=8, id=260, version=33145,
count=8, id=259, version=35223,
count=74, id=260, version=35223,
count=1, id=256, version=35223,
count=1, id=258, version=35223,
hyperkd.sys
- IMPHASH ae2d6dbe66fec7a53cd4edd5d817848b
- SHA256 b5f5f93190ecf89f94feaffdd77f25fcd9b922160a705763e4c875a88a91cb0c
- MD5 a3a24945bf08b74b9e375c130966d6d2
- SHA1 f9f57d2be4bd22effe1f49623cfc1dda04fd6dc0
- SHA512 2fdb809007038aca52629d04233d16e7b3f664aa6b970039172e710ca668b5fe370906eb7b6b5a4be4b6a5221652c573689bdc314c320b6409fbb02bd66b3b16
- SSDEEP 192:Nq4qGmnydcI9U6mycymyJyJyC6AVGs6m1zCNnchal:Nf7cI9U6mhnoQD6AVNmcy
- TLSH T17432C661A387DCD5C90681BCC2964C2E60A5F104D32757C79BB698B4CE4E7E12F3BA23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
63:b6:0e:d5:49:a9:3c:09:82:c7:8c:d0:ff:bc:63:2a:c7:ef:2d:e5:71:e9:c6:77:50:7f:fb:72:42:f3:c2:8d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Denuvo GmbH
Chains
Mar 2, 2026
Subject
CN=Denuvo GmbH
Serial Number
56:08:b4:6b:fb:ba:cf:95:47:ed:83:e7:33:de:0c:17
Issuer
CN=Denuvo GmbH
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 26, 2026 - Feb 26, 2027
Minor OS version
0
Major OS version
10
Entry point
4176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
hyperhv
ProcessExitCleanup
CounterThreadHandle
StopCounterThread
NotifyRoutineActive
VmFuncUninitVmm
CounterUpdater
VmFuncInitVmm
ntoskrnl.exe
ObfDereferenceObject
KeWaitForSingleObject
ExCreateCallback
ExRegisterCallback
ExUnregisterCallback
PsCreateSystemThread
ObReferenceObjectByHandle
ZwClose
NtQuerySystemInformation
PsThreadType
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=5, id=259, version=33145,
count=8, id=260, version=33145,
count=7, id=257, version=35223,
count=290, id=1, productName=Unmarked objects,
count=1, id=259, version=35223,
count=43, id=260, version=35223,
count=1, id=258, version=35223,
hyperlog.dll
- IMPHASH 0f1f4591add7f21f35124b5fbf17aa2a
- SHA256 587ec95aed2e1707129cf958010b77d1af4eaff98ae06f0cc6edacf130f9ac4a
- MD5 f28aa9b5c7598806bcc6b78f29daab8c
- SHA1 0553b2413888610f46a9c28a820a9f954fcdfe8a
- SHA512 96274e0abdb3c11e4547ba122a3f0a96f959bb998adbf914d8d3a6e47558bbeda70edfbe6ae1f62ccf64f39527d473e8ff78a12eba64f92ac7dfaabb655d6c7f
- SSDEEP 192:3v2Ikf6QZh7V77O7Tm5ITwHYcHylqaSyxU5KzCNncos:f2zCSh7xO/mSwH5jDcos
- TLSH T15F522829218124F8E81E597995B71E0AEDB2F8111B3262DF1576C3BB4F26BC1373DA03
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
6f:f8:92:de:e2:6e:67:36:31:47:89:37:c2:d5:cf:b8:5d:8f:a5:fe:82:fc:e1:0f:f7:9e:57:82:79:0f:46:91
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Denuvo GmbH
Chains
Mar 2, 2026
Subject
CN=Denuvo GmbH
Serial Number
56:08:b4:6b:fb:ba:cf:95:47:ed:83:e7:33:de:0c:17
Issuer
CN=Denuvo GmbH
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 26, 2026 - Feb 26, 2027
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntoskrnl.exe
ExAllocatePoolWithTag
ExAllocatePool2
ExFreePoolWithTag
strnlen
DbgPrint
RtlTimeToTimeFields
KeLowerIrql
KfRaiseIrql
KeInitializeDpc
KeInsertQueueDpc
KeSetEvent
KeInitializeSpinLock
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeQueryActiveProcessorCount
KeGetCurrentProcessorNumberEx
ExSystemTimeToLocalTime
IofCompleteRequest
ObReferenceObjectByHandle
ObfDereferenceObject
sprintf_s
vsprintf_s
ExEventObjectType
DllInitialize
DllUnload
LogCallbackCheckIfBufferIsFull
LogCallbackPrepareAndSendMessageToQueue
LogCallbackPrepareAndSendMessageToQueueWrapper
LogCallbackSendBuffer
LogCallbackSendMessageToQueue
LogInitialize
LogMarkAllAsRead
LogRegisterEventBasedNotification
LogRegisterIrpBasedNotification
LogUnInitialize
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
714B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33145,
count=24, id=1, productName=Unmarked objects,
count=5, id=259, version=33145,
count=7, id=260, version=33145,
count=4, id=260, version=35223,
count=1, id=256, version=35223,
count=1, id=258, version=35223,
hyperlog.inf
- SHA256 7d72feb2ab1a3ad7a8d6d7c367d3e8589530b5373bb17a4debdc448cd8c4237e
- MD5 3cc4065db0d5a9aed9f58575c488452a
- SHA1 69e16aebd7e2de1a2ee1021a6b8b1f5d8309ee7a
- SHA512 884327d101bd64960beff31a4e6ef088634c39841ac434afa24acbbde617b11526ab64c1de9db02352784960677eb0ffe9ca1f94a188f6ec6661d0ca5665e809
- TLSH T123419B090E5E4FB83593A3165F27D6E3F9C0620B539F342BB19EB2255B8C918423D76E
- MD5 SHA1 SHA512 TLSH
kdserial.dll
- IMPHASH 6358ef294754edad6f5d13aee2ac7743
- SHA256 d7ce65448e021af0233caa3b27b0eda5dc9e3c4b461b917d5378db38a790b363
- MD5 c3ede4d9aa30b30effd25cc1cdeef8a1
- SHA1 4410fa4f2aa184c7f506104fe0536e3190c8f301
- SHA512 31e418fd657edb17386cb3d7abe7506e5e61d85559f1af27e9dd4fdf1db7ef94ac3abaa1b3a2362b41aebfa91ec6f2ca8d1a23e2af7fb5bfcb61f75224b88e7e
- SSDEEP 768:tKRkD9uVFoZpRZ5Z2Pz7iePkO24lVvgA+8yfX0jxh6sJHcB:tQTofZ52PPkO2/AUX0TN6
- TLSH T167D22B9A12F424AAC559827DC9536D1FC6FFF8281310A6DF0320627E6F23BF15A39721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
02:e9:fb:cb:c4:dd:c6:c0:f0:d3:61:5d:63:48:e3:93:ee:90:fb:d3:4a:1d:20:84:5a:87:1e:0a:af:a7:33:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Denuvo GmbH
Chains
Mar 2, 2026
Subject
CN=Denuvo GmbH
Serial Number
56:08:b4:6b:fb:ba:cf:95:47:ed:83:e7:33:de:0c:17
Issuer
CN=Denuvo GmbH
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 26, 2026 - Feb 26, 2027
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntoskrnl.exe
_strupr
KdDebuggerNotPresent
HalPrivateDispatchTable
PoSetHiberRange
EtwRegister
EtwWriteTransfer
_vsnprintf
EtwSetInformation
strstr
KeFindConfigurationEntry
atol
hal
KeStallExecutionProcessor
KdComPortInUse
DllInitialize
DllUnload
HviGetDebugDeviceOptions
HviGetHypervisorFeatures
HviIsHypervisorVendorMicrosoft
KdHyperDbgPrepareDebuggeeConnectionPort
KdHyperDbgRecvByte
KdHyperDbgSendByte
KdHyperDbgTest
KdInitialize
KdPower
KdReceivePacket
KdSendPacket
KdSetHiberRange
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
512B
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
457B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=263, version=27412,
count=4, id=262, version=27412,
count=5, id=257, version=33145,
count=13, id=1, productName=Unmarked objects,
count=4, id=259, version=33145,
count=7, id=260, version=33145,
count=17, id=260, version=35223,
count=1, id=256, version=35223,
count=1, id=258, version=35223,
steamclient_loader_x64.exe
- IMPHASH 365e642f3e1cc345bc7f6d7709fe1049
- SHA256 551a28422e1cd119140aad059f9d44237ebf8c850037ef4ff4522a02627b3d65
- MD5 e3901b3d2889dcf02f3fb9174f806f94
- SHA1 5280bd47fafbb32f34839f1d74eecbec162410ed
- SHA512 52329830c36a356a9e28ceb093b6754e79e5489289aa06de3b2aeaf8ced644e19272ee1f76009c593a5267c82ce726db40af5e8e7126395bbc7fcc8deda70625
- SSDEEP 6144:BGq6IsVjtdVb8z9G0SDUpkT8kU+W4AxTjaK2F/lrTw072T4:BkJ09G0wUpkvWnxT52trM14
- TLSH T16E746E66F79414F9E1B7C138CD428905EBB2BC5A4761EADF23E04A962F236D08E3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
73:05:25:79:14:71:38:60:f6:61:48:d3:2e:cd:90:44:5c:9b:aa:9f:60:66:e4:06:21:16:c7:ef:54:65:05:2c
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=GSE,OU=GSE,O=GSE,C=UK
Chains
Mar 2, 2026
Subject
CN=GSE,OU=GSE,O=GSE,C=UK
Serial Number
73:8e:7a:89:4b:48:77:fb:1e:b8:eb:d6:cb:6c:4e:ef:d2:4e:33:7c
Issuer
CN=GSE,OU=GSE,O=GSE,C=UK
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 19, 2026 - Apr 6, 2041
Minor OS version
0
Major OS version
6
Entry point
120192
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
MessageBoxA
kernel32
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
GetModuleFileNameW
GetModuleHandleW
CreateRemoteThread
FormatMessageA
SetEnvironmentVariableA
SetEnvironmentVariableW
GetCurrentProcessId
TerminateProcess
ResumeThread
CreateProcessW
WriteConsoleW
WaitForSingleObject
SetLastError
GetLastError
CloseHandle
SetEndOfFile
LoadLibraryW
LocalFree
GetLocaleInfoEx
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
AreFileApisANSI
GetProcAddress
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlUnwind
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
ExitProcess
GetStdHandle
WriteFile
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
advapi32
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
Name
.text
Size
223KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
watchdog.exe
- IMPHASH 57a8dc5bdbaba87295256a559be1ecf0
- SHA256 6fe71d7bd09ba6518f49ce27abfc3eab6d83b07cc990a72682b421e106fd80e5
- MD5 f912a8cab09669e2b5cc40d01d2c1f35
- SHA1 d3b5ec43075923916b2f4d42e60d84fc7d07504c
- SHA512 35214a1c6e0dc68238d35ac96b7767a0d23ddc35ff826270a4c29fefa680ce44a097544f6398e26866882e00c861ac63a3c7bb76e142e9ac76b533e8c9265802
- SSDEEP 1536:TUD5ndR4ESf3r8qaSfjUxvW4Tlqe/LRjlFEZUIf:gdmfrZa3xlrd
- TLSH T11563F194A6DE0AD4F8E086B7D3370648B136B9A6E33035DF42B2912D193ABD05CF1257
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CloseHandle
CreateToolhelp32Snapshot
ExitProcess
FormatMessageW
GetCommandLineW
GetLastError
LocalFree
OpenProcess
Process32FirstW
Process32NextW
WaitForSingleObject
user32
MessageBoxW
advapi32
CloseServiceHandle
ControlService
DeleteService
OpenSCManagerW
OpenServiceW
shell32
CommandLineToArgvW
msvcrt
_wtol
memset
wcscat_s
wcscmp
wcscpy_s
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ