AutoTweakerSetup[.]exe

resource
AutoTweakerSetup.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Bridge.exe
unpack001/Executor.exe
unpack001/LuminAutoTweaker.exe

AutoTweakerSetup.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 60c4632f3bad71f86f738c1104256f581c95bfa84069e2f5fb2c1b2b7795080d
MD5 393c8a6312ba5801390d4a1153c1d809
SHA1 45940440bf67bcb2f2f00bbf5e6cc7e3a821fca9
SHA512 b79ee2d1eec436c84bcb88dc159ac4aff826b4d8c5b8740ebfa018ec2d1ddeca7b7480640172b3d52c695e72c477335e1ab8102281bd23370ee5df849e265c2a
SSDEEP 1572864:mnU1HPKRtnP4slDJhjvoxyjUV67611Nx5Qr88D77:mnU1vKRlP4s3vBT7IL47
TLSH
T1FED73372A35408D5EB839071C2AEBB8441739EB730D2E1D27610BE6A2DF4BE7CB19157
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 8e58b3e6e3896a4bae05fa2f6adc238d391aa80bc51c138f851f373c6c23e518
MD5 eadf80c79f88337c58ca0fb5032cb579
SHA1 523d7118a3755790eaddd6e99f7b3814e97d47d0
SHA512 ed612cda75f4b345c1405be33575a0060d6399654d66356e8102ec82a057497ef7dc99906132bd729ae793e7fc4f46cdbd57256fca567a056bed642c1d58b7ed
SSDEEP 192:6K3Taw+vLvvswRvyb7qY1eL5qDJD8CUNObWF/U0p3+i8Esub:6MOLzYQdqDJHsxcWPX
TLSH
T1681207AEAF1C6F539E71D2D9EA21188D1902861CF51ACEEC7E8F24055763B54267CFC0
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bridge.exe

IMPHASH 3142d73fbd66c57e9fd8dc65f39f3ab0
SHA256 38c901914fa977ac27ecc76aeadb216d2ec806ec69307790798a8e30ea1925d1
MD5 aceec939b62be3a5181d76069322c2cf
SHA1 6bf871b6594b233e3287e951deee6359502cf301
SHA512 f5a42730a46a4640f318deadc661aa7572bfc225e37b39a1e360282b9eb5c4855f2e5b7e8d7e2ec363a8f245eac086d15fb98b16c3beb27d301ae5667a5d09db
SSDEEP 6144:LTkH4xD0vWwceRYmwy901X0GNaLlt0fbZvZq:L1ZYu
TLSH
T12C6408C2EC071AE9F6E6E63975A13323F86737960A38C73F25C05D62551878092AF74E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

262808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\JoshK\OneDrive\Desktop\Auto Tweaker WPF v5\Bridge\x64\Release\Bridge.pdb

kernel32

TerminateProcess OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW QueryFullProcessImageNameA CreateFileA GetCurrentThread Process32FirstW CloseHandle FreeConsole GetThreadContext VirtualProtect GetModuleHandleW WideCharToMultiByte GetConsoleWindow CreateProcessA IsDebuggerPresent GetExitCodeProcess ReadFile CreateNamedPipeA WriteFile DisconnectNamedPipe ConnectNamedPipe WaitNamedPipeA GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess GetCurrentProcessId ExitProcess QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

user32

ShowWindow MessageBoxA

advapi32

RegCloseKey RegOpenKeyExA RegEnumKeyExA

msvcp140

?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_detach _Thrd_join _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memcpy memcmp __std_exception_destroy __std_exception_copy __std_terminate strstr

api-ms-win-crt-runtime-l1-1-0

exit terminate _beginthreadex _register_thread_local_exe_atexit_callback _c_exit _invoke_watson _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _initterm _initterm_e _exit

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-string-l1-1-0

_stricmp strcmp tolower

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-convert-l1-1-0

wcstombs_s

api-ms-win-crt-math-l1-1-0

__setusermatherr sin sinf expf cos sqrt tan

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

264KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.1337

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Executor.exe

IMPHASH 8d6bb70e5aa482aca6975e001ef9bdfe
SHA256 9c9970bf7de7b8b907605a58869e23cd77d8991191a9a392f9a01bbf134815a3
MD5 87a53f8e47a83552452b6f5a7ac9c5e4
SHA1 99f065bffb97dbb95b9e4952fd33ec9414fb5953
SHA512 8fa3ed0e82045066d81a5b296dd50a098ca2b994982380752f2a12cc94fad833d10544990d94758250640d11ebaf15cbf1fd21359ebf7874ad799a54a793867d
SSDEEP 24576:V+NbN2NUN1NHNSN/NZJ/TP1n1Lisi0i5ibiIiuiki1ieihiNibiSiyiYidiqi1i2:2vi8XrtoQ0xDBbZ7dpjeIJcY2E
TLSH
T18B76A6C29C0356DDF9E2E63636A93723B8633B561A2DCB3F58D05C72511978092EB34E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6654908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\JoshK\OneDrive\Desktop\Auto Tweaker WPF v5\Executor\Executor\x64\Release\Executor.pdb

bcrypt

BCryptDestroyKey BCryptDestroyHash BCryptHashData BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGetProperty BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey

winhttp

WinHttpCloseHandle WinHttpSetOption WinHttpSendRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpCrackUrl WinHttpOpenRequest WinHttpQueryHeaders WinHttpQueryDataAvailable

advapi32

EnumServicesStatusExA RegOpenKeyExA RegEnumKeyExA RegCloseKey CryptReleaseContext CryptGenRandom CryptAcquireContextW RegEnumValueA OpenEventLogA CloseEventLog AllocateAndInitializeSid GetUserNameA FreeSid CheckTokenMembership ReadEventLogA CloseServiceHandle OpenSCManagerA

user32

CreateDesktopW ShowWindow CloseDesktop

kernel32

GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx GetConsoleOutputCP GetConsoleMode ReadConsoleW GetTimeZoneInformation HeapReAlloc IsValidCodePage GetACP GetOEMCP LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetModuleFileNameA FindFirstFileA VirtualProtect GetCurrentProcess TerminateProcess GetEnvironmentVariableA FindClose WaitForSingleObject IsProcessInJob OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetLastError Process32NextW QueryFullProcessImageNameA CreateFileA GetCurrentThread DeleteFileA Process32FirstW CloseHandle FreeConsole GetCommandLineA GetThreadContext GetProcAddress ExitProcess GetCurrentProcessId GetModuleHandleW FreeLibrary WideCharToMultiByte GetConsoleWindow CreateProcessA IsDebuggerPresent GetExitCodeProcess MultiByteToWideChar OutputDebugStringW ReadFile SetInformationJobObject SetHandleInformation WriteFile AssignProcessToJobObject CreateJobObjectW CreatePipe PeekNamedPipe CreateProcessW CreateDirectoryW FindFirstFileW FindNextFileW CreateFileW GetFileAttributesW GetTickCount64 DeleteFileW GetLocalTime GetFileSize MoveFileA GetFileAttributesExA CreateNamedPipeA FindNextFileA GetCurrentDirectoryA DisconnectNamedPipe GetTempPathA CopyFileA FileTimeToSystemTime K32GetModuleBaseNameA K32EnumProcesses RemoveDirectoryA SystemTimeToTzSpecificLocalTime K32EnumProcessModules CreateDirectoryA ConnectNamedPipe FlushFileBuffers GetFullPathNameA GetStdHandle SetFileAttributesW TlsAlloc GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize InitializeCriticalSectionAndSpinCount SetLastError RaiseException InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo SetEndOfFile FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetModuleFileNameW FreeLibraryAndExitThread ExitThread GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection CreateThread GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue WriteConsoleW QueryPerformanceCounter FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx SetCurrentDirectoryW GetCurrentDirectoryW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle GetTempPathW AreFileApisANSI DeviceIoControl CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW LocalFree GetLocaleInfoEx WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection TlsGetValue

crypt32

CryptBinaryToStringA CryptStringToBinaryA

shell32

SHGetFolderPathW

ole32

CoInitializeEx CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity

oleaut32

VariantClear SysFreeString SysAllocString

dxgi

CreateDXGIFactory1

d3d12

ord101

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle InternetReadFile

setupapi

SetupDiDestroyDeviceInfoList SetupDiSetClassInstallParamsW SetupDiCallClassInstaller SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader RtlUnwind

Name

.text

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

211KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.1337

Size

1024B

Virtual Size

616B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

LuminAutoTweaker.exe

IMPHASH 25f4444e0f8d2a8ae40cbacacc252543
SHA256 91bb36fb598b49b08ed115dda2cf311acad808e25c8aa1feb9642e2f2420e565
MD5 542d144d4c8df706551911eecc055f35
SHA1 8a6fea37be12b910d3a4cd03376eaafe2d933bf1
SHA512 6904f583b6dac2e89f353c93080db6ec94d385b4ccfa91d7eb03565e9d3767c27f65d8aa13f3457111002fed9792ecb3ab3438364cec10eb7d0038d00da829e6
SSDEEP 786432:l4b3mYETdcak6pobIV5OtsFTbSssc7JCZjHGeAZT2ud/nF9PQG1BLgFBPtmnXYcB:o2YSdGmoUxSssKQmdauBYG7gFBMIoPx3
TLSH
T183A88D15A3D85629D17BC234C7728662D6F0BC629324C2CF1095FA193E73BC16A36B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6041072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

RaiseException FreeLibrary SetErrorMode RaiseFailFastException GetExitCodeProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler MultiByteToWideChar GetTickCount FlushInstructionCache QueryPerformanceFrequency QueryPerformanceCounter RtlLookupFunctionEntry LocateXStateFeature RtlDeleteFunctionTable InterlockedPushEntrySList InterlockedFlushSList InitializeSListHead GetTickCount64 DuplicateHandle QueueUserAPC WaitForSingleObjectEx SetThreadPriority GetThreadPriority GetCurrentThreadId TlsAlloc GetCurrentThread GetCurrentProcessId CreateThread GetModuleHandleW WaitForMultipleObjectsEx SignalObjectAndWait RtlCaptureContext SetThreadStackGuarantee VirtualQuery WriteFile GetStdHandle GetConsoleOutputCP MapViewOfFileEx UnmapViewOfFile GetStringTypeExW InterlockedPopEntrySList ExitProcess Sleep CreateMemoryResourceNotification VirtualAlloc VirtualFree VirtualProtect SleepEx SwitchToThread SuspendThread ResumeThread InitializeContext SetXStateFeaturesMask RtlRestoreContext CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer ReadFile GetFileSize GetEnvironmentVariableW SetEnvironmentVariableW CreateEventW SetEvent ResetEvent GetThreadContext SetThreadContext GetEnabledXStateFeatures CopyContext WerRegisterRuntimeExceptionModule RtlInstallFunctionTableCallback GetSystemDefaultLCID GetUserDefaultLCID RtlUnwind HeapAlloc HeapFree GetProcessHeap HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW FormatMessageW CreateSemaphoreExW ReleaseSemaphore GetACP LCMapStringEx LocalFree VerSetConditionMask VerifyVersionInfoW QueryThreadCycleTime GetLogicalProcessorInformationEx SetThreadGroupAffinity GetThreadGroupAffinity GetProcessGroupAffinity GetCurrentProcessorNumberEx GetProcessAffinityMask QueryInformationJobObject CloseHandle GetSystemTimeAsFileTime GetModuleFileNameW CreateProcessW GetCPInfo LoadLibraryExW CreateFileW GetFileAttributesExW GetFullPathNameW LoadLibraryExA OutputDebugStringA OpenEventW ReleaseMutex ExitThread CreateMutexW HeapReAlloc CreateNamedPipeA WaitForMultipleObjects DisconnectNamedPipe CreateFileA CancelIoEx GetOverlappedResult ConnectNamedPipe FlushFileBuffers SetFilePointer MapViewOfFile GetActiveProcessorGroupCount GetSystemTime SetConsoleCtrlHandler GetLocaleInfoEx GetUserDefaultLocaleName RtlAddFunctionTable LoadLibraryW CreateDirectoryW RemoveDirectoryW CreateActCtxW ActivateActCtx FindResourceW GetWindowsDirectoryW GetFileSizeEx FindFirstFileExW FindNextFileW GetTempPathW FindClose LoadLibraryA GetCurrentDirectoryW IsWow64Process EncodePointer DecodePointer CreateFileMappingA TlsSetValue TlsGetValue GetSystemInfo GetCurrentProcess OutputDebugStringW IsDebuggerPresent LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte GetCommandLineW GetProcAddress GetModuleHandleExW SetThreadErrorMode FlushProcessWriteBuffers SetLastError DebugBreak WaitForSingleObject GetNumaHighestNodeNumber SetThreadAffinityMask SetThreadIdealProcessorEx GetThreadIdealProcessorEx VirtualAllocExNuma GetNumaProcessorNodeEx VirtualUnlock GetLargePageMinimum IsProcessInJob K32GetProcessMemoryInfo GetLogicalProcessorInformation GlobalMemoryStatusEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlVirtualUnwind IsProcessorFeaturePresent RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsFree RtlPcToFileHeader TryAcquireSRWLockExclusive GetExitCodeThread GetStringTypeW InitializeCriticalSectionEx GetLastError CreateFileMappingW

advapi32

ReportEventW AdjustTokenPrivileges RegGetValueW SetKernelObjectSecurity GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken DeregisterEventSource RegisterEventSourceW RegQueryValueExW RegOpenKeyExW RegCloseKey EventRegister SetThreadToken RevertToSelf OpenThreadToken EventWriteTransfer EventWrite LookupPrivilegeValueW

ole32

CoCreateFreeThreadedMarshaler CreateStreamOnHGlobal CoRevokeInitializeSpy CoGetContextToken CoGetObjectContext CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CLSIDFromProgID CoReleaseMarshalData CoTaskMemFree CoTaskMemAlloc CoCreateGuid CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoGetClassObject

oleaut32

CreateErrorInfo SysFreeString GetErrorInfo SetErrorInfo SysStringLen SysAllocString SysAllocStringLen SafeArrayGetDim SafeArrayGetLBound SafeArrayDestroy QueryPathOfRegTypeLi LoadTypeLibEx SafeArrayGetVartype VariantChangeType VariantChangeTypeEx VariantClear VariantInit VarCyFromDec SafeArrayAllocDescriptorEx GetRecordInfoFromTypeInfo SafeArraySetRecordInfo SafeArrayAllocData SafeArrayGetElemsize SysStringByteLen SysAllocStringByteLen SafeArrayCreateVector SafeArrayPutElement LoadRegTypeLi

user32

LoadStringW MessageBoxW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

strncat_s wcsncat_s _wcsicmp wcsnlen wcscat_s towupper iswascii _strdup strncpy strnlen wcstok_s isdigit isupper isalpha towlower _wcsdup iswspace isspace islower strtok_s strcmp strcspn __strncnt _wcsnicmp strlen wcscpy_s toupper wcsncpy_s strcpy_s strcat_s strncpy_s _strnicmp tolower wcsncmp iswupper strncmp _stricmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf fflush __acrt_iob_func __stdio_common_vfprintf __stdio_common_vswprintf __stdio_common_vfwprintf fputws fputwc _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc fgetpos fgets fgetc fputc _wfsopen _wfopen __p__commode _set_fmode __stdio_common_vsnprintf_s setvbuf _setmode _dup _fileno ftell fseek fputs __stdio_common_vsnwprintf_s __stdio_common_vsprintf_s fwrite _flushall fopen fclose

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _register_onexit_function _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e _exit _invoke_watson __p___argc __p___wargv _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _beginthreadex terminate _controlfp_s _wcserror_s _invalid_parameter_noinfo _errno exit abort

api-ms-win-crt-convert-l1-1-0

_atoi64 _ltow_s _wtoi strtoul _wcstoui64 atol _itow_s strtoull wcstoul

api-ms-win-crt-heap-l1-1-0

free _set_new_mode calloc malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

asinhf atanhf cbrtf acoshf cosh cbrt coshf exp expf acosh atanh floor floorf fma fmaf cosf _fdopen cos ceilf _copysignf _isnanf trunc truncf ilogb ilogbf tanhf ceil fmod fmodf atanf frexp atan2f atan2 log log10 log10f atan asinf log2 log2f logf pow powf sin sinf asin sinh sinhf sqrt sqrtf tan tanf tanh acosf _copysign asinh _isnan _finite modf modff _dclass _ldclass acos __setusermatherr

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_unlock_locales setlocale __pctype_func ___lc_locale_name_func _lock_locales ___lc_codepage_func ___mb_cur_max_func _configthreadlocale localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrename _unlock_file _wremove _lock_file

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

221B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dependencies/App/A9C3L8D6T2V5X1J7

SHA256 befb7f4d222498218c026f5c8e428d9a9293884437bd7a78be1d5bbfb4f377d2
MD5 ff471af85d320d06e8976d73291579f1
SHA1 b49dfcce2b98f5e57d59507a6d68e1611d43b624
SHA512 53e3c7dc51a2b423567ca5d50e34d1882039f1c558e858f2b0b87ceaae8e8845e4409ecbd317430f31d8ed13a2f953bacad1874972c34432e4b0d634cec761e7
TLSH
T13731B8A4E816CF25FD58DC7104A673041AC287E89E52AA1B1580F7362D3ABC16913EDF
MD5 SHA1 SHA512 TLSH

Lumin.nip

SHA256 26458fcd1f59ad8a2b0cabe741eff230c27648ef0ec61c809404d65c02430165
MD5 4337019d89fcb829ede9cd87996da4be
SHA1 533f9ac3c2ed62811d958b246c36b09fdf322e98
SHA512 e1fafcad111cad987b5f15947c12a8433db42b0a9c583c5d4a38c894167bbe832791173bbe5eda81beddc02af3fd9d51fbbfacc826908b04efd06c117c913d5b
SSDEEP 96:PKIRZHo7HMHUHrHAH6H+H1HYHSHiH6YTHZY82wHZYcH8THSHgHuH1HBaHIsHCH52:iIO2DQ2HRIfyQee21Itq
TLSH
T1DA92C06D25C56A0FA2385DD6F66A9339DF28612704534070B89E760F2F379EA03E7E06
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/App/H7T4Y2B9J6X3P1D8

SHA256 b55afb9ea1de00d2b69932e220e67d7c44ac75b29b887ed55e5ca1fc9de1e20a
MD5 942b29bd805b6c35667ded4b2d6b1cd6
SHA1 e7e36e31f1ff7d4d59211e73c1b9df38a9820e17
SHA512 5f1d6719415146638f172cad16ab527f1a82ea7d8545ec1b366aa2edc6eac4f46771b7569443a49e0a84b8b5dbe3ee514ebe1e7aad8d55de94763c6ae257c36e
TLSH
T1564119B2F1713695CAEB443460828D9CF14F8A7314C29AC2EAB4560C2D6E542D99008E
MD5 SHA1 SHA512 TLSH

Scalability.ini

SHA256 c23f3ff3be71c0a8b8195a1c894c4ea50d441a19f731d741626f0b6b12ea8539
MD5 bbdd35fc5ab4abd301c82edc06034828
SHA1 2360890ac00c851350e21c7378128976b490a1a3
SHA512 c3d2ca5139c5cf486a7a36bed177457f93389443de2c68f8a2cffe6f0b8046bf39849aa24d54b4d8e90b670b6f80df48c589b4219ad0aafd0174de25d28e8fa8
SSDEEP 96:3SjXGujaMmL1JREVJkJqJ0JBJF5NdvLZrsOk4Z6++XC6NAppkB2L98:3SjXGujaHL1JR6WYWzX5NdvN9kS4DNHz
TLSH
T1DC91B71A86302503AFCF423DB565179E4E3D5D97443F29A4C436824DF5CE08F9A8CB19
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/App/K8H3Z6N1D5M9Q2W7

SHA256 e3d9f55f72255f986c286ca57deca3eeef6c7c7b1ad603a55cdc4b55270c14d0
MD5 b208dbc1f29b5ad95861c5c0582fcca0
SHA1 e2587d196c665f066507cf81f4f14135f03ff79f
SHA512 099835acc57498a9e06ac948d8eeb114b863ab11f658c9b09edadf86ededd88166eee50a9d619120ff61ddc863d1d1c0ab1ab486542fbf51b7424ad7e1e087ba
TLSH
T140617C7C623294C9DA9E86FCE406ED0A92950978C056D2EB2BC68FC750522A07961B0F
MD5 SHA1 SHA512 TLSH

GameUserSettings.ini

SHA256 cf21092671adeb1aa23bd9739a5f466d730e91161a5a260931de6afcebf3ae26
MD5 59e606e93f62ba0705be3f4714ebd110
SHA1 87c499176273a22b7afe460cde1e6e2818ab3a4d
SHA512 8404ded99607840d15cc576b65f0d40a45e61c6d5850ab3332cf9b854637240eaa7494b29880bee5887c112521d109f4d6b1fb60b58de999b5e4b31619f1fa13
SSDEEP 192:hfqig7bARtYZ1LK0vx0+iRk5piMx3Ffuiymu5wN011N+Sauiv1x45g7/EVkk:RIPARtYZ1l50+G7KFOauiv1x45g7/Eh
TLSH
T16BF184E42C201092D92791BBBCA7F01314F173AE51DF5408BBC6A71B784DB88A5CBA3D
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/App/M5W2Z9Q1F8R6N3K4

SHA256 be48cb265f14218e1a458887d1e6d7885256941ab6a8ea00ee83509cc4790a4f
MD5 a70114ade864636054026852110a7aea
SHA1 1c776053433f19618a4beb104503a45bd028c6a2
SHA512 a51a17845b01314cdfdcbaab1f74a5c846d30adc6caf2c89aa8ce974c10c8d1aa547427c63a5b2c44881423a90b940cfcc136ad9b616d40bf250b8676c14cc4d
TLSH
T1E5411AB28C2413FDFE4405FA09485ABD5B6ED4A523F2DF6188F474881F4DE625E1E250
MD5 SHA1 SHA512 TLSH

Engine.ini

SHA256 9cd816663df4da08ee3f536e0309ac8dca55bbcf7ab0a68bc059bb35cfc20e05
MD5 cd018d59c42578822bcbf2c448409f5a
SHA1 a3ae45e028431fbba2ee3c083203bd971ee9b05c
SHA512 75163f8be4bfd0d45f73e47b7e6ab93edb9e531a2cb33915be7d3d0702d7881abc4f6dadd6776da52e43b8f56c24f9d2bc88ac212669ecdf9590c0db050cc30a
SSDEEP 96:x+XceOsfJkJqJ0JBJX5bJhSMpjwpo8FOqVJOc/TYBoal1Le:x4fOMWYWzZ5bJhSMp8DFOuJOc/TYBoZ
TLSH
T1A8B184155A653544AF86523EA872679E0F3C2823007F64F8F83E928DF7DA04F964C728
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/App/P1X9L6C3J8R2V7T4

SHA256 5d32f7d2a7af94c6c9bbf9f6d3c97aeae2eeb2dd2758fc2eaf88429bbf8c8583
MD5 083f3fda2687f479a3ec8c052d627bb6
SHA1 d6142a3cb00295211835e2e06d237bc55dda3ea9
SHA512 5049b9d8d0c9cfa08c8bb711987350c1fb097158df6d0288a1d899bed60d81a52cf7baf105992a9941343d1119ce0f60aa7047a9f625e148552800f414133ddc
SSDEEP 384:Qd6AZc4YSyQDBLOvwH2JnqgWhe93UP7vt+RB1OXmO+KjbJoY+PeGrB1ApDfrdrFa:Qd60dziI2VqgbUP7vsR/O2OzBx+PeGrD
TLSH
T18C92E11BF01D7AD5FBEAC431C303F580279999B8640DD16A03B9528E1D2A615F97C673
MD5 SHA1 SHA512 SSDEEP TLSH

Engine.ini

SHA256 7f3bc61ffabf73175448ba8e3dcac35920b70798e4768cfd746bc6d4cc083e62
MD5 e9951ef80f942c9eae76390f0d5b20d3
SHA1 641af07079d2b3d2135623d25b460b31a3f8c389
SHA512 13b377867b5c35482d7f1b1fbfa74dcf965f68f5f33405ae292774d60abe69b08bcbfc8090a9cbfa2fa1bedfd1da14226e4dd626637616c1624b580ae4af5ad2
SSDEEP 768:9JMit/1w8awr6Mz61Ia+jqJK4a2KSm3CQmOpV93sFDt0kabhx:9rBnqAb2KSm3ppVZsFDt0hbr
TLSH
T17814BF3A42303851B93F93A6516E5EE1DFECFA90B2054D283ABD17AFE4C5B592C70760
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/App/R2M8Q6K3N1F5W9Z7

SHA256 0f83a851e151c397bc33f8ea13c6dc3a11fe38bc1d2f31f93d593daba183413d
MD5 3b188070de4030c6131c6607f39ef5d5
SHA1 8cbf19c7483aad69a6d505a528d00f417ffc7c61
SHA512 9e952c18eba5d492034ee9bf92d3d6bc82a7d12997c01bc0e1bb2c4d232e5ad9076f9aa935096fa9128ed61224fe3a4c67ae480872a425ae123b5e69e988ee65
TLSH
T16411B96D90385F9FCA20653AD2201A5831B916280C301B6459A54786591B1160DECAEA
MD5 SHA1 SHA512 TLSH

GameUserSettings.ini

SHA256 3730b6738927b7f8b4e444795095e045dd99ad5c1c907f82a4892c32c3c7f443
MD5 4017a71c85fec8ac774b0978754b777b
SHA1 bb72b7c7fc6d9070a1e7f2b964b89d4bf10ee039
SHA512 6fbe3438780c741715b3097d8befcc87daa7acfe9a335ec6a58a5125d98a757a54a53bf121a6afc2d5e7b9db80dc34260f0fb5d3f4e53fa0805f75f728e94a63
TLSH
T13041EDE14D310216F51751A398137A1F15F8738B51EFD49DB6CE8B57AB0DA412F4A01C
MD5 SHA1 SHA512 TLSH

dependencies/App/T6V3R1P9J8L4C2X7

SHA256 19cd9c9e375700a80764f95e161137db322da86265d02d9ed558c19ec42409f3
MD5 ec9ef0c323b537abf60529e3c3f5ba45
SHA1 f50f119af7acd04bdb03b1b0f90dc62d6682c4bf
SHA512 b3adbff805dc6f35314285ed71f43ec5b4881342e1c2ace3b302a97e41e487c86d93b48db617bca07365179130de516920d5ec3fdd2b748eb123f3f86ede410b
TLSH
T18B01442CDC7A8350F70903B2C42EEB8541E64441C804AF5593B9623B24C89543A4274A
MD5 SHA1 SHA512 TLSH

GameUserSettings.ini

SHA256 273c8393ed9cf2c2e5bd55729526ba577e91598c530b264369b53e767579b472
MD5 c6f7302684ec181a90fae3c103cfada4
SHA1 1913983312585ed451a594210a90a59a028d281e
SHA512 7f5d4e25429ee6d676b7f0dcaf49c22aa4aa514b207a796a12207b4514e7c7a5c3f07fa343db20116ae94d768cb221c2e58b0273dea72b067388b5feede3fbb0
TLSH
T18321ABF89E728407D30B56339C133B1E1CB13359A1DF24991F4B4A276E4EB95174B16D
MD5 SHA1 SHA512 TLSH

dependencies/App/Z4Y7K1Q9H8M3P6R2

SHA256 75cf40e2ee7e880c8d70b1281abde0662cca14d447628016d9c2a2f20f882b8d
MD5 e6b83c743a6c05f714b74677549a0be1
SHA1 d01f5b61d58f9bb225cf9c7018aa6b6a4bc3ea44
SHA512 113923388757539c5b8b80cdd501860b375546657bb50e14669561283884994f86224b25d0c8d8f7190739cab830fa1921a66977803e764d3566519a1b4c9926
TLSH
T16B817BF3E858E119D496253233E6106E32C016F2446C8E374A98A2DC2C39A43CA6B1AA
MD5 SHA1 SHA512 TLSH

Lumin.pow

SHA256 d33d18c2b38a91c6ed4fd8b778393167e8083866ae141b565e0dae844adfd163
MD5 5aff7842bb21677b8fc2d9e655f02845
SHA1 81aa9585ac169d193410ecdbf9a7b15fd402ff28
SHA512 9f7199f21c94c8bc031d432eecc9fa35e033100c32b865d2c0bb34b76f08e26478597aa12806c5e66a516ab120431bba0686a0548e3ad5c2e4151bc7774d488f
SSDEEP 96:uKfE5yUigtOlXWf7cowCR1koByfgmWgzC4kyAUDfpYtssMyddo3fCVaxv6:tM5yUig0lWTX1k+yf0zofpY4yLA
TLSH
T15A92B8C0F950D9C8E65A6B325D5BCFC4DA99BF26BC40067B3384370EAEF66C2A15601C
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/Bios/SCEWIN_64.exe

IMPHASH c6ad08a1589dd9cf353748c20ce378ce
SHA256 2d78e7bb62fcab44c54fe853f51e8836ada45ea374027423bcb6d7a5db46502b
MD5 d89e8173dc0b82d80add7451d4aa4622
SHA1 578358cd958756b1786f30e913e4195c0003333c
SHA512 cb5e4ebf895b5414b70caa243d032ec1d8820ff3aac155aa065a449f3a3f7ef0b01a29b006d49c69c8c1f8c11235742f0a453b120132942d32d310c7b2d3808a
SSDEEP 6144:Jk/u4+ss7CVVs7DYebnaGSEM1JLCUdDcwDfTx1ZdeuLJzVpEKz7k32lobAYBhXcP:JTjC/s7DjkDZdeuLHuEm2ybAYBc/3+s
TLSH
T11AE40956E7F351E8D8B6D03489A22236FAB178548738DBC78794860B0B72FF0993E751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Digest

a0:4f:56:4e:4f:9b:a7:68:c9:b1:53:d9:6b:ae:32:32:e5:c1:99:ae:20:01:3d:d6:fd:62:2d:be:df:b4:f3:c2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 22, 2021

SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

b9:96:37:58:ea:d2:36:c6:e1:5c:d4:8b:a5:43:3a:ae

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 21, 2020 - Sep 21, 2023

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

61:18:54:86:00:00:00:00:00:24

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 11, 2011 - Apr 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

2

Major OS version

5

Entry point

4652

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetHandleCount GetFileType GetStartupInfoW DeleteCriticalSection EncodePointer DecodePointer FlsFree SetLastError FlsSetValue FlsGetValue GetLastError GetCurrentThreadId FlsAlloc HeapSetInformation HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection OutputDebugStringA RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx SetConsoleCtrlHandler FreeLibrary InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW HeapFree HeapAlloc GetCPInfo GetACP GetOEMCP Sleep TerminateProcess GetCurrentProcess UnhandledExceptionFilter LCMapStringW MultiByteToWideChar GetStringTypeW HeapReAlloc VirtualProtect VirtualAlloc SetThreadStackGuarantee GetSystemInfo VirtualQuery RaiseException RtlPcToFileHeader HeapSize WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle WriteFile ExitProcess GetModuleHandleW GetProcAddress SetUnhandledExceptionFilter GetVersionExW LoadLibraryExW GetCommandLineA GetProcessHeap SetEndOfFile GetWindowsDirectoryA LoadLibraryA GetSystemDirectoryA CloseHandle GetFullPathNameA GetSystemFirmwareTable SetThreadExecutionState CreateMutexA SetProcessAffinityMask GetVersionExA GetCurrentDirectoryA GetModuleHandleA DeleteFileA CreateFileA DeviceIoControl CreateNamedPipeA ReadFile CreateThread LocalFree GetLocalTime DebugBreak ReadConsoleInputA SetConsoleMode GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointer CreateFileW WriteConsoleW SetStdHandle

advapi32

DeleteService ControlService OpenServiceA StartServiceA CreateServiceA CloseServiceHandle OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA OpenSCManagerA

shell32

ShellExecuteA

user32

SystemParametersInfoA BlockInput ExitWindowsEx MessageBoxA RegisterClassExA DefWindowProcA DispatchMessageA TranslateMessage GetMessageA CreateWindowExA wsprintfA

dependencies/Bios/amifldrv64.sys

IMPHASH 4fbdc03e4487f98fb59360ea5b3e640d
SHA256 e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f
MD5 e5e8ecb20bc5630414707295327d755e
SHA1 06ecf73790f0277b8e27c8138e2c9ad0fc876438
SHA512 f8949a43b5d0b08349b719daac12089fd94e824e307ae5265fd39885029a19a91d35a45dd3f3ff41cd0e3d563d4419d96221212d96b5a9a10e5ebe952dfb16aa
SSDEEP 384:xv+wvxzpsQbQS5Z5OxV0HM2DecoLiZFnJtQSZsHLPK6jzHpNMbvFRJl6p+w:xvPvxtV5lgCM8eBLgJt6PKgDpNMPO
TLSH
T11CD23B91C6789C43EEA3DD3062F8E6177E34B6822760C6DF4165D4904F92BD2AB3C369
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

70:9a:b9:53:02:bb:44:c7:a7:da:fa:f3:42:ca:93:34:22:ea:03:ed:7b:49:2b:e2:04:a3:19:16:1f:eb:35:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 11, 2020

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

c4:2f:ea:a6:c9:78:8b:71:61:b7:65:f7:25:07:02:04:f7:b5:e3:ec

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 11, 2020

SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 30, 2017 - Sep 24, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 11, 2020 - Mar 5, 2021

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:AE2C-E32B-1AFC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:16:93:22:ea:bf:bb:2d:4d:e6:00:00:00:00:01:16

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Feb 11, 2021

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

1

Major OS version

6

Entry point

24676

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb

dependencies/Bios/amigendrv64.sys

IMPHASH 07a42e80559d960b176c0fc8fd309bfe
SHA256 ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f
MD5 7b9717c608a5f5a1c816128a609e9575
SHA1 ec457a53ea03287cbbd1edcd5f27835a518ef144
SHA512 4138ca89d0d74799ff10e512c247ea626846d107f0e054aef403adafeb7c7708415cb9e4ce7dbf0d168e98101f9faf5d5d3567ca7fc64406f72b1bd7a751664c
SSDEEP 384:79TBPBgGLd6veRHilu/XWncQ528rQjX+kl811pZFnJtQSZsHLPK6jzE9bvFRrqP8:pFsvSClu/mRH8lklJt6PKg49Puti
TLSH
T159F24C9197B44886FDA79E3062E4D2277E75F7923A30C7DF0160D0641FA3BC2A63835A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

51:67:b3:3a:95:b4:db:0a:12:44:cb:3b:95:d4:02:45:87:d9:a5:a9:52:22:ba:bb:03:32:10:e6:b1:11:d2:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 23, 2020

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

60:55:db:c4:53:c1:11:e5:7c:85:ec:8c:fa:d9:e6:e1:14:21:c8:d4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 22, 2020

SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=J912954,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0e:55:cd:b4:e7:e8:ee:b9:dd:5d:89:fc:1d:75:88:ca

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 30, 2017 - Sep 24, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 11, 2020 - Mar 5, 2021

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:01:0a:52:c8:39:01:52:d1:70:4b:00:00:00:00:01:0a

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2019 - Jan 21, 2021

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

0

Major OS version

10

Entry point

36864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\AMIBIOS\Utility\AmiFlashDriver\AmiFlashDriverSrc\sys\x64\Release\amifldrv64.pdb

Name

.text

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

508B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

512B

Virtual Size

328B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dependencies/Nvidia/Reference.xml

SHA256 512ce2c34d28514730e90369f2e08e9de49d24944c610a5336a7b69c1a2fe35e
MD5 48a4e5b434edbd8a466658695edb6b21
SHA1 5b6d1e1f09f09e7fa838ec7851ab9d10c09712c7
SHA512 e5f5c11629aa569255bf5d1871efa2ead54f6fd69fc6d00118dfb7801d20dd80d8b74d3cd0a216c0062de5d2319219122c5f131683a10002d57e2be66b4b9467
SSDEEP 768:CD3LbbGIdNbClHn/cfNwIzM0AAOzFkFK1mCZ/Qz8USt3H12OIDonOWjNT:CH2kmlHn/chZA1QA/QwUk12OZnO4d
TLSH
T12444724D70FC69A9AB0444E3F53F222996AFEE590785122DA93D26737092CDD22D0D3F
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/Nvidia/nvidiaProfileInspector.exe.config

SHA256 9d1ac1797bdefd5c040ed737a213d55c492276b00cb78201a2183c0a2c868749
MD5 b987c34a41f202a7453e3c8971e40556
SHA1 4648a12c459450d11d54cc99abfbe0f5b3647813
SHA512 a8140a1bfc10eab4caa1cec13ecbbc6ed2fc9357609a2fc62c8e1ee1e59bfce01805d8182b52c738937902943f62bed2d3ab0231593671b42287466225ad6027
TLSH
T1C3C08C9940247C278C124F1392A081664BF43262A424100CE0ABAE64066004E824A3A6
MD5 SHA1 SHA512 TLSH

logo.ico

SHA256 bae3e9db7ba83ec1ced43b463219ce99e713e3c0a007eb65016d923d4a78e2ec
MD5 40f018372afe2cad692a07492e385580
SHA1 0090537eaa1f02847f3509ef9fa96ae6167446e3
SHA512 6225de488724aacf67beba22e9a1d5884830143353c4af12dd959c317471d1af9a0a1d035d42d4a3c5ab4ae1eaa6f427df8c53861d05538616ab5ef03adde398
SSDEEP 768:E7lVFwmLWL0HRTojDFKx//8r6sQFIVn9oM2xknOSMqU:E7RdLWLCCy/8Gry+MaZSMj
TLSH
T146143672A3645AD6D3D71578C12EBB2A42360EFA59C7D1C8B0943C6A2EF47C7CB04B61
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer