CheatEvolution.zip
- SHA256 f220fbaada39d3e2889d5a93cfe1fc855cc3962b32d809b31ae4ee4a1a2b1b04
Overview
overview
8Static
static
3CheatEvolution.zip
windows10-2004-x64
7CheatEvolu...on.exe
windows10-2004-x64
8CheatEvolu...32.exe
windows10-2004-x64
3CheatEvolu...64.exe
windows10-2004-x64
1CheatEvolu...er.exe
windows10-2004-x64
8CheatEvolu...ta.dll
windows10-2004-x64
1CheatEvolu...ct.lua
windows10-2004-x64
3CheatEvolu...ace.js
windows10-2004-x64
3CheatEvolu...gs.lua
windows10-2004-x64
3CheatEvolu...ce.dll
windows10-2004-x64
1CheatEvolu...32.dll
windows10-2004-x64
5CheatEvolu...64.dll
windows10-2004-x64
5CheatEvolu...nfo.js
windows10-2004-x64
3CheatEvolu...ch.bat
windows10-2004-x64
1CheatEvolu...pt.bat
windows10-2004-x64
1CheatEvolu...32.dll
windows10-2004-x64
3CheatEvolu...64.dll
windows10-2004-x64
1CheatEvolu...gs.lua
windows10-2004-x64
3CheatEvolu...86.dll
windows10-2004-x64
3CheatEvolu...64.dll
windows10-2004-x64
1CheatEvolu...86.dll
windows10-2004-x64
3CheatEvolu...64.dll
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
CheatEvolution.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral2
Sample
CheatEvolution/CheatEvolution.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral3
Sample
CheatEvolution/DotNetDataCollector32.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
CheatEvolution/DotNetDataCollector64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral5
Sample
CheatEvolution/Launcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral6
Sample
CheatEvolution/data/data.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
CheatEvolution/lua/DotNetInject.lua
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral8
Sample
CheatEvolution/lua/DotNetInterface.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral9
Sample
CheatEvolution/lua/additional_settings.lua
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral10
Sample
CheatEvolution/lua/dlls/DotNetInterface.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
CheatEvolution/lua/dlls/MonoDataCollector32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral12
Sample
CheatEvolution/lua/dlls/MonoDataCollector64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral13
Sample
CheatEvolution/lua/dotnetinfo.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral14
Sample
CheatEvolution/lua/dotnetsearch.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
CheatEvolution/lua/monoscript.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
CheatEvolution/lua53-32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral17
Sample
CheatEvolution/lua53-64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
CheatEvolution/settings.lua
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral19
Sample
CheatEvolution/speedhack-i386.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral20
Sample
CheatEvolution/speedhack-x86_64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
CheatEvolution/vehdebug-i386.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral22
Sample
CheatEvolution/vehdebug-x86_64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
General
- Target CheatEvolution.zip
- Size 13.0MB
- Sample260620-txzy1ahs5t
- SHA256 f220fbaada39d3e2889d5a93cfe1fc855cc3962b32d809b31ae4ee4a1a2b1b04
- MD5 fef659b9066539816b5856682966cc13
- SHA1 a8d0338b657cc981102ca81e629dfe31b601c205
- SHA512 7660fdeaf140ce8bc60028cbc143c4c0a5110a9f5d88f66bf23f5777021ae19c033e66d8be6e15055dc07bf52085ca150174add409481e4cca5b943c022e2e6c
- SSDEEP 196608:aUnKJA2Yj88dz9ub25R9pjHjLDsMpj5pLApi9QFr/qW9ZD8qanmd5zI7qo0uWOd/:aMOYwAzq6RjDpLAmK8Jnmrgl3BqdPS
- TLSH T125D633BB34A3C2E08E63C7621E1BE9D65689018504464FE7D6A705A93C0FFC63978D7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 2 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/CheatEvolution/CheatEvolution.exe unpack001/CheatEvolution/Launcher.exe - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/CheatEvolution/data/data.dll unpack001/CheatEvolution/lua/dlls/DotNetInterface.dll unpack001/CheatEvolution/vehdebug-i386.dll unpack001/CheatEvolution/vehdebug-x86_64.dll
File Explorer
-
CheatEvolution.zip.zip 13.0MB
-
CheatEvolution/CheatEvolution.exe.exe 11.1MB
-
CheatEvolution/DotNetDataCollector32.exe.exe 161KB
-
CheatEvolution/DotNetDataCollector64.exe.exe 186KB
-
CheatEvolution/Launcher.exe.exe 1.4MB
-
CheatEvolution/data/data.dll.dll 1.3MB
-
CheatEvolution/lua/DotNetInject.lua6KB
-
CheatEvolution/lua/DotNetInterface.lua.js 5KB
-
CheatEvolution/lua/additional_settings.lua426B
-
CheatEvolution/lua/dlls/DotNetInterface.dll.dll 8KB
-
CheatEvolution/lua/dlls/MonoDataCollector32.dll.dll 378KB
-
CheatEvolution/lua/dlls/MonoDataCollector64.dll.dll 505KB
-
CheatEvolution/lua/dotnetinfo.lua.js 53KB
-
CheatEvolution/lua/dotnetsearch.lua.bat 11KB
-
CheatEvolution/lua/monoscript.lua.bat 104KB
-
CheatEvolution/lua53-32.dll.dll 439KB
-
CheatEvolution/lua53-64.dll.dll 515KB
-
CheatEvolution/settings.lua10KB
-
CheatEvolution/speedhack-i386.dll.dll 189KB
-
CheatEvolution/speedhack-x86_64.dll.dll 245KB
-
CheatEvolution/vehdebug-i386.dll.dll 293KB
-
CheatEvolution/vehdebug-x86_64.dll.dll 381KB
CheatEvolution/CheatEvolution.exe
- IMPHASH c652a46e8161c3830a0f71c9a9360bac
- SHA256 5d5162db542340f73b7451c2d9138ec714da25483b05344392111c8b0316dbfc
- MD5 e385bf6abe0ddfadfb7e098da559a882
- SHA1 3681f2ec7bbfe2e2d6edab73ea3b108d0d45999d
- SHA512 1f439e28270b49f6c7421bec6dc0f70d14df8d41e43e54a79c037a626df6645b0a6d500c1598c1678cac0e44c0934ab67b02191895f87aed1f8f1cf5c5d0946d
- SSDEEP 196608:6Gn6Hg2U/VbIRN92THpdNV3nTgv9j8p6DQLpx6yfrrUXQLA2iYhPOuw7mV:6WUU/VsRIHQ9j8M6UALA2iwP07m
- TLSH T16EC62229B14C33ACC72A857078E7EC06ED61321E08F4959A7ECB3784779A50389FB756
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
10:71:2d:df:2b:b2:3a:39:2c:07:2c:c6:6d:b5:68:51:3a:62:ad:5d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=ZamTalk Communication Ltd.,O=ZamTalk Communication Ltd.,ST=London,C=GB
Chains
Mar 19, 2022
CN=ZamTalk Communication Ltd.,O=ZamTalk Communication Ltd.,ST=London,C=GB
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=ZamTalk Communication Ltd.,O=ZamTalk Communication Ltd.,ST=London,C=GB
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=ZamTalk Communication Ltd.,O=ZamTalk Communication Ltd.,ST=London,C=GB
Serial Number
d5:8d:e7:9d:20:27:21:a5:b3:9c:21:f2:a5:c5:78:1b
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 6, 2021 - Aug 6, 2022
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 23, 2020 - Jan 22, 2032
Minor OS version
2
Major OS version
5
Entry point
22327044
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
oleaut32
SysAllocStringLen
user32
MessageBoxA
CharUpperBuffW
advapi32
LookupAccountSidA
gdi32
CreateFontIndirectA
version
GetFileVersionInfoSizeA
shell32
DragQueryFileA
opengl32
wglUseFontBitmapsA
ole32
CoCreateGuid
comctl32
InitCommonControls
shlwapi
AssocQueryStringW
comdlg32
ChooseColorA
imm32
ImmGetContext
ntdll
ZwCreateSection
ws2_32
__WSAFDIsSet
wsock32
closesocket
imagehlp
StackWalk64
psapi
GetMappedFileNameA
lua53-64
lua_close
winmm
sndPlaySoundA
wininet
InternetOpenA
Name
.text
Size
Virtual Size
7.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
984KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
Virtual Size
5.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
Virtual Size
436KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.8+"
Size
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
./]W
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.A|.
Size
11.0MB
Virtual Size
11.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
CheatEvolution/DotNetDataCollector32.exe
- IMPHASH 527cfa642ac8a84a0b0628cb5f479c9c
- SHA256 12dfdbec903ce46e0132f239ba4c8e8665b2020ca4aa781dc96a7cd98ed60cf4
- MD5 5ae652ca00afa7378b0fcc6f1a85c137
- SHA1 8720955f40a852e9b5b64fda6ad5b0447c363248
- SHA512 f3858b9c8718c5379b087cfdec37659740d288ed86dc172f592a3e6008bf03907135bcb4ef9449480795893a9d35d87381caf6b5497dc2bead1e8bbc09eae4e7
- SSDEEP 3072:BFdofg4yfkMJ9ftaJMgMhAVhGmmyGrv1RMqIMqsGLOQKs60DYTMgeIe7eT0Z:ndox2VgLCnys1wMZGqdeNZ
- TLSH T19CF39C2179C1C833E563083424F4E6BA197DF9311FA89DDFA7854779AE307D19328A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fd:9d:59:96:ce:68:4a:4f:80:c1:59:cb:f4:40:f9:4f:0e:4b:17:34:f2:08:00:b9:2c:5b:55:23:9a:93:57:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2020
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Digest
75:69:bd:af:01:b1:f8:ba:f7:1f:09:e7:58:4d:d5:5d:fe:39:57:a8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2020
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
69:36:cd:67:6b:6c:40:a3:d5:54:1f:17
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2020 - Jul 4, 2022
Subject
CN=GlobalSign TSA for Advanced - G2
Serial Number
0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2018 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 2, 2011 - Mar 29, 2029
Minor OS version
0
Major OS version
6
Entry point
21460
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\git\cheat-engine\Cheat Engine\bin\DotNetDataCollector32.pdb
shlwapi
StrCpyW
StrCmpW
StrCatW
kernel32
ReadFile
EnterCriticalSection
WriteFile
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
OpenProcess
GetLastError
GetCurrentProcessId
LoadLibraryW
Wow64GetThreadContext
GetThreadContext
ReadProcessMemory
OpenThread
FindFirstFileW
lstrlenW
CreateNamedPipeW
FindClose
GetModuleHandleA
CreateToolhelp32Snapshot
OutputDebugStringW
LoadLibraryA
Module32FirstW
GetProcAddress
Module32NextW
ConnectNamedPipe
HeapReAlloc
HeapSize
SetFilePointerEx
GetFileSizeEx
CreateFileW
WriteConsoleW
FindNextFileW
GetConsoleMode
GetConsoleCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
DecodePointer
SetLastError
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
LCMapStringW
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
user32
PeekMessageW
MessageBoxA
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
ole32
CoInitialize
Name
.text
Size
107KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26213,
count=147, id=261, version=26213,
count=18, id=260, version=26213,
count=39, id=261, version=26706,
count=17, id=260, version=26706,
count=17, id=259, version=26706,
count=1, id=242, version=40116,
count=11, id=257, version=26213,
count=105, id=1, productName=Unmarked objects,
count=6, id=265, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
CheatEvolution/DotNetDataCollector64.exe
- IMPHASH 251b2a02e42c648284cca0f3e0076947
- SHA256 3a138fda1ec86d8795114d192613414ecc3a1702674c67da3b14ab970acfc211
- MD5 6e4d5643ba06864ca5f9c0598cfa8c41
- SHA1 32a47b05c6f2cf0403a118f130fa62700a6dc97e
- SHA512 c45b7f06256bc2631e9917d636b2de3521f3e817d6fe6fa4ac3bc86fb5ccef408fd0a1a4a376bd80d2ba4fbbaef226d3877555ffb89760e61649f830ba6c49ad
- SSDEEP 3072:PZ9I3HumDI7uSG009IOEMfv+K5SAgH+9gr0zKArFoeeeWA0i:PZ9qBMuSRKDEMX+qC2wti
- TLSH T115149D4A73A510F9E22BC53DCD459556E7B3B4420BA49A9F036403BADF633E09F39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5e:8b:5f:fb:43:4a:c7:5d:4b:07:dd:b8:53:89:22:17:40:5e:97:01:00:8f:c2:07:ce:45:2f:fd:0f:e1:e4:73
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2020
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Digest
c7:ae:d3:bf:47:86:bf:e1:8e:4f:c7:e9:5c:8d:cc:3f:84:92:eb:c6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2020
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
69:36:cd:67:6b:6c:40:a3:d5:54:1f:17
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2020 - Jul 4, 2022
Subject
CN=GlobalSign TSA for Advanced - G2
Serial Number
0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2018 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 2, 2011 - Mar 29, 2029
Minor OS version
0
Major OS version
6
Entry point
22268
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\git\cheat-engine\Cheat Engine\bin\DotNetDataCollector64.pdb
shlwapi
StrCpyW
StrCmpW
StrCatW
kernel32
ReadFile
EnterCriticalSection
WriteFile
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
OpenProcess
GetLastError
GetCurrentProcessId
LoadLibraryW
Wow64GetThreadContext
GetThreadContext
ReadProcessMemory
OpenThread
FindFirstFileW
lstrlenW
CreateNamedPipeW
FindClose
GetModuleHandleA
CreateToolhelp32Snapshot
OutputDebugStringW
LoadLibraryA
Module32FirstW
GetProcAddress
Module32NextW
ConnectNamedPipe
HeapReAlloc
HeapSize
SetFilePointerEx
GetFileSizeEx
CreateFileW
WriteConsoleW
FindNextFileW
RtlPcToFileHeader
GetConsoleMode
GetConsoleCP
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RaiseException
SetLastError
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
LCMapStringW
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
user32
PeekMessageW
MessageBoxA
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
ole32
CoInitialize
Name
.text
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=26213,
count=5, id=259, version=26213,
count=144, id=261, version=26213,
count=41, id=261, version=26706,
count=16, id=260, version=26706,
count=8, id=259, version=26706,
count=1, id=242, version=40116,
count=11, id=257, version=26213,
count=109, id=1, productName=Unmarked objects,
count=6, id=265, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
CheatEvolution/Launcher.exe
- IMPHASH 6e79880c0d2e6bada94587f3722756d6
- SHA256 8dc6883eb66ca05dbf5cc6c0f98178abf34b848a1c748dba8a8ca4e97c64df87
- MD5 d26ebf669c6736fa7b300b34ec6bf2d2
- SHA1 b5232029e3dee01a9b4c935d341cb0b952473500
- SHA512 0f58f1b9c93453002720aaec4aca545d85bc4871cd165f0c07df42904c6ea242aa51846a82edbe3d11e1b6c78379b805f05100787abfcc1b687e2290f0df2452
- SSDEEP 12288:ridXiXyXGDjDeewZgDxbMAMnHxPN2cSosXWApDp0L9MIl4JS:OXiX6G/DrwZgpMbdN2o+pDp03wS
- TLSH T1CC652E14A6788931C3F45774B0EF0AA0DE28601D4FC7675B19E6D4E8FC4932B1AF668B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
fd:40:82:8a:41:3e:7b:09:3c:75:de:0c:8d:db:99:db:23:d9:90:73
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=ZamTalk Communication Ltd.,O=ZamTalk Communication Ltd.,ST=London,C=GB
Chains
Jan 5, 2022
CN=ZamTalk Communication Ltd.,O=ZamTalk Communication Ltd.,ST=London,C=GB
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=ZamTalk Communication Ltd.,O=ZamTalk Communication Ltd.,ST=London,C=GB
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=ZamTalk Communication Ltd.,O=ZamTalk Communication Ltd.,ST=London,C=GB
Serial Number
d5:8d:e7:9d:20:27:21:a5:b3:9c:21:f2:a5:c5:78:1b
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 6, 2021 - Aug 6, 2022
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 23, 2020 - Jan 22, 2032
Minor OS version
0
Major OS version
5
Entry point
115652
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
user32
MessageBoxA
CharNextW
LoadStringW
MessageBoxW
LoadStringW
GetSystemMetrics
CharUpperBuffW
CharUpperW
kernel32
Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
SwitchToThread
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
SetCurrentDirectoryW
GetCurrentDirectoryW
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
TerminateProcess
SetLastError
SetEvent
ResetEvent
RemoveDirectoryW
OpenProcess
MoveFileW
IsValidLocale
GetVersionExW
GetThreadLocale
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFileAttributesW
GetDiskFreeSpaceW
GetCPInfo
FreeLibrary
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumSystemLocalesW
EnumCalendarInfoW
DeleteFileW
CreateFileW
CreateEventW
CreateDirectoryW
CompareStringW
CloseHandle
Sleep
shell32
ShellExecuteW
Name
.text
Size
106KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
19KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
340B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
12B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
111KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.debug
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
CheatEvolution/data/data.dll
- IMPHASH 6cc72dfd29b7bcfb61ec75e3082dfc41
- SHA256 60c16c2fab14b344b8343778dcd6bbfdee3dfe5f83d1ac8d2e50c6877419eee4
- MD5 c11138204609ea63a3e88b4c8c09b035
- SHA1 b0829124f7e275b0f341c6af0fdd3dd5f65667a4
- SHA512 28d9e92498433c1f6ec41893fc17db76d6cb7a1c565461eb6e67eebc2b924dd4aa65486c29874caa9ac5c78f804a8799c7ce1c641dd9f080bf1bf94b58ca208c
- SSDEEP 12288:aHnKY5WcmiyfogSknJbjhrbXBbrxaLsBDJbVQAjXwcasznMbDz43X6dmM:aqY5Wcmi4FJbXdsLsBNRQAjgH
- TLSH T1A2557D47B3B941B8D4AB927DCA534B4BE7B175451320ABDF469887A52F03FE21A7E300
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
936256
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\MinGW\msys\1.0\home\drh\sqlite\sqlite\sqlite3.pdb
kernel32
GetVersionExA
OutputDebugStringA
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingW
CreateFileMappingA
LoadLibraryA
GetDiskFreeSpaceW
LockFileEx
HeapSize
GetProcAddress
GetLastError
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
CreateFileW
ReadFile
GetFileAttributesW
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
GetVersionExW
FormatMessageW
Sleep
LoadLibraryW
WideCharToMultiByte
WriteFile
FormatMessageA
GetSystemTimeAsFileTime
GetProcessHeap
UnlockFileEx
GetTickCount
OutputDebugStringW
WaitForSingleObjectEx
LockFile
UnlockFile
WaitForSingleObject
HeapFree
QueryPerformanceCounter
SystemTimeToFileTime
HeapAlloc
FreeLibrary
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
DeleteFileA
AreFileApisANSI
GetSystemTime
LocalFree
GetTempPathA
GetCurrentProcessId
DeleteFileW
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
GetCommandLineA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetModuleHandleW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
GetTimeZoneInformation
SetLastError
GetCurrentThread
RtlUnwindEx
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetModuleFileNameA
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
FatalAppExitA
SetConsoleCtrlHandler
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetTimeFormatEx
GetDateFormatEx
CompareStringEx
GetLocaleInfoEx
GetUserDefaultLocaleName
LCMapStringEx
IsValidLocaleName
EnumSystemLocalesEx
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetEnvironmentVariableA
SetStdHandle
SetFilePointerEx
WriteConsoleW
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strnicmp
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_write_debug
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=126, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=30, id=207, version=50628,
count=110, id=206, version=50628,
count=9, id=205, version=50628,
count=1, id=206, productName=VS2012 build 50727, version=50727,
count=1, id=202, productName=VS2012 build 50727, version=50727,
count=1, id=201, productName=VS2012 build 50727, version=50727,
count=1, id=204, productName=VS2012 build 50727, version=50727,
CheatEvolution/lua/DotNetInject.lua
- SHA256 a3c0a76e8654384dc6896fc73664fdf7f2ed94e95433f34f9668e3e04cb7354e
- MD5 6fecbdcaac54e6f9cf6b5ff07e0d47c5
- SHA1 bb22202c3ecd421ae843822ec4715a72c9891f6c
- SHA512 baea3a88281decad200641df2df5903ee326d59df54349629ac3ed75154322dafe61f8cbebdc21af2f5ac4c639a557ef34cd8a236562779c2b10d3f8b9da96a5
- SSDEEP 192:zuiTTPEYya1gq5jfFEYQt3xB97Yq1fvhEh:ztTzyapAy
- TLSH T11BE1BB023FC3B5DD1E50E3DF4C28E0C6F380E943AE36991475D8877B2AA84695A6D72D
- MD5 SHA1 SHA512 SSDEEP TLSH
CheatEvolution/lua/DotNetInterface.lua
- SHA256 dfed591417fdf76524e127bfdb022fa6a32394e3a42303f896b39d441bfa6f8e
- MD5 602ea720e7ce9376d736bc348f3988d2
- SHA1 483699d71387b874b7e21eb0a5b3a237e10f5e82
- SHA512 e72bcb9483eb7b503a5a273efac6891b51e6a379920957a831b26d15e06868b65d4abaed0674c0c004d0a42005d91f2b16924765f60a3dc1ec5e505644a7c8f1
- SSDEEP 96:c/miSCXPgMTbTgvp0gh3g60goqZrLLKqQhq0qhRPyvdFO41+/gSrlaYfsm7:4miffgMzgKgh3g60goArLLKqQE0qn6v6
- TLSH T1A8B1DD5C5A9A20C326FEC375AB475890E2631042233717D5BF584CA2FB24A7CB5DDBD4
- MD5 SHA1 SHA512 SSDEEP TLSH
CheatEvolution/lua/additional_settings.lua
- SHA256 a0343d322f042622040d129c7b5d9f9b4cd10e0ee3b249f280b9da7c1f7c0222
- MD5 1f73e4d6e1a5c6eb97b31813ec21d0db
- SHA1 2b7be02d9a14c3141dcc1a147928cc617e198ebc
- SHA512 570f8228f08cda9514d548ef2b6602be677cf03886c2c33cb46e2bde1c74ead077dd6282742bf8bbfaa2b9ef51dec931270e268b4d2520ba273c1a1778da8871
- TLSH T166E02B90368391A51BF0D379CC8B7403F245A78301AE0028799E06917FB07DCA2F4E51
- MD5 SHA1 SHA512 TLSH
CheatEvolution/lua/dlls/DotNetInterface.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4eafac874d7a3e9d1ff72e1810d9b1828f0a99a429290d739246786fa7939e66
- MD5 5b12656d94b4bbb14c7c59d2c34c3c0b
- SHA1 b6ccc3bbd82456b83ee01c0b4f44b847b401f494
- SHA512 77c9fd0aa9f6f2e4a3109e85f6b2062e5fbd4ec8942dbcd62907742273c1dce691d0de1992d3e41d2ed54e38b3d98fee10af8b7b3d84220d88da4b1225c644a4
- SSDEEP 192:41OcJck67k4zua8M6hahFz/V49eTVTcl:gOcJck6747FhaV49ehTcl
- TLSH T18E02FA09EB948717E0AE097894F203110774F329B483DB5F0DC555A35C677A81FA2BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\git\cheat-engine\Cheat Engine\DotNetInvasiveDataCollector\DotNetInvasiveDataCollector\obj\Release\DotNetInterface.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CheatEvolution/lua/dlls/MonoDataCollector32.dll
- IMPHASH e7887ec2f66f5872997a7a195437342d
- SHA256 484d2d7eeb49a538162467819b4262aeea1eb45dfea92796520f93e421ecf20d
- MD5 36a5efb2e73e652216c58d7cf8402748
- SHA1 e40926beccd687add6e89c9cb45fef7e73f37ecd
- SHA512 2af5595b489428b5c5403cf2d9bd0845d877cc166b87f1640d729224e740f11141b2606332ffc2ac12d6da8bb5ed7d5636fc5683f5cdafbc8cdb19676ae00e46
- SSDEEP 6144:e0eMHxadZltCtCbvvO4WsD0gWZATaxLqvqzplT4rtwAOag494uZlo69YIT:e4xadXtCEbvvO4WsxsATasvUqrtwwg4l
- TLSH T1D6848D1235C2C073E4AF01307864E7555AAEA9314FB9CCEBE7DC262E4E746C25B35A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7a:af:3c:22:be:6d:92:aa:91:16:75:1f:85:50:4a:7c:83:b6:37:a2:ae:a9:7f:ae:9d:93:d6:92:46:d5:b0:6c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2020
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Digest
2e:ba:a0:8f:74:24:59:ed:86:4a:d1:0e:90:96:43:a2:22:d6:f9:97
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2020
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
69:36:cd:67:6b:6c:40:a3:d5:54:1f:17
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2020 - Jul 4, 2022
Subject
CN=GlobalSign TSA for Advanced - G2
Serial Number
0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2018 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 2, 2011 - Mar 29, 2029
Minor OS version
1
Major OS version
5
Entry point
54548
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\git\cheat-engine\Cheat Engine\bin\autorun\dlls\MonoDataCollector32.pdb
kernel32
ReadFile
EnterCriticalSection
WriteFile
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
OutputDebugStringA
CreateThread
CreateFileW
FreeLibraryAndExitThread
GetModuleHandleA
Sleep
GetCurrentThread
TerminateThread
GetProcAddress
GetCurrentProcessId
CreateNamedPipeW
GetCurrentThreadId
CreateToolhelp32Snapshot
GetLastError
Module32FirstW
AddVectoredExceptionHandler
GetModuleHandleW
WideCharToMultiByte
Module32NextW
ConnectNamedPipe
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
MultiByteToWideChar
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlUnwind
RaiseException
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetACP
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
HeapReAlloc
GetTimeZoneInformation
SetStdHandle
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW
MDC_ServerPipe
Name
.text
Size
262KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=131, id=243, version=40116,
count=29, id=242, version=40116,
count=50, id=261, version=26706,
count=31, id=260, version=26706,
count=20, id=259, version=26706,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=101, id=1, productName=Unmarked objects,
count=5, id=265, version=27027,
count=1, id=256, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
CheatEvolution/lua/dlls/MonoDataCollector64.dll
- IMPHASH 74b975218b10bb5ec452830411e264de
- SHA256 93125bb74fcff6d7c00a8bf28858826badb62add244636296ecf87b5259d239d
- MD5 9f12c94f8b3d5c5c07d6e510ea10fe3a
- SHA1 42003013a194e13f2354183f69bfc77ebe1c8c36
- SHA512 58adcbab27e1e3a9c95c2011f1bd416626dec29ecf6c4bc8e3be189636713e30305dd87a584b26107613520797658af6ac6176263e96ff0f892176a651de8cd8
- SSDEEP 6144:J2IkI+FKFaLmXBKQ3syN8ROOK5lcsfM6/fjyJKfTqP4+R0XHyohfooWgY2efvn+T:clHEQQcyN8RYl6NAyop6gYnmi8D
- TLSH T145B47D19B79842B9E067D138C8938A42F7B1740A1B30D7DF43E0967E1F673A15E7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
06:c9:e6:0e:bb:60:f4:d9:36:42:9c:bb:48:1f:2c:b9:0d:c0:1f:ba:ba:18:85:80:ad:87:d6:39:a8:f4:e9:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2020
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Digest
58:56:d8:d7:13:ae:40:c0:39:e7:c1:a2:9b:c7:1b:07:66:dc:3d:92
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2020
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
69:36:cd:67:6b:6c:40:a3:d5:54:1f:17
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2020 - Jul 4, 2022
Subject
CN=GlobalSign TSA for Advanced - G2
Serial Number
0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2018 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 2, 2011 - Mar 29, 2029
Minor OS version
2
Major OS version
5
Entry point
62388
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\git\cheat-engine\Cheat Engine\bin\autorun\dlls\MonoDataCollector64.pdb
kernel32
ReadFile
EnterCriticalSection
WriteFile
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
OutputDebugStringA
CreateThread
CreateFileW
FreeLibraryAndExitThread
GetModuleHandleA
Sleep
GetCurrentThread
TerminateThread
GetProcAddress
GetCurrentProcessId
CreateNamedPipeW
GetCurrentThreadId
CreateToolhelp32Snapshot
GetLastError
Module32FirstW
AddVectoredExceptionHandler
GetModuleHandleW
WideCharToMultiByte
Module32NextW
ConnectNamedPipe
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
MultiByteToWideChar
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetACP
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
HeapReAlloc
GetTimeZoneInformation
SetStdHandle
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW
MDC_ServerPipe
Name
.text
Size
333KB
Virtual Size
332KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
132KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=131, id=243, version=40116,
count=25, id=242, version=40116,
count=52, id=261, version=26706,
count=30, id=260, version=26706,
count=9, id=259, version=26706,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=1, productName=Unmarked objects,
count=5, id=265, version=27027,
count=1, id=256, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
CheatEvolution/lua/dotnetinfo.lua
- SHA256 41df4679278eb1b39b872799eb5fd39a166eaad1ac2442ca428c91b90b21a0d5
- MD5 880fdcbd218df2aedb1eaf3be84734b7
- SHA1 3a54200be38433dff112a428aa2c4f2c25ffff1c
- SHA512 e2c7d3a0d3390ef516d12d653d45488e2467b7d3b9621a8ab8d5ef60a2408a16fcb2d51df20d6d79c5af279f56ac4a0be66a48d1051f6dee9378b04175756f74
- SSDEEP 768:uJ28WbCiBJb2C2vGQQmUjdEBtUmEpbGfDW/dWd0WERi/if4AMAbfEUd8tVhfPFg/:geh2v4bpcIRO49tLr0VR2G5cBUam0WEv
- TLSH T190332E46355322E791BB826E64CA4C02DB236063D49A2D90BBFC40963F7835CA5FD7BD
- MD5 SHA1 SHA512 SSDEEP TLSH
CheatEvolution/lua/dotnetsearch.lua
- SHA256 dea79bdbda952bbc2e0070c95c7e41d8ce5f9bdb5f18957f31c38b77c31444cb
- MD5 ee8bb6ab0b341b467c918b93fe129822
- SHA1 5fccccb78e5cc1780c86fbddabbb3e58629ba45d
- SHA512 3fd8afcc9ef8de42e3341640c2db7a81261121f6bf0e8e7d8eb01a7a8f957360810c4f82220210978d6ff0dd2a019f528030aa4e22dcb6f50ae48df590e424b7
- SSDEEP 192:f2yeaJbJtCJtJ7lJtJxA3TQmnz3JTiMJADKtDF3zY0PLYcu+herCwthzf12LPNAK:fTJbJcJtJZJtJeJAmDF3zY0PLTuHrRty
- TLSH T1674212136910127BB4F3867D6AC37899D622114385871A44BFED90823FB87DDA9F83BD
- MD5 SHA1 SHA512 SSDEEP TLSH
CheatEvolution/lua/monoscript.lua
- SHA256 61d8d8b8ea43a2651cec2295aa04805e9daf99e3d45890a0bc2c35ede46dcb27
- MD5 cd5bb3f15cb7a9dad2dfcd90b58a8413
- SHA1 d223a680a89c5de611eb374f962e88df8b36b41a
- SHA512 22c7928041c045650c179a1529ec67b3bf0e47ab96289031592c1a4f19bcb322582695d40d0254859df6ec72ee0f3d0c7a5fc690adc62598d082b473c08afe4e
- SSDEEP 768:/smxQLPqWuiXL9eoiK8uthP/xoiEFLWiP8bTg1b3lDWIkCD+JwaS7CIta9HEPsuo:724aRTTwfo6FV23s8DN
- TLSH T132A39556241762B69AFBC3746CCF1407F3110053A12A1A19BAECECA63FB526CD1F672D
- MD5 SHA1 SHA512 SSDEEP TLSH
CheatEvolution/lua53-32.dll
- IMPHASH 3991c01e50953690ce06a82b4aab452d
- SHA256 7b4f832fdb72fa75a67c9e035f828de0057dbb5d3c4e9963a9fe596719af0cf9
- MD5 dde3f283f576c0469443f6a59adaca76
- SHA1 aef9a9b07f542eac0dd0012525d12a522bfdb877
- SHA512 d18f8344673a65678dc610ba60493b12b988741569f61e8abcfd80f69b44cdca8da09012c72f6d2476bab6fdd105d10d514a3655bef79cd897fa48e48337a9a0
- SSDEEP 12288:lBj8paX8fQ/T/md4OASZAOLRwRai6wXGn+hfc:lxLrLmd4OA4L8DXGnmc
- TLSH T101A4AE12AD52C031D4B8047699B8A5628D3C7E300B3CEDE7A3E958794E742E1F93BB57
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
66:f1:82:b9:ac:cb:79:f5:91:30:16:5e:f7:1d:55:44:76:8b:4c:b7:eb:fa:3a:28:1b:2b:36:3d:99:e1:ae:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2020
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Digest
b7:e3:aa:fa:3a:68:03:ad:48:ef:fc:5e:b7:36:a9:f6:9a:06:cc:08
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2020
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
69:36:cd:67:6b:6c:40:a3:d5:54:1f:17
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2020 - Jul 4, 2022
Subject
CN=GlobalSign TSA for Advanced - G2
Serial Number
0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2018 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 2, 2011 - Mar 29, 2029
Minor OS version
1
Major OS version
5
Entry point
176795
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\git\cheat-engine\Cheat Engine\bin\lua53-32.pdb
kernel32
GetModuleFileNameA
LoadLibraryExA
GetLastError
GetProcAddress
FreeLibrary
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
CloseHandle
DuplicateHandle
CreateProcessA
GetTempPathW
ReadFile
ExitProcess
GetModuleHandleExW
QueryPerformanceFrequency
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetACP
ReadConsoleW
WaitForSingleObject
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
CreateFileW
SetFilePointerEx
GetStringTypeW
DeleteFileW
GetTimeZoneInformation
MoveFileExW
GetCPInfo
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetStdHandle
WriteConsoleW
HeapSize
SetEndOfFile
DecodePointer
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_buffinitsize
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_checkversion_
luaL_error
luaL_execresult
luaL_fileresult
luaL_getmetafield
luaL_getsubtable
luaL_gsub
luaL_len
luaL_loadbufferx
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffsize
luaL_pushmodule
luaL_pushresult
luaL_pushresultsize
luaL_ref
luaL_requiref
luaL_setfuncs
luaL_setmetatable
luaL_testudata
luaL_tolstring
luaL_traceback
luaL_unref
luaL_where
lua_absindex
lua_arith
lua_atpanic
lua_callk
lua_checkstack
lua_close
lua_compare
lua_concat
lua_copy
lua_createtable
lua_dump
lua_error
lua_gc
lua_getallocf
lua_getfield
lua_getglobal
lua_gethook
lua_gethookcount
lua_gethookmask
lua_geti
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_getuservalue
lua_iscfunction
lua_isinteger
lua_isnumber
lua_isstring
lua_isuserdata
lua_isyieldable
lua_len
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_pcallk
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawgetp
lua_rawlen
lua_rawset
lua_rawseti
lua_rawsetp
lua_resume
lua_rotate
lua_setallocf
lua_setfield
lua_setglobal
lua_sethook
lua_seti
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_setuservalue
lua_status
lua_stringtonumber
lua_toboolean
lua_tocfunction
lua_tointegerx
lua_tolstring
lua_tonumberx
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_upvalueid
lua_upvaluejoin
lua_version
lua_xmove
lua_yieldk
luaopen_base
luaopen_bit32
luaopen_coroutine
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table
luaopen_utf8
Name
.text
Size
328KB
Virtual Size
327KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=43, id=241, version=40116,
count=186, id=243, version=40116,
count=36, id=242, version=40116,
count=29, id=261, version=26706,
count=18, id=260, version=26706,
count=25, id=259, version=26706,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=102, id=1, productName=Unmarked objects,
count=36, id=264, version=27027,
count=1, id=256, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
CheatEvolution/lua53-64.dll
- IMPHASH 779703c2d47ce86829a9221b077786f6
- SHA256 002dcb8ae68f51d54927b05e4726601640c6ddd6a063cc306640a7245b655f57
- MD5 13100b2466570bf52c48725199c4e3c6
- SHA1 166cc1d388de4d292d4cd9331ef65ee3a158a31e
- SHA512 5e916722673d431417400836e9555148b433a4f9a15e06076ec3eb1c0ba986915c4f4d6940e7f88dcbb2f9599458e14d692bcaaa56dc1e2253005ab295d8589d
- SSDEEP 6144:7shVOadaiL9mUHQMpgL8LgpqClZNKX6SumisBEb/NUidzSky3uDMK/LXTMBQqN5I:TOL9J2L8E5VKKSuLGEhXGstCXoYkc7B6
- TLSH T19AB47CA8A6781ABDEC7BD13AC9830917F7B234150B62DADF02E166750F137E2167B314
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
81:24:f5:6e:29:14:f8:4e:f1:41:77:d6:d5:6f:d1:de:1e:6f:c9:aa:eb:80:59:e4:25:e8:0a:a4:2e:7e:d4:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2020
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Digest
63:38:84:cf:4a:92:39:93:31:3d:d1:94:0f:fe:b6:98:63:14:7b:89
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2020
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
69:36:cd:67:6b:6c:40:a3:d5:54:1f:17
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2020 - Jul 4, 2022
Subject
CN=GlobalSign TSA for Advanced - G2
Serial Number
0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2018 - Mar 18, 2029
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 2, 2011 - Mar 29, 2029
Minor OS version
2
Major OS version
5
Entry point
211692
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\git\cheat-engine\Cheat Engine\bin\lua53-64.pdb
kernel32
GetModuleFileNameA
LoadLibraryExA
GetLastError
GetProcAddress
FreeLibrary
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RtlPcToFileHeader
CloseHandle
DuplicateHandle
CreateProcessA
GetTempPathW
ReadFile
ExitProcess
GetModuleHandleExW
QueryPerformanceFrequency
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetACP
ReadConsoleW
WaitForSingleObject
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
CreateFileW
SetFilePointerEx
GetStringTypeW
DeleteFileW
GetTimeZoneInformation
MoveFileExW
GetCPInfo
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetStdHandle
WriteConsoleW
HeapSize
SetEndOfFile
RtlUnwind
?luaL_buffinit@@YAXPEAUlua_State@@PEAUluaL_Buffer@@@Z
?luaL_openlib@@YAXPEAUlua_State@@PEBDPEBUluaL_Reg@@H@Z
?luaL_pushmodule@@YAXPEAUlua_State@@PEBDH@Z
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinitsize
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_checkversion_
luaL_error
luaL_execresult
luaL_fileresult
luaL_getmetafield
luaL_getsubtable
luaL_gsub
luaL_len
luaL_loadbufferx
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffsize
luaL_pushresult
luaL_pushresultsize
luaL_ref
luaL_requiref
luaL_setfuncs
luaL_setmetatable
luaL_testudata
luaL_tolstring
luaL_traceback
luaL_unref
luaL_where
lua_absindex
lua_arith
lua_atpanic
lua_callk
lua_checkstack
lua_close
lua_compare
lua_concat
lua_copy
lua_createtable
lua_dump
lua_error
lua_gc
lua_getallocf
lua_getfield
lua_getglobal
lua_gethook
lua_gethookcount
lua_gethookmask
lua_geti
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_getuservalue
lua_iscfunction
lua_isinteger
lua_isnumber
lua_isstring
lua_isuserdata
lua_isyieldable
lua_len
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_pcallk
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawgetp
lua_rawlen
lua_rawset
lua_rawseti
lua_rawsetp
lua_resume
lua_rotate
lua_setallocf
lua_setfield
lua_setglobal
lua_sethook
lua_seti
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_setuservalue
lua_status
lua_stringtonumber
lua_toboolean
lua_tocfunction
lua_tointegerx
lua_tolstring
lua_tonumberx
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_upvalueid
lua_upvaluejoin
lua_version
lua_xmove
lua_yieldk
luaopen_base
luaopen_bit32
luaopen_coroutine
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table
luaopen_utf8
Name
.text
Size
374KB
Virtual Size
374KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=241, version=40116,
count=186, id=243, version=40116,
count=33, id=242, version=40116,
count=30, id=261, version=26706,
count=16, id=260, version=26706,
count=9, id=259, version=26706,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=1, productName=Unmarked objects,
count=36, id=265, version=27027,
count=1, id=256, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
CheatEvolution/settings.lua
- SHA256 61dfbd223f24536f4311cb124b557c8111c1e62ce6042faefbe65636a1d4556b
- MD5 3c24f79cb4ee296d67aee81a52292ff8
- SHA1 1e2a5e3c47f85a928f32e7f5aa16e32b86c78e4f
- SHA512 a0d041ed65cf6a4216c27d0c7e0b20d483af4cae7ae3403546439f39d0896287f5b3ef3326dbc97a283ca913ce2be58b1dec2e837895d77bfb7d66ef20455643
- SSDEEP 192:3HArrHdkVkyEd8fdtINfbLmFSCEpt9qh0VBv5per1rdKK9E3:3HArcEd8FtIF5dqOpCdhS
- TLSH T1EC32305C09920137483E9E572DD6862989C03E2C85C0DAF2B2DE4FDCAFE57688575B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
CheatEvolution/speedhack-i386.dll
- IMPHASH 5e630116f4d694afc4101c9e0d26d4f6
- SHA256 2f77a5e845ee6838bfdc73005e748084a79e18ae0e2de4702224041cde78e0ba
- MD5 4acc9d3311fff9d1ac7697010b43f90b
- SHA1 6874d871367bb522c6c6c08b5234b87f1c3e1c69
- SHA512 b842da8bd37a7df85e9776eed956406cbf3b595e23748121170f57e906123ae3b70a561dc28669b19622ff33007830bd8b248b26526ff95a50ff1f897c92bc12
- SSDEEP 3072:ZNyaW1Pg7kFtOp8+vRha0DAyheYn13qaIhRFXOucMEx32zPzIy2G:ZNyal78m8+vRMEe4a4OEOb8G
- TLSH T194145C57E6128237CA6B7FB8474A49D12AB4E6103CB1D4DF3DD94E8E5B70B606F28207
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
03:27:df:22:70:95:a9:1b:a9:68:8a:17:49:cc:7f:24:67:d5:66:3f:d8:7d:07:1f:25:ce:81:6e:6d:c1:f7:0c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Apr 20, 2017
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Digest
db:ff:9a:2e:2e:13:db:a9:c3:b7:08:f0:b0:90:bc:8f:ba:2a:87:4e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Apr 20, 2017
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:25:07:1d:f9:af
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 18, 2009 - Mar 18, 2019
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
4a:02:a3:8a:22:0b:b0:d2:d9:6d:da:28
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 27, 2017 - Apr 3, 2018
Subject
CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 2, 2011 - Mar 29, 2029
Minor OS version
0
Major OS version
4
Entry point
139216
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
GetLastError
SetLastError
GetTickCount
ExitProcess
GetStartupInfoA
GetStdHandle
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleA
WriteFile
ReadFile
CloseHandle
SetFilePointer
SetEndOfFile
FreeLibrary
LoadLibraryA
GetProcAddress
CreateFileW
GetConsoleMode
GetConsoleOutputCP
GetOEMCP
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
CreateThread
ExitThread
LocalAlloc
LocalFree
Sleep
SuspendThread
ResumeThread
TerminateThread
WaitForSingleObject
SetThreadPriority
GetThreadPriority
CreateEventA
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
SetUnhandledExceptionFilter
EnumResourceTypesA
EnumResourceNamesA
EnumResourceLanguagesA
FindResourceA
FindResourceExA
LoadResource
SizeofResource
LockResource
FreeResource
FormatMessageA
GetWindowsDirectoryA
GetVersionExA
CompareStringA
GetLocaleInfoA
EnumCalendarInfoA
CompareStringW
VirtualFree
QueryPerformanceCounter
GetThreadLocale
SetThreadLocale
GetUserDefaultLCID
oleaut32
SysAllocStringLen
SysFreeString
SysReAllocStringLen
user32
MessageBoxA
CharUpperBuffW
CharLowerBuffW
CharUpperA
CharUpperBuffA
CharLowerA
CharLowerBuffA
GetSystemMetrics
MessageBeep
InitializeSpeedhack
realGetTickCount
realGetTickCount64
realQueryPerformanceCounter
speedhackversion_GetTickCount
speedhackversion_GetTickCount64
speedhackversion_QueryPerformanceCounter
Name
.text
Size
132KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
CheatEvolution/speedhack-x86_64.dll
- IMPHASH 5665fc753ef1d84a6a296568fcb5f05d
- SHA256 3bd69d00774b40132bd621c09c11093f188f06d634db64a19a78c46a27388c8f
- MD5 156249ce92b9a15d71c39160dc05b4a1
- SHA1 2c2a926456f2c1929fecbe33f9aaf7842d1961a1
- SHA512 5229ca79ca70ecc4e0581bdf1e859a711ca47d4dc226de437dea58fd49a854e80b9368c4d216eb60b0d10b8fa75bb74ce37f8659c0aa59b436fb44570ebcb5d7
- SSDEEP 3072:5ViiO5Ea9m3XJusq4opSm7Im9SC2w/iKhF58jfq65bgusSVIRZOl0vDoD4CfOMst:5VZcWJusRPm7kCdKfkkASX/S
- TLSH T120340BAF7512CE7CC0CFCB35488687E19630FE9049F1A74611D0272BDE7AAA46E6C94D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
34:5b:db:86:09:27:74:b8:d3:11:2a:8e:5f:f4:4e:e6:54:cd:9d:94:28:6f:7a:60:4f:cf:1f:b8:dd:18:44:a9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Apr 20, 2017
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Digest
ba:52:40:30:70:40:9c:ce:47:a1:48:fd:2d:81:63:74:7d:7e:75:72
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Apr 20, 2017
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:25:07:1d:f9:af
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 18, 2009 - Mar 18, 2019
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
SERIALNUMBER=50212036,CN=Cheat Engine,O=Cheat Engine,STREET=Frankendaal 32,L=Eindhoven,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
4a:02:a3:8a:22:0b:b0:d2:d9:6d:da:28
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 27, 2017 - Apr 3, 2018
Subject
CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Issuer
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:31:89:c6:50:04
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 2, 2011 - Mar 29, 2029
Minor OS version
0
Major OS version
4
Entry point
57952
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
GetLastError
SetLastError
GetTickCount
ExitProcess
GetStartupInfoA
GetStdHandle
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
ReadProcessMemory
GetModuleFileNameA
GetModuleHandleA
WriteFile
ReadFile
CloseHandle
SetFilePointer
SetEndOfFile
FreeLibrary
GetSystemInfo
LoadLibraryA
GetProcAddress
CreateFileW
GetConsoleMode
GetConsoleOutputCP
GetOEMCP
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
CreateThread
ExitThread
LocalAlloc
LocalFree
Sleep
SuspendThread
ResumeThread
TerminateThread
WaitForSingleObject
SetThreadPriority
GetThreadPriority
CreateEventA
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
EnumResourceTypesA
EnumResourceNamesA
EnumResourceLanguagesA
FindResourceA
FindResourceExA
LoadResource
SizeofResource
LockResource
FreeResource
FormatMessageA
GetWindowsDirectoryA
GetVersionExA
CompareStringA
GetLocaleInfoA
EnumCalendarInfoA
CompareStringW
QueryPerformanceCounter
GetThreadLocale
SetThreadLocale
GetUserDefaultLCID
oleaut32
SysAllocStringLen
SysFreeString
SysReAllocStringLen
user32
MessageBoxA
CharUpperBuffW
CharLowerBuffW
CharUpperA
CharUpperBuffA
CharLowerA
CharLowerBuffA
GetSystemMetrics
MessageBeep
InitializeSpeedhack
realGetTickCount
realGetTickCount64
realQueryPerformanceCounter
speedhackversion_GetTickCount
speedhackversion_GetTickCount64
speedhackversion_QueryPerformanceCounter
Name
.text
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
CheatEvolution/vehdebug-i386.dll
- IMPHASH 5e7c73d37d44319a40c093a56c0eafa1
- SHA256 9a7e39788bcaac1ea29898f4fdfdcb252785f70d551cf602ad87b77b9a64d6f0
- MD5 e427a09c9df940d8e642679a0742079c
- SHA1 d39d1d47edb20b666a2ffe59a1075639f3a47bde
- SHA512 76870d7482133bce6bf02dcccce46f438c0deb43daffcf440b2d6b7e8e507376c0e6aee262006ad0ec1964630b1c6f62ebfd6850815a24818a94ebdfed8e1382
- SSDEEP 6144:VMek30eIejllI8n1b7nBzwlt/VCWs4zzcwgsaH8E4U:1k30eIkllhxjSlHFzQwgsaHWU
- TLSH T1CA546D51E9028337C0EB3AB8564966D406E5DF2038E1C4DB7FCA1F8F6EB19A17E24716
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5936
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
GetStdHandle
GetConsoleMode
TlsGetValue
GetLastError
SetLastError
ExitProcess
GetStartupInfoA
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleA
WriteFile
ReadFile
CloseHandle
SetFilePointer
SetEndOfFile
GetSystemInfo
LoadLibraryW
LoadLibraryA
GetProcAddress
FreeLibrary
FormatMessageW
CreateFileW
GetConsoleOutputCP
GetOEMCP
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
TlsFree
TlsSetValue
CreateThread
ExitThread
LocalAlloc
LocalFree
Sleep
SuspendThread
ResumeThread
TerminateThread
WaitForSingleObject
SetThreadPriority
GetThreadPriority
CreateEventA
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
SetUnhandledExceptionFilter
EnumResourceTypesA
EnumResourceNamesA
EnumResourceLanguagesA
FindResourceA
FindResourceExA
LoadResource
SizeofResource
LockResource
FreeResource
OpenFileMappingA
OutputDebugStringA
GetWindowsDirectoryA
GetVersionExA
CompareStringA
GetLocaleInfoA
GetDateFormatA
EnumCalendarInfoA
CompareStringW
GetDateFormatW
VirtualFree
GetCurrentThread
WaitForMultipleObjects
GetLocalTime
MapViewOfFile
GetCPInfo
GetThreadLocale
SetThreadLocale
GetUserDefaultLCID
SetThreadContext
oleaut32
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SafeArrayCreate
SafeArrayRedim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayPtrOfIndex
VariantChangeTypeEx
VariantClear
VariantCopy
VariantInit
user32
MessageBoxA
CharUpperBuffW
CharLowerBuffW
CharUpperA
CharUpperBuffA
CharLowerA
CharLowerBuffA
GetSystemMetrics
MessageBeep
ole32
CoUninitialize
CoInitialize
GetErrorInfo
ConfigName
InitializeVEH
UnloadVEH
fm
Name
.text
Size
224KB
Virtual Size
224KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
CheatEvolution/vehdebug-x86_64.dll
- IMPHASH 76083037bd7ee81e7939b58f20e87b85
- SHA256 29866065375542a19c52ff003da0f2a792d8e0816a52cf8d3e193dd4fe005d22
- MD5 fbaf0bf6e47e4026997be3c2f4eb5599
- SHA1 9f4ad4bb186c6c369d9ae36de798358d9b293eb0
- SHA512 cdb25b8c5eacdb1b2b8e0a23a2381efef8d3a41989ec6ee9d1fbae8346a46650d6014191ee4edd6339b3d4ed02b11255e92ff899a748522a50c8baff8f447299
- SSDEEP 3072:0LJQH9j5058zzAKrQCKEIHJ8SS4TnC6ckW3plz9Mu0TVv7Wn2PPsml62TEuGFGLg:0LJQHTfDMCy5HFWsb6eelfQ/gMHCPS4
- TLSH T1C884191BF6218A7CC08FCB74549397E29630FE5019F1A78A33C5771B4EB1AB06E6864D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
GetStdHandle
GetConsoleMode
TlsGetValue
GetLastError
SetLastError
ExitProcess
GetStartupInfoA
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
ReadProcessMemory
GetModuleFileNameA
GetModuleHandleA
WriteFile
ReadFile
CloseHandle
SetFilePointer
SetEndOfFile
GetSystemInfo
LoadLibraryW
LoadLibraryA
GetProcAddress
FreeLibrary
FormatMessageW
CreateFileW
GetConsoleOutputCP
GetOEMCP
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
TlsFree
TlsSetValue
CreateThread
ExitThread
LocalAlloc
LocalFree
Sleep
SuspendThread
ResumeThread
TerminateThread
WaitForSingleObject
SetThreadPriority
GetThreadPriority
CreateEventA
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
EnumResourceTypesA
EnumResourceNamesA
EnumResourceLanguagesA
FindResourceA
FindResourceExA
LoadResource
SizeofResource
LockResource
FreeResource
OpenFileMappingA
OutputDebugStringA
GetWindowsDirectoryA
GetVersionExA
CompareStringA
GetLocaleInfoA
GetDateFormatA
EnumCalendarInfoA
CompareStringW
GetDateFormatW
GetCurrentThread
WaitForMultipleObjects
GetLocalTime
MapViewOfFile
GetCPInfo
GetThreadLocale
SetThreadLocale
GetUserDefaultLCID
SetThreadContext
oleaut32
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SafeArrayCreate
SafeArrayRedim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayPtrOfIndex
VariantChangeTypeEx
VariantClear
VariantCopy
VariantInit
user32
MessageBoxA
CharUpperBuffW
CharLowerBuffW
CharUpperA
CharUpperBuffA
CharLowerA
CharLowerBuffA
GetSystemMetrics
MessageBeep
ole32
CoUninitialize
CoInitialize
GetErrorInfo
ConfigName
InitializeVEH
UnloadVEH
fm
Name
.text
Size
250KB
Virtual Size
249KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ