ULTIMA_1.2.2_1.2.2_NYnaWTigb.zip
- SHA256 390a5cf8a061203be05170b7418fa8017148fffc3c41a071f532509aa8b8f70b
Static task
static1
Behavioral task
behavioral1
Sample
ULTIMA-Setup-1.2.2.exe
Resource
win10ltsc2021-20260513-en
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/ULTIMA-Setup-1.2.2.exe |
| unpack002/$PLUGINSDIR/StdUtils.dll |
| unpack002/$PLUGINSDIR/System.dll |
| unpack002/$PLUGINSDIR/UAC.dll |
| unpack002/$PLUGINSDIR/WinShell.dll |
| unpack003/ULTIMA.exe |
| unpack003/dxcompiler.dll |
| unpack003/ffmpeg.dll |
| unpack003/libEGL.dll |
| unpack003/libGLESv2.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/CommandLineArgumentsParser.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/DebuggerFrontend.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/DebuggerFrontend.exe |
| unpack003/resources/app.asar.unpacked/tools/BG3/Divine.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/Divine.exe |
| unpack003/resources/app.asar.unpacked/tools/BG3/K4os.Compression.LZ4.Streams.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/K4os.Compression.LZ4.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/K4os.Hash.xxHash.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/LSLib.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/LSLibNative.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/LSLibStats.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/OpenTK.Mathematics.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/PhysXCommon_64.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/PhysXCooking_64.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/PhysXFoundation_64.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/PhysX_64.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/PhysicsTool.exe |
| unpack003/resources/app.asar.unpacked/tools/BG3/RconClient.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/RconClient.exe |
| unpack003/resources/app.asar.unpacked/tools/BG3/SharpGLTF.Core.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/SharpGLTF.Runtime.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/SharpGLTF.Toolkit.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/StatParser.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/StatParser.exe |
| unpack003/resources/app.asar.unpacked/tools/BG3/StoryCompiler.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/StoryCompiler.exe |
| unpack003/resources/app.asar.unpacked/tools/BG3/StoryDecompiler.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/StoryDecompiler.exe |
| unpack003/resources/app.asar.unpacked/tools/BG3/VTexTool.dll |
| unpack003/resources/app.asar.unpacked/tools/BG3/VTexTool.exe |
| unpack003/resources/app.asar.unpacked/tools/BG3/ZstdSharp.dll |
| unpack003/resources/elevate.exe |
| unpack003/vk_swiftshader.dll |
| unpack003/vulkan-1.dll |
| unpack002/$PLUGINSDIR/nsDialogs.dll |
| unpack002/$PLUGINSDIR/nsExec.dll |
| unpack002/$PLUGINSDIR/nsProcess.dll |
| unpack002/$PLUGINSDIR/nsis7z.dll |
| unpack002/$R0/Uninstall ULTIMA.exe |
| unpack004/$PLUGINSDIR/StdUtils.dll |
| unpack004/$PLUGINSDIR/System.dll |
| unpack004/$PLUGINSDIR/UAC.dll |
| unpack004/$PLUGINSDIR/WinShell.dll |
| unpack004/$PLUGINSDIR/nsDialogs.dll |
| unpack004/$PLUGINSDIR/nsExec.dll |
| unpack004/$PLUGINSDIR/nsProcess.dll |
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=1, productName=Unmarked objects,
count=3, id=4, version=8047,
count=4, id=14, version=7299,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=83, id=1, productName=Unmarked objects,
count=3, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
Jul 9, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=33140,
count=148, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=60, id=261, version=27316,
count=1, id=260, version=27316,
count=1, productName=Unmarked objects (old),
count=30, id=259, version=33140,
count=227, id=261, version=33140,
count=67, id=260, version=33140,
count=1, id=256, version=33140,
count=136, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
Unsigned PE
Checks for missing Authenticode signature.
Jul 9, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=53, id=260, version=32595,
count=28, id=259, version=32595,
count=201, id=261, version=32595,
count=2, id=261, version=32533,
count=9, id=257, version=30795,
count=152, id=1, productName=Unmarked objects,
count=177, id=265, version=32595,
count=1, id=256, version=32595,
count=1, id=255, version=32595,
count=1, id=151,
count=1, id=258, version=32595,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35215,
count=1, id=258, version=35215,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35215,
count=1, id=258, version=35215,
Nov 15, 2023
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33145,
count=4, id=257, version=35403,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=47, id=1, productName=Unmarked objects,
count=4, id=259, version=35403,
count=8, id=260, version=35403,
count=25, id=261, version=35403,
count=5, id=260, version=35721,
count=4, id=261, version=35721,
count=1, id=255, version=35721,
count=1, id=258, version=35721,
Unsigned PE
Checks for missing Authenticode signature.
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=30034,
count=22, id=261, version=30034,
count=8, id=260, version=30034,
count=9, id=259, version=30034,
count=3, id=257, version=27412,
count=72, id=1, productName=Unmarked objects,
count=133, id=261, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=30034,
count=22, id=261, version=30034,
count=8, id=260, version=30034,
count=9, id=259, version=30034,
count=3, id=257, version=27412,
count=104, id=1, productName=Unmarked objects,
count=21, id=261, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=30034,
count=22, id=261, version=30034,
count=8, id=260, version=30034,
count=9, id=259, version=30034,
count=5, id=257, version=27412,
count=113, id=1, productName=Unmarked objects,
count=17, id=261, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=30034,
count=23, id=261, version=30034,
count=8, id=260, version=30034,
count=9, id=259, version=30034,
count=3, id=257, version=27412,
count=273, id=1, productName=Unmarked objects,
count=140, id=261, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=35403,
count=10, id=260, version=35403,
count=30, id=261, version=35403,
count=6, id=257, version=35403,
count=28, id=261, version=30146,
count=9, id=257, version=30146,
count=2, id=257, version=33145,
count=224, id=1, productName=Unmarked objects,
count=3, id=261, version=27040,
count=3, id=265, version=35721,
count=1, id=255, version=35721,
count=1, id=258, version=35721,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35215,
count=1, id=258, version=35215,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35215,
count=1, id=258, version=35215,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35215,
count=1, id=258, version=35215,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35215,
count=1, id=258, version=35215,
Jan 16, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Apr 25, 2022
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35215,
count=1, id=258, version=35215,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=9, id=241, version=40116,
count=119, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=23907,
count=30, id=261, version=23907,
count=17, id=260, version=23907,
count=7, id=203, version=65501,
count=89, id=1, productName=Unmarked objects,
count=1, id=264, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=46, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=25, id=1, productName=Unmarked objects,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=259, version=26213,
count=152, id=261, version=26213,
count=35, id=261, version=26706,
count=16, id=260, version=26706,
count=20, id=259, version=26706,
count=19, id=260, version=26213,
count=15, id=257, version=26213,
count=190, id=1, productName=Unmarked objects,
count=43, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=131, id=261, productName=VS2017 v15.9.5 build 27026, version=27026,
count=1, id=256, productName=VS2017 v15.9.5 build 27026, version=27026,
count=1, id=255, productName=VS2017 v15.9.5 build 27026, version=27026,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.5 build 27026, version=27026,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=1, productName=Unmarked objects,
count=3, id=4, version=8047,
count=4, id=14, version=7299,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=83, id=1, productName=Unmarked objects,
count=3, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=4, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=46, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=25, id=1, productName=Unmarked objects,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,