helix.zip
- SHA256 6c62796b3796980d089f32757e513110ed048744f0eb038bf14f44362fa3517e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
helix.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target helix.zip
- Size 3.0MB
- Sample260802-ffjc2avdld
- SHA256 6c62796b3796980d089f32757e513110ed048744f0eb038bf14f44362fa3517e
- MD5 5c1a9702f1f8e1f3e90bddd1a6ae00fe
- SHA1 bfbbc38fe1a8bcb99d5322fb2969064aac833e6f
- SHA512 cfb4ef3455e9703e9fb759d4de1cc27fb7dc2e0887c79408cf111081ed9fd19b3b141d1e12ffdbddbe8be105960f8047d92c3d382f2c034617cbe538a65efcf1
- SSDEEP 49152:zwkLwY9k3jS2zYLd5AmUSC42kt62ZGziMZb4PdMpi5gVTsvAZDSEnNfvGwo0oykw:UHrmJ2+62ZGm+0PdMpSkQATBo9zQ0P8N
- TLSH T191E533E1B15B5FF4C403B9929EB443C8D246814DDE38A0076BBE1FA3E6522B71E19CE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/helix/Helix_cracked.exe
File Explorer
-
helix.zip.zip 3.0MB
-
helix/Helix_cracked.exe.exe 11.5MB
-
helix/esp_preview.mtl255B
-
helix/esp_preview.obj1.4MB
-
helix/esp_preview1_diff.png.png 68KB
-
helix/lua53-64.dll.dll 1.1MB
helix/Helix_cracked.exe
- IMPHASH 136a0333d412e9d7d8e8ba6b52d5da3a
- SHA256 13a4a373ab708d0669a2dc235031898f79d5fee1fd26be4806dc0b15d3c668e5
- MD5 9e3e4df1884afcbbc868793c393e7d3f
- SHA1 7b77ac1a2360d63b511d1eba67f93c759f29ccca
- SHA512 55a224bd096b5faa70c607c62209c8caf99db775275b5b3c79cc3e88578e2d126c733d984d14c5fb73fa8a259d66f52e6b8feb85e3b8b6a0bdf73cfe8ae15229
- SSDEEP 49152:UZDvH0FnUCONJk8uTOBKRAekDLyckhWPEvnUc/MivAYrvAMUodd2En9E0VlM:UB8FqgZayckznsiZrS/WW
- TLSH T159C664E4F1262BA4E837FD35641D7575839A5900FB39E03788FEEE2226B4DB404253A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2523876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\HelixV2\build\Helix.pdb
kernel32
OpenProcess
QueryFullProcessImageNameA
CreateFileA
CloseHandle
CreateThread
GetCurrentProcessId
GetFileType
GetLastError
GetTickCount64
WriteProcessMemory
OutputDebugStringA
GetWindowsDirectoryA
GetLocalTime
GetConsoleWindow
ExitProcess
GetModuleFileNameA
Process32First
Module32Next
GetProcessId
Module32First
CreateToolhelp32Snapshot
Process32Next
VirtualAllocEx
VirtualFreeEx
VirtualQueryEx
GetExitCodeProcess
SetConsoleScreenBufferSize
GetStdHandle
SetCurrentConsoleFontEx
SetConsoleWindowInfo
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetCurrentThread
GetThreadContext
IsDebuggerPresent
CheckRemoteDebuggerPresent
VirtualProtect
SetUnhandledExceptionFilter
SetConsoleTitleA
AllocConsole
GetFileAttributesA
CreateDirectoryA
RaiseException
GetFileAttributesW
SetFileAttributesW
GetFileSizeEx
HeapAlloc
DuplicateHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WaitForSingleObject
GetFileInformationByHandleEx
AreFileApisANSI
GetTempPathW
SetFileInformationByHandle
GetFinalPathNameByHandleW
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
AcquireSRWLockShared
ReleaseSRWLockShared
InitOnceBeginInitialize
InitOnceComplete
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WriteFile
GetCurrentProcess
ReadFile
Sleep
GetModuleFileNameW
GetModuleHandleW
ReadProcessMemory
LoadLibraryW
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
GetLocaleInfoA
HeapFree
GetModuleHandleA
user32
GetSystemMetrics
GetAsyncKeyState
SetWindowPos
DestroyWindow
SendInput
keybd_event
GetWindowTextA
GetWindow
IsWindowVisible
EnumWindows
PostMessageA
MessageBoxA
DefWindowProcW
MonitorFromPoint
GetClassNameA
DispatchMessageA
OpenClipboard
CloseClipboard
IsWindow
GetClipboardData
SetClipboardData
GetKeyState
GetMessageExtraInfo
LoadCursorA
GetDC
ScreenToClient
PostQuitMessage
UnregisterClassA
GetCapture
PeekMessageA
LoadIconA
TranslateMessage
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
SetCapture
SetCursor
SetWindowLongA
SetWindowDisplayAffinity
GetClientRect
SetProcessDPIAware
IsWindowUnicode
ReleaseCapture
SetCursorPos
ReleaseDC
GetCursorPos
GetWindowThreadProcessId
FindWindowA
ShowWindow
UpdateWindow
EmptyClipboard
SetLayeredWindowAttributes
CreateWindowExA
RegisterClassExA
gdi32
CreateSolidBrush
GetDeviceCaps
comdlg32
GetOpenFileNameW
advapi32
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegOpenKeyExA
CryptAcquireContextA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
ShellExecuteW
ole32
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize
oleaut32
SysFreeString
SysAllocString
VariantClear
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
??7ios_base@std@@QEBA_NXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??Bios_base@std@@QEBA_NXZ
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?sync_with_stdio@ios_base@std@@SA_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?_Xlength_error@std@@YAXPEBD@Z
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
_Xtime_get_ticks
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Query_perf_counter
_Thrd_join
_Mtx_unlock
?_Winerror_map@std@@YAHH@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
_Thrd_detach
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
_Mtx_trylock
?uncaught_exceptions@std@@YAHXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Xbad_function_call@std@@YAXXZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?_Random_device@std@@YAIXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
_Cnd_unregister_at_thread_exit
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Cnd_register_at_thread_exit
_Cnd_wait
_Cnd_broadcast
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
msvcp140_atomic_wait
__std_atomic_notify_all_direct
__std_atomic_wait_direct
winhttp
WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpOpen
WinHttpReceiveResponse
WinHttpSetOption
WinHttpQueryHeaders
WinHttpSetTimeouts
WinHttpAddRequestHeaders
WinHttpWriteData
urlmon
URLDownloadToFileA
wininet
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetGetCookieExA
d3d11
D3D11CreateDeviceAndSwapChain
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoGetActivationFactory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_purecall
__std_exception_copy
longjmp
memcpy
memmove
memset
memchr
memcmp
__current_exception
__current_exception_context
__intrinsic_setjmp
_CxxThrowException
__C_specific_handler
strrchr
__std_exception_destroy
__std_terminate
strchr
__RTDynamicCast
strstr
api-ms-win-crt-stdio-l1-1-0
fseek
fclose
fwrite
freopen_s
_wfopen
__stdio_common_vsprintf
fflush
_fwrite_nolock
fread
__stdio_common_vsscanf
__acrt_iob_func
ftell
__p__commode
_set_fmode
fputc
__stdio_common_vsprintf_s
fgetc
__stdio_common_vfprintf
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-string-l1-1-0
strlen
wcsncpy_s
isupper
wcslen
tolower
strncpy
strncpy_s
islower
isspace
isblank
isalnum
toupper
_stricmp
strncmp
isdigit
wcscpy_s
strcmp
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
calloc
realloc
api-ms-win-crt-convert-l1-1-0
strtod
atoi
strtoull
atof
strtoll
strtol
strtof
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_exit
terminate
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_beginthreadex
_cexit
abort
_invoke_watson
exit
_configure_narrow_argv
_crt_atexit
_initialize_narrow_environment
_get_initial_narrow_environment
_register_onexit_function
_errno
_initialize_onexit_table
api-ms-win-crt-math-l1-1-0
nearbyint
llround
tanf
_ldsign
_fdsign
_dsign
round
lroundf
_dclass
_ldclass
acosf
atan2f
atanf
ceilf
cosf
expf
floorf
fmodf
logf
pow
powf
roundf
sinf
sqrtf
_fdclass
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
strftime
_localtime64_s
_mkgmtime64
_gmtime64_s
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8.9MB
Virtual Size
8.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
57KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=257, version=35207,
count=1, id=253, version=35207,
count=6, id=259, version=35207,
count=10, id=260, version=35207,
count=51, id=261, version=35207,
count=2, id=260, version=33145,
count=31, id=257, version=33145,
count=576, id=1, productName=Unmarked objects,
count=26, id=260, version=31107,
count=92, id=265, version=35228,
count=1, id=259, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
helix/esp_preview.mtl
- SHA256 e224cf1d8444960cee40ac9f4f3e7f0cad5cd1f3bce3e0414436beae0c24de93
- MD5 d9a065e5c4cb67c7a10918bec7d4eac8
- SHA1 86923fb8efe0a28e3ab18f244b11152c5335e0ea
- SHA512 2cca87b7fb4d1e4b41894b4e929f165b130f51719a43b5ae3f9fb07ba05d35cd2ec0b1c04470a994f759fdfdad8d81397b2a93fd934cbb368b82e62ba83e47f9
- TLSH T1CDD05EF80C4FFC6D2B31A9345A59460CC664158C9F1CC864FBB66900BCBBBAE425D9DD
- MD5 SHA1 SHA512 TLSH
helix/esp_preview.obj
- SHA256 59bf412748e45d37d4149c7282a336512c3434dcb420e23aa4e0fc72e71c9200
- MD5 45a5757dce371961d28c6c47747c2827
- SHA1 340cd19a0b78796aecc38175b732ec11229fbee8
- SHA512 708ccedc3ce38dd3f599bf9e5000276c3a3be1f5d9760fb9b3e84c3a6e5e8434b24d6e004bc2e64487fad72d070fcf4dff17873e31ca48a7c4b0366b1ee05132
- SSDEEP 3072:Wm2pO78aizrJBFl7hcOrp0jArCdl7GWxOtKv3ghTBPExYdJ+/AJsl3vsYz9oAXRQ:G
- TLSH T1886532F567F490A1793EE8B4C8360A9BFB472B662740EC6407A4EC21D53EE9B4F854C4
- MD5 SHA1 SHA512 SSDEEP TLSH
helix/esp_preview1_diff.png
- SHA256 d6a52ec30919bc20f673835303f3fd4d06919995fa91b0c57541f6f06ac57ca1
- MD5 46ccc4face17ea08b71f68120da36a27
- SHA1 4650f3e883c9d91490f9465159ae0d9ca681c2d4
- SHA512 a12a82152488793e8e18f21e1b1606bfd1dcaaa4b663088d1bd88ff406712059d97ae72d6e7a093c3aeab22b28ac70acf85945d696657bd563b1a36855dad40f
- SSDEEP 1536:b89Xi1rln24m8r/VuD793cWkEQBtiC+I8uSDJ90+:b89S1Z/0DRsW5S8pDTj
- TLSH T1566302E9403C367AA1E4EB470F5920C1DC6A252B5320FF1F10E47BE555EB797C961A1C
- MD5 SHA1 SHA512 SSDEEP TLSH
helix/lua53-64.dll
- IMPHASH 05545aa845d751a39d411a0cc7ef6dec
- SHA256 436f6bf9ac414e7e7259bef4f6e287702a41e1fddbdd9af7d43350d47539a3c9
- MD5 b2d53e47d838cf917f90a9a6977c31e0
- SHA1 7189c2dc9aa6136ca5f210b5ebd242d3491a91fe
- SHA512 1efe3b14d7eac03ad7f2286ca42fbe235481195fa5906b3068dd97d4b4f5b2f9517cdcd78b6907794f6d2979944899ec97dcaae495077282b791260c41aaffe4
- SSDEEP 24576:Px5ACjuRUvIY5cfisR23K16TpoJol/nj30sIcqqD7FE5sF8+:PgCYUG2uCFwsT
- TLSH T1EC45493432A810A6D17AC17DC84B4BA6DDB0300A573C55FB5195C6E4AF237EC2B7EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5b:ec:d1:32:4d:23:34:b2:1a:c9:0c:98:7e:de:a9:72:59:a2:91:b4:14:f5:9b:e9:35:a7:5f:64:b5:a3:4e:f4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 18, 2025
SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Digest
94:5e:b9:59:f4:e4:47:07:ae:5a:0d:1c:48:fd:c2:0d:e8:38:11:99
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 18, 2025
SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=50212036,CN=Cheat Engine EZ,O=Cheat Engine EZ,STREET=Irenelaan 24,L=Waalre,ST=Noord-Brabant,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
49:65:cf:96:a5:44:99:8c:47:68:a7:30
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 18, 2024 - Sep 4, 2026
Subject
CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE
Serial Number
01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 2, 2023 - Dec 4, 2034
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 10, 2014 - Dec 10, 2034
Minor OS version
2
Major OS version
5
Entry point
454627
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\git\cheat-engine\Cheat Engine\bin\lua53-64.pdb
kernel32
FreeLibrary
GetProcAddress
GetLastError
FormatMessageA
LoadLibraryExA
GetModuleFileNameA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateThread
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RtlPcToFileHeader
QueryPerformanceFrequency
ReadFile
CloseHandle
DuplicateHandle
CreateProcessA
CreateProcessW
GetTempPathW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetCurrentThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetACP
HeapReAlloc
SetConsoleCtrlHandler
SetFilePointerEx
WaitForSingleObject
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
CreateFileW
GetStringTypeW
GetTimeZoneInformation
DeleteFileW
MoveFileExW
GetCPInfo
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
HeapSize
SetEndOfFile
OutputDebugStringA
OutputDebugStringW
WaitForSingleObjectEx
RtlUnwind
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_buffinitsize
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_checkversion_
luaL_error
luaL_execresult
luaL_fileresult
luaL_getmetafield
luaL_getsubtable
luaL_gsub
luaL_len
luaL_loadbufferx
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffsize
luaL_pushmodule
luaL_pushresult
luaL_pushresultsize
luaL_ref
luaL_requiref
luaL_setfuncs
luaL_setmetatable
luaL_testudata
luaL_tolstring
luaL_traceback
luaL_unref
luaL_where
lua_absindex
lua_arith
lua_atpanic
lua_callk
lua_checkstack
lua_close
lua_compare
lua_compat
lua_concat
lua_copy
lua_createtable
lua_dump
lua_error
lua_gc
lua_getallocf
lua_getfield
lua_getglobal
lua_gethook
lua_gethookcount
lua_gethookmask
lua_geti
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_getuservalue
lua_iscfunction
lua_isinteger
lua_isnumber
lua_isstring
lua_isuserdata
lua_isyieldable
lua_len
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_pcallk
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawgetp
lua_rawlen
lua_rawset
lua_rawseti
lua_rawsetp
lua_resume
lua_rotate
lua_setallocf
lua_setfield
lua_setglobal
lua_sethook
lua_seti
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_setuservalue
lua_status
lua_stringtonumber
lua_toboolean
lua_tocfunction
lua_tointegerx
lua_tolstring
lua_tonumberx
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_upvalueid
lua_upvaluejoin
lua_version
lua_xmove
lua_yieldk
luaopen_base
luaopen_bit32
luaopen_coroutine
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table
luaopen_utf8
Name
.textbss
Size
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
899KB
Virtual Size
899KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
187KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
512B
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
283B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=241, version=40116,
count=187, id=243, version=40116,
count=34, id=242, version=40116,
count=1, id=199, version=41118,
count=37, id=261, version=26706,
count=18, id=260, version=26706,
count=11, id=259, version=26706,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=107, id=1, productName=Unmarked objects,
count=36, id=260, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=256, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,