AssetRipper_win_x64 (2)[.]zip

Resubmissions

16/08/2026, 02:52

260816-dc1f2ayycx6

16/08/2026, 02:47

260816-c98cgabr9v6

Sharing

Copy URL Twitter E-mail

General

Target
AssetRipper_win_x64 (2).zip
Size 53.5MB
Sample260816-dc1f2ayycx
SHA256 22cd368ca0f80cacfa7b8a3b5186f4312c5dc746fe8d96b98a8f8844d34d96fc
MD5 d7a58a9aebda921b755a9d07c0209d43
SHA1 a51c6ce028441f0486b313cbbe3d0d698cff32a7
SHA512 500a42c03203780041404ce56603aceb4ac6137f65e05462c886a3780e0859468ad7732da0d7b3e5eb92cc200f2323686a3febf573d998b1df12b94fb01a6621
SSDEEP 1572864:sQU2Ndo5NfcwpkT5ej9hYmcA0zYj+fLN11gP:sIfqVcwpqA0kj+jNnY
TLSH
T1BFC73382FFC1234B15289B4A9F738B0112B662B38672CD15928D3A5705DB84DFFF54AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/AssetRipper.GUI.Premium.exe
unpack001/Photino.Native.dll
unpack001/Texture2DDecoderNative.dll
unpack001/capstone.dll
unpack001/crunch.dll
unpack001/crunchunity.dll
unpack001/dxil-spirv-c-shared.dll
unpack001/spirv-cross.dll

File Explorer

AssetRipper_win_x64 (2).zip

.zip 53.5MB
AssetRipper.GUI.Premium.exe

.exe 157.0MB
Photino.Native.dll

.dll 302KB
Texture2DDecoderNative.dll

.dll 122KB
WebView2Loader.dll

.dll 162KB
capstone.dll

.dll 5.3MB
compile_time.txt

29B
crunch.dll

.dll 30KB
crunchunity.dll

.dll 30KB
dxil-spirv-c-shared.dll

.dll 939KB
spirv-cross.dll

.dll 2.7MB

AssetRipper_win_x64 (2).zip

SHA256 22cd368ca0f80cacfa7b8a3b5186f4312c5dc746fe8d96b98a8f8844d34d96fc
MD5 d7a58a9aebda921b755a9d07c0209d43
SHA1 a51c6ce028441f0486b313cbbe3d0d698cff32a7
SHA512 500a42c03203780041404ce56603aceb4ac6137f65e05462c886a3780e0859468ad7732da0d7b3e5eb92cc200f2323686a3febf573d998b1df12b94fb01a6621
SSDEEP 1572864:sQU2Ndo5NfcwpkT5ej9hYmcA0zYj+fLN11gP:sIfqVcwpqA0kj+jNnY
TLSH
T1BFC73382FFC1234B15289B4A9F738B0112B662B38672CD15928D3A5705DB84DFFF54AE
MD5 SHA1 SHA512 SSDEEP TLSH

AssetRipper.GUI.Premium.exe

IMPHASH 5f4e0b5375a31e7abe0a1f30929b14da
SHA256 941fab50f3d35feed4986c481ca8d3c47628846d45a2c75ee5d4585199adc76a
MD5 f4538486e253ac15eaf743f0fcb68f26
SHA1 ccb4afbd458e21314d69905390447e19bda0a2be
SHA512 4e56e763f74461e3d11f4af470e01a26f18ca111cffa14e1f6317602eddfaf6003bc8b094c73401a71c4491b8da1b988bfcb65be10e9f38080d79ad72b3b0f5d
SSDEEP 1572864:yMGxEBRLdNFV0W6ZVVfgQZ3mfy52lFurEnvrgOjfjH4wMnINwo2r4:jQZwy52lFurEnvfjEwMnINo4
TLSH
T197786B2C93A50262DDE6C1B4C7129A33EAF0BD514E19850F0B98EDFC1F778624D1FAA5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

99969044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\AssetRipper.Premium\AssetRipper.Premium\Source\AssetRipper.GUI.Premium\bin\Release\win-x64\native\AssetRipper.GUI.Premium.pdb

advapi32

AdjustTokenPrivileges CreateWellKnownSid DeregisterEventSource EnumerateTraceGuidsEx EventActivityIdControl EventRegister EventSetInformation EventUnregister EventWriteTransfer GetTokenInformation GetWindowsAccountDomainSid ImpersonateLoggedOnUser LookupPrivilegeValueW OpenProcessToken OpenThreadToken RegCloseKey RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW RevertToSelf

bcrypt

BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptExportKey BCryptFinishHash BCryptDecrypt BCryptGetProperty BCryptHashData BCryptImportKey BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCreateHash BCryptGenRandom BCryptCloseAlgorithmProvider

crypt32

CertOpenStore CertNameToStrW CertGetValidUsages CertGetNameStringW CertGetIntendedKeyUsage PFXImportCertStore PFXExportCertStore CryptQueryObject CryptImportPublicKeyInfoEx2 CryptFormatObject CryptFindOIDInfo CryptDecodeObject CertVerifyTimeValidity CertVerifyCertificateChainPolicy CertGetCertificateContextProperty CertSerializeCertificateStoreElement CertAddCertificateContextToStore CertAddCertificateLinkToStore CertCloseStore CertControlStore CertCreateCertificateChainEngine CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertSaveStore

iphlpapi

GetNetworkParams GetPerAdapterInfo if_nametoindex GetAdaptersAddresses

kernel32

SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree TerminateProcess CancelIoEx CancelSynchronousIo CancelThreadpoolIo CloseHandle CloseThreadpoolIo CloseThreadpoolWait CloseThreadpoolWork ConnectNamedPipe CopyFileExW CreateDirectoryW CreateEventExW CreateEventW CreateFileMappingW CreateFileW CreateNamedPipeW CreatePipe CreateProcessW CreateThread CreateThreadpoolIo CreateThreadpoolTimer CreateThreadpoolWait CreateThreadpoolWork DeleteCriticalSection DeleteFileW DeleteVolumeMountPointW DeviceIoControl DisconnectNamedPipe DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCPInfo GetCPInfoExW GetCommandLineW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetCurrentThreadId GetDynamicTimeZoneInformation GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLargestConsoleWindowSize GetLastError GetLocaleInfoEx GetLongPathNameW GetModuleFileNameW GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessId GetProcessTimes GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimes GetThreadPriority GetTickCount64 GetTimeZoneInformation GlobalMemoryStatusEx InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent IsWow64Process K32EnumProcessModulesEx K32EnumProcesses K32GetModuleBaseNameW K32GetModuleFileNameExW K32GetModuleInformation K32GetProcessMemoryInfo LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree LocalReAlloc MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OpenThread OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ReadConsoleW ReadDirectoryChangesW ReadFile RemoveDirectoryW ResetEvent ResumeThread SetConsoleCtrlHandler SetConsoleScreenBufferSize SetConsoleTextAttribute SetConsoleWindowInfo SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetLastError SetThreadErrorMode SetThreadPriority SetThreadpoolTimer SetThreadpoolWait Sleep SleepConditionVariableCS StartThreadpoolIo SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime UnmapViewOfFile VirtualAlloc VirtualFree VirtualQuery WaitForMultipleObjectsEx WaitForSingleObject WaitForThreadpoolWaitCallbacks WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask GetSystemTimeAsFileTime InitializeCriticalSectionEx SleepEx DebugBreak SetThreadIdealProcessorEx GetThreadIdealProcessorEx GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity SetThreadGroupAffinity SetThreadAffinityMask GetNumaProcessorNodeEx CreateFileA WaitForMultipleObjects LoadLibraryW CreateNamedPipeA UnhandledExceptionFilter RtlLookupFunctionEntry

ncrypt

NCryptDeleteKey NCryptGetProperty NCryptImportKey NCryptOpenKey NCryptOpenStorageProvider NCryptSetProperty NCryptFreeObject

ole32

CoCreateGuid CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize CoWaitForMultipleHandles CoGetApartmentType

version

GetFileVersionInfoExW GetFileVersionInfoSizeExW VerQueryValueW

ws2_32

WSASocketW select send recv setsockopt ioctlsocket getsockopt getsockname getpeername WSASend shutdown bind WSAStartup listen FreeAddrInfoExW FreeAddrInfoW GetAddrInfoExW GetAddrInfoW GetNameInfoW WSACleanup WSAConnect WSAEventSelect WSAGetOverlappedResult WSAIoctl WSARecv closesocket

api-ms-win-crt-math-l1-1-0

atan __setusermatherr ceil cos exp floor fmod fmodf sqrt log log2 atan2 modf pow powf sin round

api-ms-win-crt-heap-l1-1-0

free realloc _aligned_free _callnewh malloc _set_new_mode calloc _aligned_malloc

api-ms-win-crt-string-l1-1-0

strcpy_s _strdup strtok_s isspace wcsncmp _stricmp strcmp

api-ms-win-crt-convert-l1-1-0

strtoull strtoul

api-ms-win-crt-runtime-l1-1-0

_set_app_type _initialize_onexit_table _register_onexit_function _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment abort _initterm _initterm_e _exit __p___argc _crt_atexit _errno exit _seh_filter_exe terminate _c_exit __p___wargv _cexit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

fflush __stdio_common_vfprintf __p__commode _set_fmode __stdio_common_vsprintf_s __acrt_iob_func

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Photino.Native.dll

IMPHASH f21a59e89b85eb3f5f9ab27aac735927
SHA256 cf0f1c43de9840e3bb022824faaa6780b6be1c62b91a6d5f9111c02bff5962c7
MD5 c026f0c300dddf5dab7dbe0b929488c2
SHA1 444142c8d8237782c64c43ee0d6b60ed008c7bc3
SHA512 ab61ba1d4aea5c79c6dd6cbea6e3cf04c70c369adcc0ae13f5ec15aeffe49dd8cded50749ed1f99463d911c7cb79bc8b435cc3b279f0492a36719e7883954352
SSDEEP 6144:KADaJM6TULnXHOhZLVMf74Zfn9mQLsfC1LPw+RMfC1VvKbb+bj585P/ZYgZkb0Qg:KAGlTAXHGeC9NLsfC1LPw+RMfC1VvKbl
TLSH
T14F644A46F7B40CA9E9BB913989538645E3B378674BA0C7DF2760431E6F237D0893A721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

81580

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

webview2loader

CreateCoreWebView2EnvironmentWithOptions GetAvailableCoreWebView2BrowserVersionString

kernel32

WriteConsoleW GetModuleFileNameA CreateSemaphoreExW HeapFree SetLastError ReleaseSemaphore GetModuleHandleExW WaitForSingleObject GetCurrentThreadId ReleaseMutex FormatMessageW GetLastError OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW CloseHandle HeapAlloc GetProcAddress CreateMutexExW GetCurrentProcessId GetProcessHeap GetModuleHandleW WideCharToMultiByte DebugBreak IsDebuggerPresent GetCurrentProcess K32GetModuleFileNameExW GetEnvironmentVariableW GetFileAttributesW RaiseException LoadLibraryW GetSystemTimeAsFileTime LocalAlloc MultiByteToWideChar LocalFree CreateProcessW CompareStringOrdinal LoadLibraryExW ActivateActCtx CreateActCtxA FreeEnvironmentStringsW GetSystemDirectoryA LoadLibraryA FreeLibrary GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle GetModuleFileNameW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeactivateActCtx DeleteCriticalSection LeaveCriticalSection CreateFileW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP WriteFile EnterCriticalSection EncodePointer FlushFileBuffers SetStdHandle GetStringTypeW RtlPcToFileHeader WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitOnceComplete InitOnceBeginInitialize QueryPerformanceCounter InitializeCriticalSectionEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwindEx InterlockedFlushSList

user32

SystemParametersInfoW GetWindowLongW GetMessageW DefWindowProcW PostMessageW GetWindowRect DestroyWindow SetWindowPos MessageBoxW GetDpiForWindow SetWindowLongPtrW EnumDisplayMonitors FillRect CreateWindowExW SendMessageW GetSystemMetrics SetWindowTextW GetWindowLongPtrW RegisterClassExW ShowWindow DispatchMessageW GetMonitorInfoW SetThreadDpiAwarenessContext TranslateMessage LoadIconW LoadCursorW GetSystemMetricsForDpi GetClientRect PostQuitMessage UpdateWindow SetForegroundWindow LoadImageW InvalidateRect BeginPaint EndPaint

gdi32

CreateSolidBrush

shell32

SHCreateItemFromParsingName

ole32

PropVariantClear CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize CoCreateGuid CoTaskMemAlloc

shlwapi

ord12

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

urlmon

URLDownloadToFileW

Photino_AddCustomSchemeName Photino_Center Photino_ClearBrowserAutoFill Photino_Close Photino_GetAllMonitors Photino_GetContextMenuEnabled Photino_GetDevToolsEnabled Photino_GetFileSystemAccessEnabled Photino_GetFullScreen Photino_GetGrantBrowserPermissions Photino_GetIgnoreCertificateErrorsEnabled Photino_GetJavascriptClipboardAccessEnabled Photino_GetMaximized Photino_GetMediaAutoplayEnabled Photino_GetMediaStreamEnabled Photino_GetMinimized Photino_GetNotificationsEnabled Photino_GetPosition Photino_GetResizable Photino_GetScreenDpi Photino_GetSize Photino_GetSmoothScrollingEnabled Photino_GetTitle Photino_GetTopmost Photino_GetTransparentEnabled Photino_GetUserAgent Photino_GetWebSecurityEnabled Photino_GetZoom Photino_Invoke Photino_NavigateToString Photino_NavigateToUrl Photino_Restore Photino_SendWebMessage Photino_SetClosingCallback Photino_SetContextMenuEnabled Photino_SetDevToolsEnabled Photino_SetFocusInCallback Photino_SetFocusOutCallback Photino_SetFullScreen Photino_SetIconFile Photino_SetMaxSize Photino_SetMaximized Photino_SetMinSize Photino_SetMinimized Photino_SetMovedCallback Photino_SetPosition Photino_SetResizable Photino_SetResizedCallback Photino_SetSize Photino_SetTitle Photino_SetTopmost Photino_SetTransparentEnabled Photino_SetZoom Photino_ShowMessage Photino_ShowNotification Photino_ShowOpenFile Photino_ShowOpenFolder Photino_ShowSaveFile Photino_WaitForExit Photino_ctor Photino_dtor Photino_getHwnd_win32 Photino_register_win32 Photino_setWebView2RuntimePath_win32

Name

.text

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Texture2DDecoderNative.dll

IMPHASH 3405fdc67729eea75bc8d8bada6486ca
SHA256 7572fed50f135b47afbb90bed4e6df98a414f326c8f5afbfec2594214288ea98
MD5 b99a130917c1256296e34cdcd7dadf0c
SHA1 342015dc565ec32d971ae3c510dca4f05e1b7701
SHA512 9f124dffd69242c49ad9f94286d9f81326df51e367f0bf1f2a8ec342751ecabf2d1427720b5b95c5825e55fd91207781d70cc2c71313823412e5683ccc2070b2
SSDEEP 3072:xQAK7jpj8wqhm5TsuUg+dnpndU2UmE2KOxGCs:xQAKnYmCuU3PDUmE2VGCs
TLSH
T19AC38C8AF38902EBD913D778C5C75B1AF3B8F51D034697E7168156A51E13BE0AE3A380
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

98508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

WebView2Loader.dll

IMPHASH f6946d311bccc86e2042a388e375de41
SHA256 462b36fd1be6ca9f7563466a89e57c41ef4a4def3e0a84fa885d203aea4a3aaf
MD5 c9a5d0f278d57d83a03404b8baeeac64
SHA1 39d44b999c1d89c36136804a373d4d427bc7d679
SHA512 97dfb08eae34624b7679a4bb07dee242b2a38324dc13b8aaec6de7f6fed477e9f9bc7474d4df9fbe907d1a460723db7177b7128a26edf5bd73d38d4d45722db6
SSDEEP 3072:fXAne8TlTRTSpL1ThTNTRyMDjRb/hy75HGRtVBviiZsZ5AalCPTxiEtJx9eg8Xjm:/yTlTRTUL1ThTNTRyeLq1GRtVBvPZsrw
TLSH
T184F36C5772E8007BE16A8274C5A34A11E777B4510B60ABEF03A447791F23BD4EE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

c6:09:cb:14:26:9b:b4:77:3c:29:88:04:e1:41:e3:69:ff:05:82:f6:7c:aa:90:16:0e:5e:6a:f3:0f:b3:26:3f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 10, 2024

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

18304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

WebView2Loader.dll.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

140B

Characteristics

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

capstone.dll

IMPHASH b512c61fa3e767a6fcf811ea8ddeaf7b
SHA256 f03321188a1615d044314b1183dcd9a7ffda09286c31c369d109165d4892dcbb
MD5 2a849fb16e1ce371e8577f99e290f73a
SHA1 c87eb26c07bb923b6a04da3cbc31b49f64c0c59a
SHA512 76c2586ad4a5aa25c4cba3f429d325c4bb85dfe5c7358003ec9b48e358b2ed92059ba5c854eae569aded8c4e887d269586265f55b8d3896538bdc81b478ab3ad
SSDEEP 24576:kKnEVX5TCA68C07l6NA5gk15KbKfsrBo5xTVnGRI844GiO05:vAU8CSYSn5KAGBozTVZ4G
TLSH
T13A46B50BAFA640A5C73CF13895BB571677B2F1A403A0776B33B616221F967C06D36B18
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1310304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

crunch.dll

IMPHASH 6c3db81f0627c7ae33ec25c25b21dfa8
SHA256 33d8e12fe382deee949758067d2df2e5732c7cbdb084ea57f0c8ba06565b8f1c
MD5 d3e531098f9ed52f6abc85e97f5c02bd
SHA1 a6c20da3cae9ff78df639d594d88efeee885a4d7
SHA512 e0c2fa496f0d1e6cf02c5604c9c3f0748dd08d3927ea056df4fcfce1c3e2f21387daf827cb6207ccd609319acee4d64ad7eb094d953e4b2fa0ee5b9ffc9eda08
SSDEEP 768:Bw7Ki/i2wBUMyMLtqO6rLfg2/aAz8qn/Iag:Bw2x2wBUMltqrk2/9sd
TLSH
T12CD27F9BEAA900F8E17BD17CC5565E69E574B4201F2557DF8770825E0B23BD0F23A341
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\Projects\crunch\x64\Release\crunch.pdb

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

crunchunity.dll

IMPHASH 6c3db81f0627c7ae33ec25c25b21dfa8
SHA256 a23f2e66d83551795c941ca36086260a9b3b61d205779faf5f4f949a00393b41
MD5 3adba526ae38591d5c7f880d1602ed0b
SHA1 52529a1679272a693d09622027e57623d6b6dcd0
SHA512 f60595f5a9703908b7af4349818c6d47ba6b70f2078561ae58b298aa00e0ea748b0485c409847decfbd7ad55dd800b950f7ccf2cdf73d042cd1f9843c8eba006
SSDEEP 384:DJAkqG1XbYSkzzZFQMBwrFXxdg3oPfgcs80i4+Ke++WYzrDsJXSqV82/cspW0KCO:uqrYhPGc3oHJsqoiwdv82/rfNclRx8
TLSH
T1A1E27C9AFBD940F4E4FBC03DC657AA29E5B2741017548BDF47B08A6E0B536E1E43A324
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\Projects\crunchunity\x64\Release\crunch.pdb

Name

.text

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dxil-spirv-c-shared.dll

IMPHASH 5d9684f042d3a04688061ea8fc9b556e
SHA256 18e2d7e54825e82d7ee401a43430814679f2785e26648ec8f4204611dbadd1c3
MD5 f350e54ee1b8b38346ab42ceb0d740f8
SHA1 47e16f27973d58a401bdd84ec7569861177d0e14
SHA512 35eddf193534f0e4f8caf74897b7a2b98b0a74f65d0ee2ddb078f4d795e955d38ddeaea8d346112ee99a7b65398d3564dd59ed31dc25769f632743bcbe3dc59f
SSDEEP 24576:fbGN8rPHiihj76uGzol6dPn2k6s2CzcKe:DGN87Hiihv6uGzolonYs2Czc
TLSH
T141157C12A2BC11ECD17FD1B48A0A541BEBF1348223706DCB56E49A921F27EF1577EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

805372

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

OutputDebugStringA IsDebuggerPresent InitializeSListHead DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

msvcp140

?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__current_exception_context memchr __current_exception __C_specific_handler __std_exception_destroy __std_exception_copy strchr memset _CxxThrowException memmove memcpy memcmp __std_terminate __std_type_info_destroy_list

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

fopen fclose __stdio_common_vsprintf __stdio_common_vfprintf fflush __acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _execute_onexit_table _register_onexit_function _cexit _initterm_e _initterm _initialize_onexit_table _initialize_narrow_environment terminate _invalid_parameter_noinfo_noreturn _crt_atexit abort _configure_narrow_argv

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

ceilf

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free

dxil_spv_begin_thread_allocator_context dxil_spv_converter_add_local_root_constants dxil_spv_converter_add_local_root_descriptor dxil_spv_converter_add_local_root_descriptor_table dxil_spv_converter_add_option dxil_spv_converter_begin_local_root_descriptor_table dxil_spv_converter_end_local_root_descriptor_table dxil_spv_converter_free dxil_spv_converter_get_analysis_warnings dxil_spv_converter_get_compiled_entry_point dxil_spv_converter_get_compiled_spirv dxil_spv_converter_get_compute_heuristic_max_wave_size dxil_spv_converter_get_compute_required_wave_size dxil_spv_converter_get_compute_wave_size_range dxil_spv_converter_get_compute_workgroup_dimensions dxil_spv_converter_get_patch_vertex_count dxil_spv_converter_run dxil_spv_converter_set_cbv_remapper dxil_spv_converter_set_entry_point dxil_spv_converter_set_root_constant_word_count dxil_spv_converter_set_root_descriptor_count dxil_spv_converter_set_sampler_remapper dxil_spv_converter_set_srv_remapper dxil_spv_converter_set_stage_input_remapper dxil_spv_converter_set_stage_output_remapper dxil_spv_converter_set_stream_output_remapper dxil_spv_converter_set_uav_remapper dxil_spv_converter_set_vertex_input_remapper dxil_spv_converter_supports_option dxil_spv_converter_uses_shader_feature dxil_spv_converter_uses_subgroup_size dxil_spv_create_converter dxil_spv_create_converter_with_reflection dxil_spv_end_thread_allocator_context dxil_spv_get_version dxil_spv_parse_dxil dxil_spv_parse_dxil_blob dxil_spv_parse_reflection_dxil_blob dxil_spv_parsed_blob_dump_llvm_ir dxil_spv_parsed_blob_free dxil_spv_parsed_blob_get_disassembled_ir dxil_spv_parsed_blob_get_entry_index_by_name dxil_spv_parsed_blob_get_entry_point_demangled_name dxil_spv_parsed_blob_get_entry_point_name dxil_spv_parsed_blob_get_entry_point_node_input dxil_spv_parsed_blob_get_entry_point_node_output dxil_spv_parsed_blob_get_entry_point_num_node_outputs dxil_spv_parsed_blob_get_num_entry_points dxil_spv_parsed_blob_get_num_rdat_subobjects dxil_spv_parsed_blob_get_raw_ir dxil_spv_parsed_blob_get_rdat_subobject dxil_spv_parsed_blob_get_shader_stage dxil_spv_parsed_blob_get_shader_stage_for_entry dxil_spv_parsed_blob_scan_resources dxil_spv_reset_thread_allocator_context dxil_spv_set_thread_log_callback

spirv-cross.dll

IMPHASH fe24a150cd683da6da6b7f2425f26432
SHA256 eff9cb255559e2d2900770c0e88814104e62058b04c039ab5ca72af311968454
MD5 71b501120ec579538775e230cada88d9
SHA1 a26e04d51270721252058f9e28b89284528c827b
SHA512 161299a8d3e11289e1df23cc1bf66f643a6370d9cc315fb1a604194137637ce8d5ddcb47558c323be59f2cdb9e6f516a242af86627086b301b8f7e3f1c464784
SSDEEP 49152:juiDAU5SjjX5A0z+qitmtiDn9FRf7cU7Np:/IAkcl5Np
TLSH
T18AD52B5BE36A30ECC46FC2B5C307B222B6307857973579EF49548A242D94FE0A339B56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2138384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func localeconv

api-ms-win-crt-private-l1-1-0

memchr strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _beginthreadex _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _errno _execute_onexit_table _exit _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _register_onexit_function abort

api-ms-win-crt-string-l1-1-0

iswctype strcmp strlen strncmp wcslen

kernel32

AcquireSRWLockExclusive CloseHandle DeleteCriticalSection EnterCriticalSection FlsAlloc FlsGetValue FlsSetValue GetCurrentThreadId GetLastError GetSystemTimePreciseAsFileTime GetThreadId InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vswprintf fflush fputc fwrite

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

api-ms-win-crt-convert-l1-1-0

strtod strtof strtol strtoll strtoul strtoull wcstod wcstol wcstoul

_GCC_specific_handler _Unwind_DeleteException _Unwind_ForcedUnwind _Unwind_GetGR _Unwind_GetIP _Unwind_GetLanguageSpecificData _Unwind_GetRegionStart _Unwind_RaiseException _Unwind_Resume _Unwind_SetGR _Unwind_SetIP spvc_compiler_add_header_line spvc_compiler_buffer_get_hlsl_counter_buffer spvc_compiler_buffer_is_hlsl_counter_buffer spvc_compiler_build_combined_image_samplers spvc_compiler_build_dummy_sampler_for_combined_images spvc_compiler_compile spvc_compiler_create_compiler_options spvc_compiler_create_shader_resources spvc_compiler_create_shader_resources_for_active_variables spvc_compiler_flatten_buffer_block spvc_compiler_get_active_buffer_ranges spvc_compiler_get_active_interface_variables spvc_compiler_get_binary_offset_for_decoration spvc_compiler_get_buffer_block_decorations spvc_compiler_get_cleansed_entry_point_name spvc_compiler_get_combined_image_samplers spvc_compiler_get_constant_handle spvc_compiler_get_current_id_bound spvc_compiler_get_declared_capabilities spvc_compiler_get_declared_extensions spvc_compiler_get_declared_struct_member_size spvc_compiler_get_declared_struct_size spvc_compiler_get_declared_struct_size_runtime_array spvc_compiler_get_decoration spvc_compiler_get_decoration_string spvc_compiler_get_entry_points spvc_compiler_get_execution_mode_argument spvc_compiler_get_execution_mode_argument_by_index spvc_compiler_get_execution_model spvc_compiler_get_execution_modes spvc_compiler_get_member_decoration spvc_compiler_get_member_decoration_string spvc_compiler_get_member_name spvc_compiler_get_name spvc_compiler_get_num_required_extensions spvc_compiler_get_remapped_declared_block_name spvc_compiler_get_required_extension spvc_compiler_get_specialization_constants spvc_compiler_get_type_handle spvc_compiler_get_work_group_size_specialization_constants spvc_compiler_has_active_builtin spvc_compiler_has_decoration spvc_compiler_has_member_decoration spvc_compiler_hlsl_add_resource_binding spvc_compiler_hlsl_add_vertex_attribute_remap spvc_compiler_hlsl_is_resource_used spvc_compiler_hlsl_remap_num_workgroups_builtin spvc_compiler_hlsl_set_resource_binding_flags spvc_compiler_hlsl_set_root_constants_layout spvc_compiler_install_compiler_options spvc_compiler_mask_stage_output_by_builtin spvc_compiler_mask_stage_output_by_location spvc_compiler_msl_add_discrete_descriptor_set spvc_compiler_msl_add_dynamic_buffer spvc_compiler_msl_add_inline_uniform_block spvc_compiler_msl_add_resource_binding spvc_compiler_msl_add_resource_binding_2 spvc_compiler_msl_add_shader_input spvc_compiler_msl_add_shader_input_2 spvc_compiler_msl_add_shader_output spvc_compiler_msl_add_shader_output_2 spvc_compiler_msl_add_vertex_attribute spvc_compiler_msl_get_automatic_resource_binding spvc_compiler_msl_get_automatic_resource_binding_secondary spvc_compiler_msl_get_combined_sampler_suffix spvc_compiler_msl_is_rasterization_disabled spvc_compiler_msl_is_resource_used spvc_compiler_msl_is_shader_input_used spvc_compiler_msl_is_shader_output_used spvc_compiler_msl_is_vertex_attribute_used spvc_compiler_msl_needs_aux_buffer spvc_compiler_msl_needs_buffer_size_buffer spvc_compiler_msl_needs_input_threadgroup_mem spvc_compiler_msl_needs_output_buffer spvc_compiler_msl_needs_patch_output_buffer spvc_compiler_msl_needs_swizzle_buffer spvc_compiler_msl_remap_constexpr_sampler spvc_compiler_msl_remap_constexpr_sampler_by_binding spvc_compiler_msl_remap_constexpr_sampler_by_binding_ycbcr spvc_compiler_msl_remap_constexpr_sampler_ycbcr spvc_compiler_msl_set_argument_buffer_device_address_space spvc_compiler_msl_set_combined_sampler_suffix spvc_compiler_msl_set_fragment_output_components spvc_compiler_options_set_bool spvc_compiler_options_set_uint spvc_compiler_rename_entry_point spvc_compiler_require_extension spvc_compiler_set_decoration spvc_compiler_set_decoration_string spvc_compiler_set_enabled_interface_variables spvc_compiler_set_entry_point spvc_compiler_set_execution_mode spvc_compiler_set_execution_mode_with_arguments spvc_compiler_set_member_decoration spvc_compiler_set_member_decoration_string spvc_compiler_set_member_name spvc_compiler_set_name spvc_compiler_type_struct_member_array_stride spvc_compiler_type_struct_member_matrix_stride spvc_compiler_type_struct_member_offset spvc_compiler_unset_decoration spvc_compiler_unset_execution_mode spvc_compiler_unset_member_decoration spvc_compiler_update_active_builtins spvc_compiler_variable_is_depth_or_compare spvc_constant_get_scalar_fp16 spvc_constant_get_scalar_fp32 spvc_constant_get_scalar_fp64 spvc_constant_get_scalar_i16 spvc_constant_get_scalar_i32 spvc_constant_get_scalar_i64 spvc_constant_get_scalar_i8 spvc_constant_get_scalar_u16 spvc_constant_get_scalar_u32 spvc_constant_get_scalar_u64 spvc_constant_get_scalar_u8 spvc_constant_get_subconstants spvc_constant_get_type spvc_constant_set_scalar_fp16 spvc_constant_set_scalar_fp32 spvc_constant_set_scalar_fp64 spvc_constant_set_scalar_i16 spvc_constant_set_scalar_i32 spvc_constant_set_scalar_i64 spvc_constant_set_scalar_i8 spvc_constant_set_scalar_u16 spvc_constant_set_scalar_u32 spvc_constant_set_scalar_u64 spvc_constant_set_scalar_u8 spvc_context_create spvc_context_create_compiler spvc_context_destroy spvc_context_get_last_error_string spvc_context_parse_spirv spvc_context_release_allocations spvc_context_set_error_callback spvc_get_commit_revision_and_timestamp spvc_get_version spvc_hlsl_resource_binding_init spvc_msl_constexpr_sampler_init spvc_msl_get_aux_buffer_struct_version spvc_msl_resource_binding_init spvc_msl_resource_binding_init_2 spvc_msl_sampler_ycbcr_conversion_init spvc_msl_shader_input_init spvc_msl_shader_interface_var_init spvc_msl_shader_interface_var_init_2 spvc_msl_vertex_attribute_init spvc_resources_get_builtin_resource_list_for_type spvc_resources_get_resource_list_for_type spvc_type_array_dimension_is_literal spvc_type_get_array_dimension spvc_type_get_base_type_id spvc_type_get_basetype spvc_type_get_bit_width spvc_type_get_columns spvc_type_get_image_access_qualifier spvc_type_get_image_arrayed spvc_type_get_image_dimension spvc_type_get_image_is_depth spvc_type_get_image_is_storage spvc_type_get_image_multisampled spvc_type_get_image_sampled_type spvc_type_get_image_storage_format spvc_type_get_member_type spvc_type_get_num_array_dimensions spvc_type_get_num_member_types spvc_type_get_storage_class spvc_type_get_vector_size unw_get_fpreg unw_get_proc_info unw_get_proc_name unw_get_reg unw_getcontext unw_init_local unw_is_fpreg unw_is_signal_frame unw_local_addr_space unw_regname unw_resume unw_set_fpreg unw_set_reg unw_step

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

449KB

Virtual Size

448KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

AssetRipper_win_x64 (2).zip

AssetRipper.GUI.Premium.exe

advapi32

bcrypt

crypt32

iphlpapi

kernel32

ncrypt

ole32

version

ws2_32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

Photino.Native.dll

webview2loader

kernel32

user32

gdi32

shell32

ole32

shlwapi

api-ms-win-shcore-scaling-l1-1-1

urlmon

generic

Texture2DDecoderNative.dll

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

generic

WebView2Loader.dll

kernel32

generic

capstone.dll

kernel32

generic

compile_time.txt

crunch.dll

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

generic

crunchunity.dll

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

generic

dxil-spirv-c-shared.dll

kernel32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

spirv-cross.dll

api-ms-win-crt-heap-l1-1-0