Installer.zip
- SHA256 96e4ef399e57dadf1fe9b79406a25ab584c23dfc18d49cddfb677273c0984345
Password
2026
Overview
overview
7Static
static
3Installer.zip
windows10-2004-x64
1Installer.zip
windows11-ltsc_2024-x64
1Installer/...!!.txt
windows10-2004-x64
1Installer/...!!.txt
windows11-ltsc_2024-x64
1Installer/ALI213.ini
windows10-2004-x64
1Installer/ALI213.ini
windows11-ltsc_2024-x64
1Installer/...ME.txt
windows10-2004-x64
1Installer/...ME.txt
windows11-ltsc_2024-x64
1Installer/DW/dw.exe
windows10-2004-x64
7Installer/DW/dw.exe
windows11-ltsc_2024-x64
7Installer/...er.exe
windows10-2004-x64
7Installer/...er.exe
windows11-ltsc_2024-x64
7Installer/Serilg.dll
windows10-2004-x64
1Installer/Serilg.dll
windows11-ltsc_2024-x64
1Installer/...Ex.dll
windows10-2004-x64
1Installer/...Ex.dll
windows11-ltsc_2024-x64
1Installer/config.jet
windows10-2004-x64
3Installer/config.jet
windows11-ltsc_2024-x64
3Installer/...13.ini
windows10-2004-x64
1Installer/...13.ini
windows11-ltsc_2024-x64
1Installer/...lg.dll
windows10-2004-x64
1Installer/...lg.dll
windows11-ltsc_2024-x64
1Installer/...Ex.dll
windows10-2004-x64
1Installer/...Ex.dll
windows11-ltsc_2024-x64
1Installer/...xt.dll
windows10-2004-x64
1Installer/...32.dll
windows10-2004-x64
3Installer/...32.dll
windows11-ltsc_2024-x64
3Installer/...40.dll
windows10-2004-x64
1Installer/...40.dll
windows11-ltsc_2024-x64
1Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Installer.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Installer.zip
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Installer/!!!README!!!.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Installer/!!!README!!!.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Installer/ALI213.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Installer/ALI213.ini
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Installer/DW/README.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Installer/DW/README.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Installer/DW/dw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral10
Sample
Installer/DW/dw.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral11
Sample
Installer/Installer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral12
Sample
Installer/Installer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral13
Sample
Installer/Serilg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Installer/Serilg.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Installer/SystemEx.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Installer/SystemEx.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Installer/config.jet
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
Installer/config.jet
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
Installer/data/ALI213.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
Installer/data/ALI213.ini
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
Installer/localdata/Serilg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Installer/localdata/Serilg.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Installer/localdata/SystemEx.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Installer/localdata/SystemEx.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Installer/localdata/bin/shellext.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Installer/localdata/dll/libasset32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
Installer/localdata/dll/libasset32.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
Installer/localdata/dll/mfc140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Installer/localdata/dll/mfc140.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Installer.zip
- Size 8.9MB
- Sample260825-rbttrazvg1
- SHA256 96e4ef399e57dadf1fe9b79406a25ab584c23dfc18d49cddfb677273c0984345
- MD5 76c8689f9e894f0fc4befc2230d62696
- SHA1 26cef978e6ddc2f57bf17f25b0c0daf28967fd8e
- SHA512 1fdc4789749abc1224fecb2fe35d58fc5dadfce5677e67cd75aa592ee0c889d75f7324dd8ff0b31916300436cf266ea3227e8de0f18fe6eda6968d1ac9eb6a49
- SSDEEP 196608:JT8ikPiW2kZsrUvYvl99OaVRyD7s7PRxxPhb:d8l1/Jgl9M1PmL/
- TLSH T13496330E92E77E9C214A2F3D4FCFAA80B045F111E5D9725C1BFE96048FF91ED8606A61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule static1/unpack001/Installer/localdata/dll/libasset32.dll embeds_openssl - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Installer/Serilg.dll unpack001/Installer/localdata/Serilg.dll unpack001/Installer/localdata/bin/shellext.dll.mui - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Installer/DW/dw.exe unpack001/Installer/Installer.exe
File Explorer
-
Installer.zip.zip 8.9MB
-
Installer/!!!README!!!.txt2KB
-
Installer/ALI213.ini2KB
-
Installer/DW/README.txt544B
-
Installer/DW/dw.exe.exe 3.6MB
-
Installer/Installer.exe.exe 3.5MB
-
Installer/Serilg.dll.dll 125KB
-
Installer/SystemEx.dll.dll 23KB
-
Installer/config.jet697B
-
Installer/data/ALI213.ini2KB
-
Installer/data/Localization.json8KB
-
Installer/data/eula.1042.txt17KB
-
Installer/data/eula.2052.txt17KB
-
Installer/data/globdata.ini1KB
-
Installer/data/kernel.bin518KB
-
Installer/data/overrideAutodetect.lua162B
-
Installer/localdata/ALI213.ini2KB
-
Installer/localdata/GameSettings.ini4KB
-
Installer/localdata/Localization.json8KB
-
Installer/localdata/Serilg.dll.dll 125KB
-
Installer/localdata/SystemEx.dll.dll 23KB
-
Installer/localdata/bin/ProtectionManagement.mfl98KB
-
Installer/localdata/bin/ProtectionManagement_Uninstall.mfl1KB
-
Installer/localdata/bin/shellext.dll.mui.dll 3KB
-
Installer/localdata/config.jet697B
-
Installer/localdata/dll/libasset32.dll.dll 8.8MB
-
Installer/localdata/dll/mfc140.dll.dll 5.5MB
-
Installer/localdata/eula.1042.txt17KB
-
Installer/localdata/eula.2052.txt17KB
-
Installer/localdata/globdata.ini1KB
-
Installer/localdata/kernel.bin518KB
-
Installer/localdata/overrideAutodetect.lua162B
-
Installer/setcr.ini1KB
Installer/!!!README!!!.txt
- SHA256 4183e28e3a081910a7e002c2ae044143e0fff18cefae5334ea7227f4a6014596
- MD5 f48ea165dff168150cac7db08cedfbcf
- SHA1 7d9cc93e2fe5c0721bdd05a260f2ce522f137cd6
- SHA512 87cccfb5afc02b48f1bd93c4cd93281144d9fead3706bcc0559aec75f98559566bc1badda383b89f07874a94ab4cd3bdf785e7c931a62bb7ad31ee1e4e71cd0d
- TLSH T131511A5EFFDBAAB39041DA112B1ED6A2C20D516CAA470B101A5450BC36A06B379FA4E6
- MD5 SHA1 SHA512 TLSH
Installer/ALI213.ini
- SHA256 bbd3bfc1f61c8eec3bd404478226e9b2e509082f1a68341095a7cab6eb9a9383
- MD5 c2a1e48fc987e950cb2f447027a3af72
- SHA1 b10d6503095805d0a4ff725bd5014ff5c97b49e6
- SHA512 ac79b7d1ca93cd7784288b5d595a356a2192aa761457465fb3fb4b089c70a8c394f26e4c700307a4ec4bcd126a6580fb80ad34e6c6e62cb1c0a58fe288f2e4c2
- TLSH T18051508FF7CE104F2306608B69A70C91B1E3B1482C230996FC6DBB00AE05E1EE44247F
- MD5 SHA1 SHA512 TLSH
Installer/DW/README.txt
- SHA256 7f022910960d0b0b59a8c34cc6aa8ef2ab6b3812556edbff37c705ae84f9e7b3
- MD5 cfaa8fa0af14238d62ad14cb3d6f9a98
- SHA1 4ef6bf9018c513f6a1f1c950e77b75aceb1709d4
- SHA512 e087d62af3569ac6cd6b02b843e4d3281a04fd9dc2e2f540c67a436ef99c8c14071945eca3b0fa87fa4dc38125d8f966d649a39c339f7d96efef1c45826686c4
- TLSH T173F08B0EEFCFA6B21501E7926B4DD953D208A43C93618DF45835217C61703B46AED6F9
- MD5 SHA1 SHA512 TLSH
Installer/DW/dw.exe
- IMPHASH f0ea7b7844bbc5bfa9bb32efdcea957c
- SHA256 56e25bff1587bb278f048a1ae5f74e2286946f1cbaf59aaa03d3cea070a462ae
- MD5 c503cb2ca43594f1ac72d5c9c3b9bc27
- SHA1 67a9b5a371f806be8e8009bc37153165e42f7b23
- SHA512 a655b257a8bcd3ecbc56f11573320bd2024a4f1842e2b1223997b146c703d38fa1b864a07373fd20f2b0e3b3bc6a3032232df1d3fe6d689d62c991724de8c699
- SSDEEP 49152:sYxgaLCN+0v/2rdPm/jUJu75vfX7WMsf1SgibezD1BT:cNc+U
- TLSH T114062707389411E0C8EB9A35E1BA1262AB247C8DC73473E36E5167702F667C13EF9B59
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
2026
PE Signature issue
Digest
b5:ae:ca:69:20:66:19:fe:e1:c5:6d:75:c0:a8:70:dd:21:e3:b7:9d:5c:96:f5:1b:2c:19:4f:4d:55:99:31:e5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Harbor Anchor,O=Harbor Anchor,C=US
Chains
Aug 24, 2026
CN=Harbor Anchor,O=Harbor Anchor,C=US
Subject
CN=Harbor Anchor,O=Harbor Anchor,C=US
Serial Number
02:f4:9a:c5:e9:29:49:02:a9:4e:92:0e:5c:5b:ed:ff
Issuer
CN=Harbor Anchor,O=Harbor Anchor,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 17, 2026 - Aug 24, 2027
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
1
Major OS version
6
Entry point
394560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
101KB
Virtual Size
451KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Installer/Installer.exe
- IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
- SHA256 5e1c98cddce4b990947d12476ececc3703bc593fe503c55050b0b6cd299f3c23
- MD5 2868086a4034f2fcf8f54780fdf95c46
- SHA1 0148b1c5365dfe5cfd033ece2890e626ce9a3c2e
- SHA512 48f262479065c7b75d3870561a6788e8f7e4d3457dad399887baadff4ad3891493e1ee72e9295d58868ae6d4b06ec989ea27684f96081bd6b91fcdbb212f7b33
- SSDEEP 49152:umxZogJTDW3kj1A/r7GV5NGUcUnufCP0ZwY/D2oEI0nXO3bgwGQj9mC5ND1p8tk/:uSTaGjNGUc7CP0//REI0nXc0r2
- TLSH T1DE06190B3885B060D49A4D31A13A51627B207CADC33C27AB6E91D6B51F767C22E7BF71
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
2026
PE Signature issue
Digest
24:52:f5:9e:da:fa:d2:90:55:a1:8b:26:9e:cc:a7:d0:8c:c4:0d:dc:76:e2:08:43:7c:47:17:da:a0:07:32:81
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Blue Ridge Solutions,O=Blue Ridge Solutions,C=US
Chains
Aug 25, 2026
CN=Blue Ridge Solutions,O=Blue Ridge Solutions,C=US
Subject
CN=Blue Ridge Solutions,O=Blue Ridge Solutions,C=US
Serial Number
b7:1e:01:cb:51:73:5f:a9:cd:e2:d8:d1:8c:f7:ca:9d
Issuer
CN=Blue Ridge Solutions,O=Blue Ridge Solutions,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2026 - Aug 25, 2027
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
1
Major OS version
6
Entry point
398016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
102KB
Virtual Size
462KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Installer/Serilg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 db0a4c4a21a1ba0937d1c22095c2b0702422efd4c7a41aaa577608288a2e69fc
- MD5 181f3e3d0c509566283156816eb317ca
- SHA1 400debdd4fb9ae24719157132a87c4bfeff7fa6c
- SHA512 039d5a0013d6f0e916a86baa95452d79d4524f5c83b913170daa73e1333b2d424c0d9a74193e71ede3a0866b778781c57993806baa08833d11df825626e6d667
- SSDEEP 3072:6obKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDt:bbKKz1UeZk/Phv8lDuPa
- TLSH T18EC34C2863FC9EA1CBEE75B5A0B081810B74FC9F6077EF8E695C25F91D123094A60B57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
4
Entry point
133174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/Serilog/obj/Release/netstandard2.1/Serilog.pdb
mscoree
_CorDllMain
Name
.text
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Installer/SystemEx.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a78c4d08c6726e1e560c3a47436c631847423cab95032d02ccd4e10f92e6d937
- MD5 fba0fc7ec66d149d2096ab7032f751c5
- SHA1 e2d9f46a045235548ae4d648de1d317b71531b5a
- SHA512 124966ca2827b1d11d8e49dada8e5a708047e6819fac6031d5f83150dcbad0b2935bb630304e4589845b22ce22665796c9987bd343668345875143b44f80d342
- SSDEEP 384:TZucmhNHUrP0p/gN9ro7zjLIYiVTAM+o/8E9VF0NyJWQI:8LN0IgLE7X0YipAMxkELI
- TLSH T117B26E0A9F489803CA5F5A7070D5532AC230F69A6BC2D7E7369CC1359F4338639E63E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
2026
Digest
9b:d5:2d:fb:35:36:ad:88:00:0c:63:c4:c5:ef:37:00:61:53:fe:f6:b4:ad:bf:5a:5e:61:2c:be:b0:82:ed:55
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=2019191556,CN=Smartly Dressed Games Ltd.,O=Smartly Dressed Games Ltd.,L=Calgary,ST=Alberta,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1307416c6265727461,1.3.6.1.4.1.311.60.2.1.3=#13024341
Chains
Feb 13, 2024
SERIALNUMBER=2019191556,CN=Smartly Dressed Games Ltd.,O=Smartly Dressed Games Ltd.,L=Calgary,ST=Alberta,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1307416c6265727461,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=2019191556,CN=Smartly Dressed Games Ltd.,O=Smartly Dressed Games Ltd.,L=Calgary,ST=Alberta,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1307416c6265727461,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=2019191556,CN=Smartly Dressed Games Ltd.,O=Smartly Dressed Games Ltd.,L=Calgary,ST=Alberta,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1307416c6265727461,1.3.6.1.4.1.311.60.2.1.3=#13024341
Serial Number
01:5b:2f:ef:63:1a:86:9c:b5:99:97:32:fa:03:c4:29
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 4, 2023 - Jun 22, 2024
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
19394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Unturned\Library\Bee\artifacts\1900b0aP.dag\SystemEx.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Installer/config.jet
- SHA256 7ab308abac85601d348005bbb7032c92261fa25c782a712f1b0482bd85845ede
- MD5 53a9cdbb5470cba6ec4fbafdf7ac618c
- SHA1 dd8600c6f92b975ce54f300ac854abbdddb96559
- SHA512 c501cf9bbce1186e42352612d60c1f41699c0e297bfa93a6a91ad586b8f09fcd81b00b67ca1cc52a80a227d29750739ec56a8b494fe3f679ffca0c797ccec02f
- TLSH T1CD0176308A7D243C430CCEAC3D62EB5AAA7C020F5784C41FD56D8EED1BC00A159D7352
- MD5 SHA1 SHA512 TLSH
Installer/data/ALI213.ini
- SHA256 bbd3bfc1f61c8eec3bd404478226e9b2e509082f1a68341095a7cab6eb9a9383
- MD5 c2a1e48fc987e950cb2f447027a3af72
- SHA1 b10d6503095805d0a4ff725bd5014ff5c97b49e6
- SHA512 ac79b7d1ca93cd7784288b5d595a356a2192aa761457465fb3fb4b089c70a8c394f26e4c700307a4ec4bcd126a6580fb80ad34e6c6e62cb1c0a58fe288f2e4c2
- TLSH T18051508FF7CE104F2306608B69A70C91B1E3B1482C230996FC6DBB00AE05E1EE44247F
- MD5 SHA1 SHA512 TLSH
Installer/data/Localization.json
- SHA256 0ed2630f4d0450117719a6200426a1e1b78eeb9b100a0fb8e4cc10b7995e3aa2
- MD5 53efcb8e8d93ca156a3962254cde417e
- SHA1 dca16a76e1345958a33cc09d9dbbf080adc0aead
- SHA512 63fd95544513f9f6716d39c5e9d732fb2b30927e0e43717846dcc1d59f80e5dd31e8f302d169f7d5f3a7d897adf264cab22b6e610f35409968b3a5b04d5f4fd6
- SSDEEP 192:Q7WjQPr8cHgeaxcE57vTQNZfl0RB7vTQNZflBa7vTQNZflhWhN7vTQNZfl1B:iXrUcIspERspBAsphWhdsp1B
- TLSH T1D9020114FB401CAB822261A16405FC1774A901FFAB29B7FF764C811E6BAD02ED477AE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Installer/data/eula.1042.txt
- SHA256 a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded
- MD5 9147a93f43d8e58218ebcb15fda888c9
- SHA1 8277c722ba478be8606d8429de3772b5de4e5f09
- SHA512 cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705
- SSDEEP 384:Ce91JzQa6Kc6ZyaMeqFjLD+f2bTdmKMvO:Ce94aUaijLD+fiTdmKMvO
- TLSH T1E0827622A3FD4618F6FB3F506EB966685E7ABC96AC3DC64D1150104E09B6E80CD70B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Installer/data/eula.2052.txt
- SHA256 a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded
- MD5 9147a93f43d8e58218ebcb15fda888c9
- SHA1 8277c722ba478be8606d8429de3772b5de4e5f09
- SHA512 cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705
- SSDEEP 384:Ce91JzQa6Kc6ZyaMeqFjLD+f2bTdmKMvO:Ce94aUaijLD+fiTdmKMvO
- TLSH T1E0827622A3FD4618F6FB3F506EB966685E7ABC96AC3DC64D1150104E09B6E80CD70B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Installer/data/globdata.ini
- SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
- MD5 0a6b586fabd072bd7382b5e24194eac7
- SHA1 60e3c7215c1a40fbfb3016d52c2de44592f8ca95
- SHA512 b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
- TLSH T1AF11D64846A04125E2F2485298E21CEA9DAB74235E39E95A00D52BCF9AB4E41FD3634B
- MD5 SHA1 SHA512 TLSH
Installer/data/kernel.bin
- SHA256 952ca2531233f5993cadc72e6396983d96957a435c9b78a568dd8ff4fa9ca4d4
- MD5 d9b31471fa5f562bf746a1fd1f07094a
- SHA1 95a381ad0e3aa296aa0545ca5b86cb5ca96924b5
- SHA512 af2c1f585001ae50bdb1dd0d407eff25fb0b4bd3c98c8c07da873afedf7aef3b75c4757d583616a666154b2911be3744a4c358a4c20afed24241ca82be48952c
- SSDEEP 12288:GEakMQ33cCxTWI8W8o9hMCiWIUdJWz3L1bfQmudC4WPgHGwgQ3piVnMlPs2n6aJk:3aDw3h9/xZjM/dkWzBbn0rGwgQ3piVnx
- TLSH T1EDB40E68273B0BA5E106ECC554921C03DF54A39633BEDEF19F579EB60350CAAA4B4CD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Installer/data/overrideAutodetect.lua
- SHA256 817dc1b1f94ab2bae24edb81907f0ef36a00631563de9e47b2263d2c23958db9
- MD5 a51d997e849f796e0df777cb67f2f3e7
- SHA1 7f59e9422d976cef13ebb588c62e28f5e4b22dec
- SHA512 581d26ad578ef711a03dc9f58e90a946e3000021907f3d1a118c4f6caf89038cd3ac7303448768a735a0a7e3d53c1edf4945e992e141c90cdc4b04509103de1b
- TLSH T15FC08CB09736B9280B1BF7B7EC022A0604F0E81A01A7242F1350008C5A00F69A42AC1F
- MD5 SHA1 SHA512 TLSH
Installer/localdata/ALI213.ini
- SHA256 bbd3bfc1f61c8eec3bd404478226e9b2e509082f1a68341095a7cab6eb9a9383
- MD5 c2a1e48fc987e950cb2f447027a3af72
- SHA1 b10d6503095805d0a4ff725bd5014ff5c97b49e6
- SHA512 ac79b7d1ca93cd7784288b5d595a356a2192aa761457465fb3fb4b089c70a8c394f26e4c700307a4ec4bcd126a6580fb80ad34e6c6e62cb1c0a58fe288f2e4c2
- TLSH T18051508FF7CE104F2306608B69A70C91B1E3B1482C230996FC6DBB00AE05E1EE44247F
- MD5 SHA1 SHA512 TLSH
Installer/localdata/GameSettings.ini
- SHA256 f6b23c96431deed5152dedb5c41a73cfc3a28fcfa644a31f4c5255dc3f612021
- MD5 e8520eabc3656c930a8513885f98ed3d
- SHA1 a1549127bf7997e630c525fa3c7e42ed74382927
- SHA512 774bbaa754859a8d7991c975d18316981be0e4c63654bb7f25561d523f82a3653ec0cefe948981704702e4c3f176c47452459bbfd86b77440d15bc7bcb148ff6
- SSDEEP 96:ETmU1EeU3IyA6zVDdOHzEGbrOS9++Z0WG7++NzPPdSB6v5LFDY:pUvU0inOAGvLZ0WG7++NzPPdSB6v5Ly
- TLSH T108A194A7512E009AC917E2A089E4338373D531CA17D91B7C7FCE111E6F46B26D22662F
- MD5 SHA1 SHA512 SSDEEP TLSH
Installer/localdata/Localization.json
- SHA256 0ed2630f4d0450117719a6200426a1e1b78eeb9b100a0fb8e4cc10b7995e3aa2
- MD5 53efcb8e8d93ca156a3962254cde417e
- SHA1 dca16a76e1345958a33cc09d9dbbf080adc0aead
- SHA512 63fd95544513f9f6716d39c5e9d732fb2b30927e0e43717846dcc1d59f80e5dd31e8f302d169f7d5f3a7d897adf264cab22b6e610f35409968b3a5b04d5f4fd6
- SSDEEP 192:Q7WjQPr8cHgeaxcE57vTQNZfl0RB7vTQNZflBa7vTQNZflhWhN7vTQNZfl1B:iXrUcIspERspBAsphWhdsp1B
- TLSH T1D9020114FB401CAB822261A16405FC1774A901FFAB29B7FF764C811E6BAD02ED477AE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Installer/localdata/Serilg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 db0a4c4a21a1ba0937d1c22095c2b0702422efd4c7a41aaa577608288a2e69fc
- MD5 181f3e3d0c509566283156816eb317ca
- SHA1 400debdd4fb9ae24719157132a87c4bfeff7fa6c
- SHA512 039d5a0013d6f0e916a86baa95452d79d4524f5c83b913170daa73e1333b2d424c0d9a74193e71ede3a0866b778781c57993806baa08833d11df825626e6d667
- SSDEEP 3072:6obKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDt:bbKKz1UeZk/Phv8lDuPa
- TLSH T18EC34C2863FC9EA1CBEE75B5A0B081810B74FC9F6077EF8E695C25F91D123094A60B57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
4
Entry point
133174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/Serilog/obj/Release/netstandard2.1/Serilog.pdb
mscoree
_CorDllMain
Name
.text
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Installer/localdata/SystemEx.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a78c4d08c6726e1e560c3a47436c631847423cab95032d02ccd4e10f92e6d937
- MD5 fba0fc7ec66d149d2096ab7032f751c5
- SHA1 e2d9f46a045235548ae4d648de1d317b71531b5a
- SHA512 124966ca2827b1d11d8e49dada8e5a708047e6819fac6031d5f83150dcbad0b2935bb630304e4589845b22ce22665796c9987bd343668345875143b44f80d342
- SSDEEP 384:TZucmhNHUrP0p/gN9ro7zjLIYiVTAM+o/8E9VF0NyJWQI:8LN0IgLE7X0YipAMxkELI
- TLSH T117B26E0A9F489803CA5F5A7070D5532AC230F69A6BC2D7E7369CC1359F4338639E63E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
2026
Digest
9b:d5:2d:fb:35:36:ad:88:00:0c:63:c4:c5:ef:37:00:61:53:fe:f6:b4:ad:bf:5a:5e:61:2c:be:b0:82:ed:55
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=2019191556,CN=Smartly Dressed Games Ltd.,O=Smartly Dressed Games Ltd.,L=Calgary,ST=Alberta,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1307416c6265727461,1.3.6.1.4.1.311.60.2.1.3=#13024341
Chains
Feb 13, 2024
SERIALNUMBER=2019191556,CN=Smartly Dressed Games Ltd.,O=Smartly Dressed Games Ltd.,L=Calgary,ST=Alberta,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1307416c6265727461,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=2019191556,CN=Smartly Dressed Games Ltd.,O=Smartly Dressed Games Ltd.,L=Calgary,ST=Alberta,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1307416c6265727461,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=2019191556,CN=Smartly Dressed Games Ltd.,O=Smartly Dressed Games Ltd.,L=Calgary,ST=Alberta,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1307416c6265727461,1.3.6.1.4.1.311.60.2.1.3=#13024341
Serial Number
01:5b:2f:ef:63:1a:86:9c:b5:99:97:32:fa:03:c4:29
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 4, 2023 - Jun 22, 2024
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
19394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Unturned\Library\Bee\artifacts\1900b0aP.dag\SystemEx.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
680B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Installer/localdata/bin/ProtectionManagement.mfl
- SHA256 2c4b7fb581d8b6be9c0e03e5d326f74e342cd4e7d7e0f79e37f1ab4cd5015916
- MD5 4c4e0e5647ff1dc91adff6461673fd9d
- SHA1 55e93694d7cb71aaf35870daf95fd5758b77198a
- SHA512 1f19d8d569a8b4d43348ef9dcfb77f281a7ba9b2eea5b6265c1726680d0121bf466227212771bbe1c4c9923d38d60b61d9295f60f5acd772cf420aba02c8bfbd
- SSDEEP 1536:nmC1+kUNkARKacuN0ZPgA42AhY4u+xY4ur5d/V:mC1+kUNkARKacuN0ZPgA42AM3r5/
- TLSH T19BA3200BA2FC6254B6B6AB105F7640E248777F491B34C4DD968F6D5E0878E34AA307B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Installer/localdata/bin/ProtectionManagement_Uninstall.mfl
- SHA256 1d1186d3677d1cf17666a76e7b9635326ccf8371d9fd45188cdd7014e0a0d181
- MD5 fd0a757d59aad53a698ad07dab3ea22a
- SHA1 cb28d492d3cf643c7ae863ce4d5f2e6d9038a9b5
- SHA512 27aee87a4953b9c4afbb2e3cbd5f6614bc81172a168844e4e1d4746ed195732ce4494fa6bae75e18e7960d50afe05c5e27a232b371a1a057b80b5a50d3bfd108
- TLSH T13E2194D973F821387677AF143DB928581E9B7A902D1DC07C41004E9E09FDB54C9A6BA7
- MD5 SHA1 SHA512 TLSH
Installer/localdata/bin/shellext.dll.mui
- SHA256 965d0e8e10aa6b54143ee53fdddab4d741c6d98d25d98178b952ce59525fc38f
- MD5 efc6c0bdcfcc4855ffaa417c21dd974c
- SHA1 09ba48ecfb36e41e5c6cd15a26f2107b5a306e4e
- SHA512 2a69e0bf20ab668397a6d1bdeb4dff03156360eff00dec42b898e03174509de8ac05adc384db129a17e05d6d3f84b4fa82fc93331b37dce83ffd8527138c6456
- TLSH T1AC71A10F9BBB4117F0A65B304BE745C227BD7E137392A56FCF0A142924641386A90FF2
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,
Installer/localdata/config.jet
- SHA256 7ab308abac85601d348005bbb7032c92261fa25c782a712f1b0482bd85845ede
- MD5 53a9cdbb5470cba6ec4fbafdf7ac618c
- SHA1 dd8600c6f92b975ce54f300ac854abbdddb96559
- SHA512 c501cf9bbce1186e42352612d60c1f41699c0e297bfa93a6a91ad586b8f09fcd81b00b67ca1cc52a80a227d29750739ec56a8b494fe3f679ffca0c797ccec02f
- TLSH T1CD0176308A7D243C430CCEAC3D62EB5AAA7C020F5784C41FD56D8EED1BC00A159D7352
- MD5 SHA1 SHA512 TLSH
Installer/localdata/dll/libasset32.dll
- IMPHASH 3271640cc7316e0665ec5843d406a732
- SHA256 c127f79b4996890a01986f88b4e2076ff7cdb8b6de01092c548b3f28aeda35dd
- MD5 ec1498f406642076468424ef2f45c452
- SHA1 4ab87728753c802273ad96f5567ecabfe1274465
- SHA512 df23385529ccf209478ab64756971e242caeb6c9157605bfc4c8b77bbc8af588f54c90b9fd3814372dd7f226edffb4425516eba296881ef5230bb5a9d591f60a
- SSDEEP 196608:4L7NqnDg0293wsNAXayRDfxihAYOjPTJ3kx+q8ZJPyv1wKl3bc2EeJUO9WLcb0T:ylOJDm1Lrc2EeJUO9WLcbU
- TLSH T1CF963951EA8B58F5EE936B70818BE33F5738AE10C532EFB7EB08D529A8335C21905751
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
Password
2026
Digest
40:22:fd:13:8c:5c:db:79:58:a7:4a:43:1c:1a:2b:36:b3:82:7b:bd:08:72:28:7b:35:dd:a8:4f:28:ba:16:e2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=202431257D,CN=REMOTE UTILITIES PTE. LTD.,O=REMOTE UTILITIES PTE. LTD.,L=Singapore,ST=Singapore,C=SG,1.2.840.113549.1.9.1=#0c18696e666f4072656d6f74657574696c69746965732e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Oct 16, 2024
SERIALNUMBER=202431257D,CN=REMOTE UTILITIES PTE. LTD.,O=REMOTE UTILITIES PTE. LTD.,L=Singapore,ST=Singapore,C=SG,1.2.840.113549.1.9.1=#0c18696e666f4072656d6f74657574696c69746965732e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=202431257D,CN=REMOTE UTILITIES PTE. LTD.,O=REMOTE UTILITIES PTE. LTD.,L=Singapore,ST=Singapore,C=SG,1.2.840.113549.1.9.1=#0c18696e666f4072656d6f74657574696c69746965732e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=202431257D,CN=REMOTE UTILITIES PTE. LTD.,O=REMOTE UTILITIES PTE. LTD.,L=Singapore,ST=Singapore,C=SG,1.2.840.113549.1.9.1=#0c18696e666f4072656d6f74657574696c69746965732e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
1b:17:b4:c6:10:0e:7f:d4:15:6c:5f:01
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 16, 2024 - Oct 17, 2026
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
5040
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEnumProvidersW
CryptExportKey
CryptGenRandom
CryptGetHashParam
CryptGetProvParam
CryptGetUserKey
CryptHashData
CryptReleaseContext
CryptSetHashParam
CryptSignHashW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
crypt32
CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertGetNameStringW
CertOpenStore
CertOpenSystemStoreA
CertOpenSystemStoreW
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryW
PFXImportCertStore
kernel32
CloseHandle
CompareFileTime
ConvertFiberToThread
ConvertThreadToFiber
CreateEventA
CreateFiber
CreateFileW
CreateSemaphoreA
DeleteCriticalSection
DeleteFiber
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FormatMessageA
FormatMessageW
FreeLibrary
GetACP
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeThread
GetFileSizeEx
GetFileType
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetStdHandle
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
GetVersion
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsDBCSLeadByteEx
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MoveFileExW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleW
ReadFile
ReleaseSemaphore
ResetEvent
ResumeThread
SetConsoleMode
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
Sleep
SleepEx
SuspendThread
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__mb_cur_max
_amsg_exit
_beginthreadex
_close
_endthreadex
_errno
_exit
_fdopen
_filelengthi64
_fileno
_fileno
_fstat64
_fstati64
_initterm
_iob
_lock
_lseeki64
_onexit
_read
_read
_setjmp3
_setmode
_stat
_strdup
_strdup
_strtoi64
_sys_errlist
_sys_nerr
_timezone
_unlink
_unlock
_vsnprintf
_vsnwprintf
_waccess
_wcsdup
_wfopen
_wopen
_write
_wstati64
abort
atoi
calloc
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwrite
getc
getenv
getwc
gmtime
isspace
iswctype
localeconv
longjmp
malloc
memchr
memcpy
memmove
memset
mktime
memcmp
printf
putc
putwc
qsort
raise
realloc
setlocale
setvbuf
signal
sprintf
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtol
strtoul
strxfrm
time
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
wcschr
wcscmp
wcscoll
wcscpy
wcsftime
wcslen
wcsncmp
wcsncpy
wcspbrk
wcsstr
wcstombs
wcsxfrm
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
ws2_32
WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSAResetEvent
WSASetEvent
WSASetLastError
WSAStartup
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
GetSSLVersionString
TestFunction
rmsEncAddHandleToUsedList
rmsEncAddOpenSSLKey
rmsEncDecryptData
rmsEncEncryptData
rmsEncFreeMemory
rmsEncGenerateOpenSSLKey
rmsEncGetOpenSSLKey
rmsEncGetSimpleEncKeyHandle
rmsEncInitOpenSSL
rmsEncInitSimpleEncryption
rmsEncIsHandleInUsedList
rmsEncIsOpenSSLKeyExists
rmsEncRemoveOpenSSLKey
rmsEncRsaCheckCertificateAndPrivateKey
rmsEncRsaGenerateCertificate
rmsEncRsaGenerateKeyPair
rmsEncRsaGetCertificateFingerprint
rmsEncRsaPrivateDecrypt
rmsEncRsaPrivateEncrypt
rmsEncRsaPublicDecrypt
rmsEncRsaPublicEncrypt
rmsEncSslAddContext
rmsEncSslCtxExtractPeerCertificatePEM
rmsEncSslCtxGetBIOPending
rmsEncSslCtxInitContext
rmsEncSslCtxIsHandshakeFinished
rmsEncSslCtxReadFromBIO
rmsEncSslCtxReadFromSSL
rmsEncSslCtxUnInitContext
rmsEncSslCtxWriteToBIO
rmsEncSslCtxWriteToSSL
rmsEncSslDeleteContext
rmsSendEmail
Name
.text
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
844KB
Virtual Size
843KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
890KB
Virtual Size
890KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/14
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
109KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
512B
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/94
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/110
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Installer/localdata/dll/mfc140.dll
- IMPHASH 3bd0311cf75c0398e7c83b963863274c
- SHA256 5e62691bf7275652019073c2d41f3ac50116f4dca4b73d52aed4708cc557627a
- MD5 5e9c970ad0b02973bb082349a051e14a
- SHA1 294efe32d7585a434c48876b6a82061054ace070
- SHA512 e1b287b3a818b6304d37e5e8265a5779e39ead3985f0edbd95ec427152901bca3fdb473c80ccdaadd4f381f3e47aa88707f6924e40bcad908f18a314c6a33168
- SSDEEP 49152:9D4hn6nlxf/48dzk70ogp4HjGXSBG378h/1Qs0Fz0+vULJCuSwIbFLOAkGy3zdnk:zKTWULYFLOAkGkzdnEVomFHKnPU
- TLSH T10F467D46BBAC4494C566D07A866F8E4BD3B3FC50273157CB0026679E9F337E24A39272
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
92:a5:bd:17:1b:6e:ef:9d:cf:be:b4:57:8c:64:89:e0:8b:2f:8c:1b:01:77:9e:ea:6e:f8:c2:18:79:7e:5b:0b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 14, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
b1:76:0c:ec:3c:ad:f4:97:ab:6c:dc:d2:98:ea:9b:bb:9f:c8:db:cb
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 14, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:05:8e:ca:29:22:1e:6a:34:5b:00:00:00:00:01:05
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 23, 2018 - Nov 23, 2019
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 12, 2018 - Jul 26, 2019
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 12, 2018 - Jul 26, 2019
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:e7:50:e9:25:9b:cf:e5:95:c4:00:00:00:00:00:e7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 23, 2018 - Nov 23, 2019
Minor OS version
0
Major OS version
6
Entry point
2879744
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
d:\agent\_work\2\s\binaries\amd64ret\bin\amd64\\mfc140.amd64.pdb
advapi32
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegEnumValueA
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumKeyA
RegQueryValueA
RegSetValueA
GetFileSecurityA
SetFileSecurityA
RegOpenKeyExW
IsTextUnicode
kernel32
GetLastError
VirtualQuery
GetSystemInfo
ExpandEnvironmentStringsA
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
DeleteCriticalSection
SetLastError
DeactivateActCtx
LoadLibraryW
GetProcAddress
ActivateActCtx
FindActCtxSectionStringW
CreateActCtxW
GetModuleFileNameW
GetModuleHandleExW
QueryActCtxW
OutputDebugStringA
lstrcpyA
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentThreadId
InitializeCriticalSection
GetACP
DeleteFileA
GetModuleHandleA
GetCPInfo
GetOEMCP
MulDiv
VerSetConditionMask
VerifyVersionInfoA
FreeLibrary
CloseHandle
GetTempPathA
CreateFileA
SetFilePointer
Sleep
GetCurrentDirectoryA
lstrcmpA
GetSystemDirectoryW
LoadLibraryExW
DecodePointer
EncodePointer
GetModuleHandleW
FindResourceA
GlobalFree
GetTickCount
GetWindowsDirectoryA
lstrcmpiA
SetThreadPriority
GetModuleFileNameA
LocalAlloc
LocalFree
TlsAlloc
TlsFree
GlobalHandle
GetEnvironmentVariableA
GetEnvironmentVariableW
LoadLibraryA
GlobalFlags
GlobalFindAtomA
GetSystemTime
LocalUnlock
LocalLock
GlobalGetAtomNameA
GetAtomNameA
SuspendThread
ResumeThread
SetEvent
CopyFileA
WaitForMultipleObjects
CreateEventA
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
WaitForSingleObject
FormatMessageA
SetFileAttributesA
LocalFileTimeToFileTime
GetFileAttributesExA
GetFileSizeEx
FindNextFileA
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetShortPathNameA
GetStringTypeExA
GetThreadLocale
FindClose
FindFirstFileA
GetVolumeInformationA
LoadLibraryExA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
WriteFile
ReadFile
GetCurrentProcess
DuplicateHandle
GetProfileIntA
SystemTimeToFileTime
ReplaceFileA
SetFileTime
GetFileTime
GetFullPathNameA
GetDiskFreeSpaceA
GetTempFileNameA
VirtualProtect
RaiseException
lstrcpyW
lstrcmpW
IsDBCSLeadByte
GetUserDefaultLCID
FindResourceExW
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GlobalAddAtomA
GetCurrentProcessId
SetErrorMode
GlobalDeleteAtom
CompareStringA
GetVersionExA
GetCurrentThread
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalReAlloc
GetLocaleInfoW
TlsGetValue
LocalReAlloc
TlsSetValue
GetFileSize
GetFileAttributesA
GlobalSize
SearchPathA
InitializeCriticalSectionAndSpinCount
vcruntime140
wcsstr
wcschr
wcsrchr
memcmp
__C_specific_handler
_purecall
__std_terminate
memmove
memset
memcpy
__CxxFrameHandler3
__std_type_info_destroy_list
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_invalid_parameter_noinfo
_seh_filter_dll
abort
_initterm
_initterm_e
_errno
__p___argc
__p___argv
_resetstkoflw
__doserrno
_endthreadex
_beginthreadex
_beginthread
_configure_narrow_argv
_endthread
api-ms-win-crt-string-l1-1-0
strcat_s
_strnicmp
wcscmp
wcspbrk
wcscoll
_wcslwr_s
_wcsupr_s
strlen
wcscpy_s
strcpy_s
toupper
strnlen
wcslen
wmemcpy_s
wcsncpy_s
strncpy_s
_wcsicoll
wcscspn
wcsspn
wcscat_s
wcsnlen
_wcsrev
iswspace
_wcsicmp
_strdup
api-ms-win-crt-multibyte-l1-1-0
_mbsdec
_mbsstr
_mbscoll
_mbsicoll
_mbsnbicmp
_mbsnbcmp
_ismbcdigit
_mbsnbcpy_s
_mbscmp
_mbsspn
_ismbcalpha
_mbslwr_s
_mbscspn
_mbsrchr
_ismbcalnum
_ismbcprint
_mbctoupper
_mbspbrk
_ismbcspace
_mbsinc
_mbsicmp
_mbsupr_s
_mbctolower
_mbschr
_mbsrev
_ismbblead
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vsscanf
__stdio_common_vswprintf_s
fclose
fflush
__stdio_common_vsprintf_s
fseek
fgets
fputs
fwrite
clearerr_s
ferror
ftell
feof
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
fread
_open_osfhandle
_fileno
__stdio_common_vsnprintf_s
_get_osfhandle
api-ms-win-crt-heap-l1-1-0
realloc
calloc
malloc
_recalloc
_msize
free
_expand
api-ms-win-crt-utility-l1-1-0
abs
labs
ldiv
rand_s
api-ms-win-crt-convert-l1-1-0
strtol
_itoa_s
wcstombs_s
strtoul
atol
_ultoa_s
strtod
_ltoa_s
atoi
api-ms-win-crt-math-l1-1-0
exp
cos
_fdopen
fabs
floor
sin
atan2
sqrt
ceil
api-ms-win-crt-time-l1-1-0
clock
_time64
_mktime64
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_splitpath_s
_makepath_s
_fullpath
user32
EmptyClipboard
SetClipboardData
CloseClipboard
DrawStateA
GetCapture
LoadAcceleratorsW
TranslateAcceleratorA
GetSystemMetrics
DestroyMenu
LoadMenuW
SendMessageA
PostThreadMessageA
GetClassInfoA
DefWindowProcA
GetWindow
GetMenuItemCount
GetMenuItemID
IsIconic
GetForegroundWindow
DrawIcon
GetMonitorInfoA
MonitorFromPoint
SystemParametersInfoA
LoadCursorA
ValidateRect
SetLayeredWindowAttributes
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetUpdateRect
UnionRect
SetWindowPos
LockWindowUpdate
GetKeyState
BeginDeferWindowPos
EndDeferWindowPos
AppendMenuA
CreatePopupMenu
IntersectRect
SetScrollPos
EnableMenuItem
GetNextDlgTabItem
GetSystemMenu
IsMenu
IsZoomed
ModifyMenuA
DeleteMenu
SetWindowRgn
DestroyAcceleratorTable
GetTopWindow
DestroyWindow
MonitorFromRect
EnumDisplayMonitors
GetSysColor
GetClassLongPtrA
IsClipboardFormatAvailable
DestroyCursor
CreateAcceleratorTableA
CopyAcceleratorTableA
GetKeyboardState
ToAsciiEx
MapVirtualKeyA
CharUpperA
LoadImageW
LoadIconW
SetWindowTextA
GetMenuState
CheckMenuItem
SetFocus
GetMenuItemInfoA
DrawFrameControl
SubtractRect
GetLastActivePopup
GetMessageA
UpdateLayeredWindow
EnableScrollBar
GetScrollPos
GetMenuDefaultItem
SetMenuDefaultItem
HideCaret
InvertRect
EnumChildWindows
GetWindowTextA
GetDoubleClickTime
GetDC
ReleaseDC
GetWindowRgn
FrameRect
ShowScrollBar
IsWindowEnabled
InsertMenuA
RegisterClipboardFormatA
GetComboBoxInfo
CharUpperBuffA
DrawEdge
OpenClipboard
UnregisterClassA
ShowOwnedPopups
GetWindowThreadProcessId
MessageBoxA
SetWindowLongA
SetMenuItemBitmaps
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetWindowLongPtrA
CallWindowProcA
SetActiveWindow
CreateMenu
MoveWindow
InvalidateRgn
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowTextLengthA
GetTabbedTextExtentW
GetDlgItem
CreateDialogIndirectParamA
GetActiveWindow
EndDialog
GetPropA
RemovePropA
SetPropA
MapDialogRect
GetMessageTime
GetMessagePos
GetDialogBaseUnits
GetDCEx
RemoveMenu
MsgWaitForMultipleObjectsEx
CharNextA
SetWindowContextHelpId
IsDialogMessageA
ClipCursor
SendNotifyMessageA
InSendMessage
GetMenuStringA
WindowFromDC
SetScrollRange
AdjustWindowRectEx
GetTabbedTextExtentA
CountClipboardFormats
LoadBitmapA
GetMenu
SetMenu
GetClassLongA
GetClassInfoExA
GetWindowLongPtrA
CreateWindowExA
SetWindowPlacement
TrackPopupMenuEx
RegisterClassA
WinHelpA
GetScrollRange
SetScrollInfo
GetScrollInfo
ScrollWindow
MonitorFromWindow
BeginPaint
EndPaint
SendDlgItemMessageA
LoadAcceleratorsA
LoadMenuA
UnpackDDElParam
ReuseDDElParam
InsertMenuItemA
GetMenuBarInfo
GetWindowDC
DefFrameProcA
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
CheckDlgButton
CheckRadioButton
GetDlgItemInt
GetDlgItemTextA
SetDlgItemInt
SetDlgItemTextA
IsDlgButtonChecked
ScrollWindowEx
RealChildWindowFromPoint
CharToOemBuffA
OemToCharBuffA
InvalidateRect
RedrawWindow
IsWindow
SetRect
EnableWindow
IsCharLowerA
GetKeyNameTextA
MapVirtualKeyExA
GetAsyncKeyState
GetDesktopWindow
WaitMessage
DispatchMessageA
TranslateMessage
PeekMessageA
SetForegroundWindow
LoadCursorW
GetFocus
IsChild
TrackPopupMenu
LoadIconA
GetNextDlgGroupItem
DrawFocusRect
SetCursor
GetWindowLongA
CopyImage
GetIconInfo
FillRect
LoadImageA
NotifyWinEvent
CopyRect
LoadBitmapW
MapWindowPoints
MessageBeep
SetCursorPos
WindowFromPoint
ClientToScreen
SetCapture
ReleaseCapture
CopyIcon
BringWindowToTop
RegisterWindowMessageA
DestroyIcon
GetClassNameA
SetParent
ShowWindow
GetWindowPlacement
IsRectEmpty
GetDlgCtrlID
PostMessageA
DeferWindowPos
EqualRect
GetSysColorBrush
SetClassLongPtrA
GetParent
DrawIconEx
InflateRect
OffsetRect
PtInRect
UpdateWindow
SetTimer
TrackMouseEvent
ScreenToClient
GetCursorPos
IsWindowVisible
GetClientRect
KillTimer
SetRectEmpty
PostQuitMessage
GetWindowRect
GetSubMenu
GetKeyboardLayout
gdi32
CreateMetaFileA
LPtoDP
GetCharWidthA
CreateFontA
StretchDIBits
RoundRect
CreateEllipticRgn
CreateHatchBrush
ExtTextOutA
Polyline
GetDIBits
SelectPalette
SetBkColor
CreateBitmap
SetDIBColorTable
StretchBlt
EnumFontFamiliesExA
CreateRoundRectRgn
SetRectRgn
FillRgn
GetBoundsRect
CombineRgn
CreateRectRgn
PatBlt
GetCurrentObject
EndDoc
EndPage
StartPage
ExtFloodFill
SetPaletteEntries
CreateDIBitmap
CreatePatternBrush
CreatePen
EnumFontFamiliesA
GetTextCharsetInfo
GetDeviceCaps
CreateFontIndirectA
GetBkColor
Ellipse
SetPixel
CreateDIBSection
OffsetRgn
CreateRectRgnIndirect
GetRgnBox
BitBlt
SetPixelV
CreateCompatibleBitmap
FrameRgn
PtInRegion
CreatePolygonRgn
GetPixel
GetSystemPaletteEntries
GetNearestPaletteIndex
RealizePalette
CreatePalette
GetPaletteEntries
GetStockObject
Rectangle
Polygon
GetTextColor
GetObjectType
SelectObject
DeleteObject
CreateCompatibleDC
CreateSolidBrush
GetObjectA
GetTextExtentPoint32A
GetTextMetricsA
DeleteDC
DeleteMetaFile
CloseMetaFile
GetViewportOrgEx
PtVisible
RectVisible
TextOutA
Escape
GetClipBox
GetTextAlign
GetCurrentPositionEx
MoveToEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SaveDC
RestoreDC
GetROP2
GetBkMode
GetPolyFillMode
GetStretchBltMode
GetNearestColor
GetTextFaceA
GetWindowExtEx
GetViewportExtEx
SetTextColor
SetMapMode
SetWindowExtEx
ScaleWindowExtEx
GetTextExtentPoint32W
GetTextExtentPointA
GetWindowOrgEx
SetWindowOrgEx
IntersectClipRect
CreateDCA
SetBrushOrgEx
SetAbortProc
StartDocA
DPtoLP
AbortDoc
CopyMetaFileA
UnrealizeObject
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
OffsetWindowOrgEx
SelectClipRgn
ExcludeClipRect
OffsetClipRgn
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetLayout
SetLayout
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
SelectClipPath
GetClipRgn
ExtSelectClipRgn
PlayMetaFileRecord
PlayMetaFile
EnumMetaFile
ExtCreatePen
CreateDIBPatternBrushPt
GetMapMode
ole32
CoTreatAsClass
SetConvertStg
WriteFmtUserTypeStg
OleDuplicateData
WriteClassStg
GetRunningObjectTable
OleTranslateAccelerator
IsAccelerator
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CoRegisterClassObject
RegisterDragDrop
CoLockObjectExternal
DoDragDrop
CoGetMalloc
StgOpenStorage
StgIsStorageFile
StgCreateDocfile
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
OleSetClipboard
OleGetClipboard
OleRegGetUserType
CreateBindCtx
CreateFileMoniker
OleRun
OleIsRunning
OleQueryLinkFromData
OleQueryCreateFromData
OleSetMenuDescriptor
CreateGenericComposite
CoDisconnectObject
OleRegEnumVerbs
CreateItemMoniker
OleRegGetMiscStatus
OleGetIconOfClass
GetHGlobalFromILockBytes
ReadClassStg
OleLoad
OleSave
OleCreate
OleCreateLinkToFile
OleCreateFromFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleSetContainedObject
StringFromCLSID
OleLockRunning
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
PropVariantCopy
CoInitializeEx
StringFromGUID2
ReadFmtUserTypeStg
OleLoadFromStream
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
ReadClassStm
OleSaveToStream
CreateOleAdviseHolder
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
ReleaseStgMedium
CreateDataAdviseHolder
CreateDataCache
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
PropVariantClear
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree
WriteClassStm
CoCreateInstance
OleDraw
RevokeDragDrop
GetClassFile
oleaut32
SysAllocString
SysStringLen
SysFreeString
VariantChangeType
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
OleCreatePropertyFrame
VarParseNumFromStr
SafeArrayCreateVector
VarBstrFromDec
VarDecFromStr
VarDateFromStr
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCopy
VarBstrFromCy
VarCyFromStr
SysReAllocStringLen
SafeArrayRedim
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SysStringByteLen
SysAllocStringByteLen
SafeArrayDestroy
VariantCopy
VarBstrCmp
DispCallFunc
VariantInit
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
OleLoadPicture
OleCreatePictureIndirect
OleCreateFontIndirect
OleTranslateColor
SysAllocStringLen
shlwapi
PathFindFileNameA
PathRemoveExtensionA
StrFormatKBSizeA
PathIsUNCA
PathStripToRootA
UrlUnescapeA
PathRemoveFileSpecW
PathFindExtensionA
imm32
ImmGetOpenStatus
ImmReleaseContext
ImmGetContext
uxtheme
DrawThemeParentBackground
GetWindowTheme
DrawThemeBackground
GetThemeColor
OpenThemeData
CloseThemeData
GetCurrentThemeName
GetThemeSysColor
DrawThemeText
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
IsAppThemed
Name
.text
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
51KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=243, version=40116,
count=1, id=245, version=40116,
count=23, id=244, version=40116,
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26706,
count=8, id=260, version=26706,
count=23, id=261, version=26706,
count=19, id=239, version=40116,
count=1039, id=1, productName=Unmarked objects,
count=5, id=259, version=26706,
count=406, id=265, version=26706,
count=1, id=256, version=26706,
count=1, id=255, version=26706,
count=1, id=258, version=26706,
Installer/localdata/eula.1042.txt
- SHA256 a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded
- MD5 9147a93f43d8e58218ebcb15fda888c9
- SHA1 8277c722ba478be8606d8429de3772b5de4e5f09
- SHA512 cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705
- SSDEEP 384:Ce91JzQa6Kc6ZyaMeqFjLD+f2bTdmKMvO:Ce94aUaijLD+fiTdmKMvO
- TLSH T1E0827622A3FD4618F6FB3F506EB966685E7ABC96AC3DC64D1150104E09B6E80CD70B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Installer/localdata/eula.2052.txt
- SHA256 a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded
- MD5 9147a93f43d8e58218ebcb15fda888c9
- SHA1 8277c722ba478be8606d8429de3772b5de4e5f09
- SHA512 cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705
- SSDEEP 384:Ce91JzQa6Kc6ZyaMeqFjLD+f2bTdmKMvO:Ce94aUaijLD+fiTdmKMvO
- TLSH T1E0827622A3FD4618F6FB3F506EB966685E7ABC96AC3DC64D1150104E09B6E80CD70B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Installer/localdata/globdata.ini
- SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
- MD5 0a6b586fabd072bd7382b5e24194eac7
- SHA1 60e3c7215c1a40fbfb3016d52c2de44592f8ca95
- SHA512 b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
- TLSH T1AF11D64846A04125E2F2485298E21CEA9DAB74235E39E95A00D52BCF9AB4E41FD3634B
- MD5 SHA1 SHA512 TLSH
Installer/localdata/kernel.bin
- SHA256 952ca2531233f5993cadc72e6396983d96957a435c9b78a568dd8ff4fa9ca4d4
- MD5 d9b31471fa5f562bf746a1fd1f07094a
- SHA1 95a381ad0e3aa296aa0545ca5b86cb5ca96924b5
- SHA512 af2c1f585001ae50bdb1dd0d407eff25fb0b4bd3c98c8c07da873afedf7aef3b75c4757d583616a666154b2911be3744a4c358a4c20afed24241ca82be48952c
- SSDEEP 12288:GEakMQ33cCxTWI8W8o9hMCiWIUdJWz3L1bfQmudC4WPgHGwgQ3piVnMlPs2n6aJk:3aDw3h9/xZjM/dkWzBbn0rGwgQ3piVnx
- TLSH T1EDB40E68273B0BA5E106ECC554921C03DF54A39633BEDEF19F579EB60350CAAA4B4CD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Installer/localdata/overrideAutodetect.lua
- SHA256 817dc1b1f94ab2bae24edb81907f0ef36a00631563de9e47b2263d2c23958db9
- MD5 a51d997e849f796e0df777cb67f2f3e7
- SHA1 7f59e9422d976cef13ebb588c62e28f5e4b22dec
- SHA512 581d26ad578ef711a03dc9f58e90a946e3000021907f3d1a118c4f6caf89038cd3ac7303448768a735a0a7e3d53c1edf4945e992e141c90cdc4b04509103de1b
- TLSH T15FC08CB09736B9280B1BF7B7EC022A0604F0E81A01A7242F1350008C5A00F69A42AC1F
- MD5 SHA1 SHA512 TLSH
Installer/setcr.ini
- SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
- MD5 0a6b586fabd072bd7382b5e24194eac7
- SHA1 60e3c7215c1a40fbfb3016d52c2de44592f8ca95
- SHA512 b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
- TLSH T1AF11D64846A04125E2F2485298E21CEA9DAB74235E39E95A00D52BCF9AB4E41FD3634B
- MD5 SHA1 SHA512 TLSH