VMProtect Demo.zip
- SHA256 b8d5646e679a4c283eeae442c6a082037964197b378839a2be980ac747c272e6
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VMProtect.exe
Resource
win11-20260911-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target VMProtect Demo.zip
- Size 68.3MB
- Sample261007-3pt78axvez
- SHA256 b8d5646e679a4c283eeae442c6a082037964197b378839a2be980ac747c272e6
- MD5 749d34bb67bda1788e7e484698a0bc85
- SHA1 7cab7ec35cce3fb80f1a63baadbbb6f3ef5fd2e7
- SHA512 4d089b813859f53ec8caae587e2c10a44d71bbea372ddf23d3b41429a5190896744d66b4fdef3c7a5d3fb0394bbf1c9177770f3b2da12e4b310c91119ec4cb0e
- SSDEEP 1572864:ecx8ZMh5lH7QLSMk5XeJLFazy2dYKvfWHhuUxNhUsTvFo8yPMhe:6MlH7QLi5XqLFauAYKvfWHMeNhTXyPV
- TLSH T14EF73313FF0E472DB6A112D6FA0F0CBDA2DD50679486AF3EFA40AAD15D0809637B16D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/Lib/Net/VMProtect.SDK.dll unpack001/Lib/Windows/VMProtectDDK32.sys unpack001/Lib/Windows/VMProtectDDK64.sys unpack001/Lib/Windows/VMProtectSDK32.dll unpack001/Lib/Windows/VMProtectSDK64.dll unpack001/unins000.exe
File Explorer
-
VMProtect Demo.zip.zip 68.3MB
-
Include/ASM/VMProtectSDK.inc2KB
-
Include/C/VMProtectDDK.h3KB
-
Include/C/VMProtectSDK.h3KB
-
Include/Go/VMProtectSDK.h3KB
-
Include/Go/vmprotect.go2KB
-
Include/Pascal/VMProtectSDK.pas11KB
-
Include/VB6/VMProtectSDK.bas3KB
-
Langs/de.lng10KB
-
Langs/en.lng10KB
-
Langs/fr.lng11KB
-
Langs/ru.lng21KB
-
Langs/zh.lng12KB
-
Lib/Android/libVMProtectARM64.so.elf 13KB
-
Lib/Android/libVMProtectSDK32.so.elf 13KB
-
Lib/Android/libVMProtectSDK64.so.elf 13KB
-
Lib/Linux/libVMProtectARM64.so.elf 19KB
-
Lib/Linux/libVMProtectSDK32.so.elf 17KB
-
Lib/Linux/libVMProtectSDK64.so.elf 18KB
-
Lib/Net/VMProtect.SDK.dll.dll 10KB
-
Lib/Windows/BCC64ELF/VMProtectSDK64.lib3KB
-
Lib/Windows/MinGW/VMProtectSDK32.a23KB
-
Lib/Windows/MinGW/VMProtectSDK64.a23KB
-
Lib/Windows/OMF/VMProtectSDK32.lib4KB
-
Lib/Windows/VMProtectARM64.dll113KB
-
Lib/Windows/VMProtectARM64.lib8KB
-
Lib/Windows/VMProtectDDK32.lib9KB
-
Lib/Windows/VMProtectDDK32.sys.dll 3KB
-
Lib/Windows/VMProtectDDK64.lib8KB
-
Lib/Windows/VMProtectDDK64.sys.dll 3KB
-
Lib/Windows/VMProtectSDK32.dll.dll 98KB
-
Lib/Windows/VMProtectSDK32.lib9KB
-
Lib/Windows/VMProtectSDK64.dll.dll 115KB
-
Lib/Windows/VMProtectSDK64.lib8KB
-
Lib/macOS/libVMProtectSDK.dylib.dylib 165KB
-
VMProtect.exe.exe 40.2MB
-
VMProtect_Con.exe.exe 34.3MB
-
unins000.dat70KB
-
unins000.exe.exe 1.1MB
Include/ASM/VMProtectSDK.inc
- SHA256 15bb47d02910fe98f17b51d6c4e8172e4cc04b6bfd88fb02997600e94744cfeb
- MD5 7939453f109d9ecd41cfb8dd96385127
- SHA1 cc4d70e8c8c3c60293a54deb13717c3d90314577
- SHA512 30950be57c8a5470b37e43f72569b7079a4ff97df758478b77462834e730c38045424f2a479c912bf9772a19404b29d037169e4419f3b57735a31159aa376cc2
- TLSH T13751040A9509768FC0A345F6B9A6EC44AEA7F91103FCC66B20A54902134743CE7B9F9B
- MD5 SHA1 SHA512 TLSH
Include/C/VMProtectDDK.h
- SHA256 7e519283a40c4d35e08820b72a9fff46548d457babb755738d938caf29faa626
- MD5 564fbb3734769771f0aab4bafc92fee7
- SHA1 631794f6d847747a7061d8c0fdaa5e6bfd728463
- SHA512 938b71a039a658bb50b797fa3ef53740d3f6935f721c38ba41eb33f334be972ab46f084754509596ef1bb4f52e5b52ecf8bb4bfcbf1f6fd0a98ae2d12ccce786
- TLSH T19E71AB410D02306AE292D7F9577BDC5225ACF02335F2EDEF220620151BC354D6BAAAAF
- MD5 SHA1 SHA512 TLSH
Include/C/VMProtectSDK.h
- SHA256 b93a1e14de583cb25bff62d65528bc02e85843f3285e064176be644c28870ea6
- MD5 8001b2784aa913501afa1a1a5fdd4c2e
- SHA1 c7f69d642cf46b0bb5c7157695bbd8ca0e9ce978
- SHA512 1bd61c5b2b37fea56c032dc969717081c88a0f3a4aab522a468c661ef80a0541fcd4b26915fa91d05062387d33df68ed756a1721f27b49e74d336d3838b2287b
- TLSH T16F81AC010D01306AE292D6E56B7BDD5225ACF42335F2ECEF220665151AC344E6BEAA9F
- MD5 SHA1 SHA512 TLSH
Include/Go/VMProtectSDK.h
- SHA256 b93a1e14de583cb25bff62d65528bc02e85843f3285e064176be644c28870ea6
- MD5 8001b2784aa913501afa1a1a5fdd4c2e
- SHA1 c7f69d642cf46b0bb5c7157695bbd8ca0e9ce978
- SHA512 1bd61c5b2b37fea56c032dc969717081c88a0f3a4aab522a468c661ef80a0541fcd4b26915fa91d05062387d33df68ed756a1721f27b49e74d336d3838b2287b
- TLSH T16F81AC010D01306AE292D6E56B7BDD5225ACF42335F2ECEF220665151AC344E6BEAA9F
- MD5 SHA1 SHA512 TLSH
Include/Go/vmprotect.go
- SHA256 2ab9b45d7d5813e1148d6c2c9c4b53e67594c9bce07b6cec2958f6be657e8e13
- MD5 4203982fb56c98d396234e404bab30e1
- SHA1 06418f1739b05f4e5a53b094c3180fecd2335b6d
- SHA512 99f0c09c39b8942d6b95a2799c69cd25bff07c7dab36846e942966e84f48d3fdbe29fc4d83844d6240768cc25afe384032cb4c5e3ee50ce59addb55b641ab817
- TLSH T1B85123422693A10FD2E213552635FD907CC6F12246F3C1ABB1CC42E1B3BA1587F3C6AA
- MD5 SHA1 SHA512 TLSH
Include/Pascal/VMProtectSDK.pas
- SHA256 7fdde5994a455e3aae5c6193151621469b2e004db1b5fe9d2f5227482baa3e9f
- MD5 a47a3377214bc97ee401660b418c663d
- SHA1 5cee6f1acda64b47203858efcbdb66173748ab08
- SHA512 59223f99ec2ab37a076b5ee98e93d4d70e48fd32db6fc1cbf4f93971c2ee496fa489f8ec75247a979ac4b0e68f37976fdc5adb5790d74758a5dedfba1f270f95
- SSDEEP 192:x2SAj3zKKVlOuiI72qkMPWYKQZRIkkIkrIkfkAkHkDk4kpkgkhkokbkOkwkaknku:x2SAj3b+Fc6
- TLSH T133326D754A2174CE849A747F733FEC9A293552A0A0F1D5F7B102A7B18F8E058750BD8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Include/VB6/VMProtectSDK.bas
- SHA256 d2c1334fd893071b3b7e42d0817cbd37310c831af2af12ee1f94e8f654eff403
- MD5 30d0ac58f09ba02d81dde6ea9067b582
- SHA1 b97c402bb5e423d7e2bdc438bcfc4024b1d6a7d4
- SHA512 b06e099b109506716ce8d9c25f58d3af2b870510c1f3bc33c5d5cb5a356c626285e2b4e6503cebb5b4dd0276007552416b412854b115c01d9c6e795482d48ce2
- TLSH T1EC814999E6147C7AC8A5A1E83027DCEBBCEC529535B9D393603062CF0FA28CC67D4167
- MD5 SHA1 SHA512 TLSH
Langs/de.lng
- SHA256 5c56a15e90fcb124be61cc3ba06384016361023e56d35379f08395c1ef2eeac6
- MD5 7e20bccae3756a760ad009e5b446a568
- SHA1 636c7ae3d78d3c6ef4bbdd8fbad3ec771a58d078
- SHA512 a864b6d52a13fd8e4f56809535b2dabf1fceac2bb3ed375a013e02c09a319f47cd70a2ec5bc5a229fbd4247e2a66afd76b9dfea4691283560aa13698abda773b
- SSDEEP 192:UQmLI/xiNfj1J5CUGvJ1D4XRYIe9kZ4vPs52dzxLGk3HfVUH/EuULNP9sPRY1zex:r83IqhY7eZ2zxLGkPe6spvDXF
- TLSH T1DF3208150E08628FD3D32BB67540C86B37B4C36917B020A3088CE3E75B97D7D9B6E596
- MD5 SHA1 SHA512 SSDEEP TLSH
Langs/en.lng
- SHA256 30aa31e3198d7ba46117018990b84557e564df6f14ad3fa479f38f1f7209f701
- MD5 9e54393aae67e92b15775c84c59a9eeb
- SHA1 8aada06a259e35b3e5c1901c9932db130f37d53f
- SHA512 e01204e4ff51a0ac824aafee831f4efe02909246e21cf39bd8572f4f159bb71503d8dbf42df97d665a6c6d35f9fe04ec59c3dfeed99253073e83a8e86b245f90
- SSDEEP 192:TORjTHv17nwN71QIgWSiaDNVsJG1EDN6uXxjw2UkVH/bvohKVKeElDt7deAnaR70:C/Hi95SDDnsJG2DMSxjw2U0uuAnaR72h
- TLSH T10822C50D2704629715D301B7AB52CCA3A7B5825C6674020718ACE7A827E7D3CEBBBAD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Langs/fr.lng
- SHA256 b35d3bab6a63e8191340b9b18a5ed5e0eb86fe65f9dfe9d17696839a102314e3
- MD5 eee0c8e57a4d0a3dcfb1bcbf50e5b9b9
- SHA1 cb1d6cdf7ce3433a706f436e7cfd3770b01ebe11
- SHA512 f759b0c77e7392d2e7842372027bf174218b536d7e23d229bbab30b0f558c4b30711e826a3f28b4c372334a493af1453d13e9f910f1ba153e30fb0b0f5a60193
- SSDEEP 192:aj2o6S4kp87L1NG3Ck2dM0x10NZapGYx1MvvWmPyYNNtPAhcy+LVS9n2rfgiXl87:IT3b2+08TY1MGmPyYa+h4nIoiV80S5
- TLSH T1BD32B50EBA80614763D312F7B552D527A638C2547A19F2064CC8A7E863EFD3CD38F999
- MD5 SHA1 SHA512 SSDEEP TLSH
Langs/ru.lng
- SHA256 4672c6661f7ee9db43a485a31ad3070b73d90f3a344c2a61710fd93819515397
- MD5 180ea2002c6f9e6e84df1cf91afedf9d
- SHA1 88f5e301ec9bc1133b5adb4781443a58063ce8ec
- SHA512 8e22f9bb34aa15f9457f27a55a5a54a2c30c2b8bf4c8bc16665c95e2c4a62cb7305b44f25ad76812a3a6abe2444e58ddac66b720a9a5c4275dbdc58993f7535a
- SSDEEP 384:Fr2mIZLqvfh2Eu7Ebi0FxF71Ki4aRkjEPve4AN8V3rse92OQqa4k:Fr2P7SxFRRDz92OQz
- TLSH T18AA2F34FFAFC5114B5B6DA40AF3189D206EAB7102B19C0DD86CF2C5A1478AB477227E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Langs/zh.lng
- SHA256 39ff0ffe1532ed801b8ca99ebf8bc7566b2dd5b4b18645e2319c5da796b110c5
- MD5 de13bbcc687ad3762a073f102b99e95c
- SHA1 a3a721d5c610fe0ee5f6eb60ea6c97f291bbf2d4
- SHA512 a4bc69f4bc419008d4d86eef4ecf32ddd5c285fe18571c81d62a8bc99e2feec6471ad156a783b7aabe5851bcc826ef1be79d1ad304a80ed9a2ff18ec620649a4
- SSDEEP 384:ENm0bnMYC5qftk8ns3CMUitEJURa2RBaOzI/9XPZO:ENmUI4n8CMQiRdzI/9XPk
- TLSH T18A52540127FE6019F6F79F98EAB894564BBBBC261E1DC12D95C4404E18B1E808A777F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Android/libVMProtectARM64.so
- SHA256 9201bab5712017e8f1cf4c4b34395e83a0ea1561e36a52e0e38c94aaaab8e2c7
- MD5 ca726b187b446f0b4aea7eecd062d89e
- SHA1 42075f39c863b85fccf73cff49e36585f68b66f0
- SHA512 4616467bc8b09a3471a8e7061647ab36c5d6c596e796977774f15b234f131e07a1da96e58896ad30e57be5eadc84ed5990092f2f147fb21c268575f735624c10
- SSDEEP 96:V3yYajUYP+1UG3xgNkjGeLjXjW3K6oW9Q4bQ0js5N0GTOXUaIeD4suMeS8gZqlVo:VAPBUbjDjTaXV9Q0Z+8UMDUAkV
- TLSH T1B952635BE480EA3FC9D952B119978FF87372504CA3ABCBC3141A86516F4239F0E556CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Android/libVMProtectSDK32.so
- SHA256 3879bf9a4f991f94cf93e50314287121267e8f51434c8e27e4b64e3e2a99b231
- MD5 2260547fe25a796f3dd1662f266792db
- SHA1 0c16cf9fdaa508dc4d9d3ad2fb5a4b45de993454
- SHA512 2ed358df8e61eab2ec8f1bf8fbf3e506e340c697910c50904b94d901031aeb06ac11800d14499b1a351cd19d28b73870d8c6bc55bb546d383430b90486398216
- SSDEEP 192:1e0gg6cDwuIxX3Qgc2iGfQ1LL4Y/sBnV6UkcNrOog:19KZgg3gv4Y/sRopu
- TLSH T17052C843BA89AE75E9DA0274295FCF3CD630C4015177CB137628E7489E933CC710A6DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Android/libVMProtectSDK64.so
- SHA256 a96f93909f0ca6b9f789541335a410ca737ba94f5abda4d818dad57b7dee25f7
- MD5 60333672f9cf826737a6362b5c576445
- SHA1 f7e4fb2bc9fb41641ad4934765d28c7f74fd0b5f
- SHA512 5930fb88b0510838f9c5c7a17d22f3b263bc47de09ddd140df546b766254fb792b0739f9f3abb16aa71e517065b27aa3809b2eb06d62a97fef1f310d74097695
- SSDEEP 192:RXjQVpvNI9znNUzRAPWuhPCJDgbhALZhFsn:ljQGlNUtTJssh
- TLSH T1E052948BB581AA7ECAEA91B0D5ABCFB12375F8009321CF277150F7741D523885A079A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Linux/libVMProtectARM64.so
- SHA256 e90b4b562a2e3e95f152e3bf644046e9843949d40edf317e17f606ff8fc990d2
- MD5 0df8a3c1c6c70c4242eb861d314e136b
- SHA1 f94cfcb7ce4fd89fab1321ca72109c16d4520e5d
- SHA512 7c96e2259fbe79dcf652c2528b21e5fba21a9d121007c82b03d058d3584e351eb11c77479222e627404fda89223af3e1f3d9da016ab210ba185469dfed058e8d
- SSDEEP 192:yC8pLC9qo8jDjJrDkrLzC9bO0lmDzI8csiucifMe7wCf:0C94jDjVDkrLu90Dz5csvcl8L
- TLSH T1C292A60DE494ED3FCCC19375166B8F6473625408A3B6D743301A46653E833DEAF6AA8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Linux/libVMProtectSDK32.so
- SHA256 a14ba2eb8e3271a2b25705628e9534a9b9d26d9c58a6a25c8228eb83ed4b3c7e
- MD5 3d951ddd962005cf8ae21230eb243b38
- SHA1 87317c951460f9a3511da51865bd72f4c146b3b8
- SHA512 ae69da31b7b85199db855f920da07e5b48c66a75ce0b3100cbee2ac2c315b52d6805673d6c88f25314a5fb32b377fed8be5184e7f09cb874a42b476955f686a4
- SSDEEP 384:ku5I6kSYJhggtMmUgIDy33uXf47Pej/ro7fI1vK:ku5I69yftMZgIDyHW1K
- TLSH T11D72F982FF85B9BEC4C34274622BDF6D6430C8324971CF63AA2C93615E9339C2506B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Linux/libVMProtectSDK64.so
- SHA256 9c12f5bc6ae834c7f0751b9a16d32726c098af56cb1d12658419d7ee25835d85
- MD5 e96e2a69ed33376145c09c72bf46eb63
- SHA1 acbb90bc9e094323e55d9eac2281e42964d6b6f2
- SHA512 44e27dfed5374600e50de79dc3cc66a24f086027129e003440a62584a623a3de81da3422bdcacb1b2d2404cb6f883499b2ad7476b9299864a03e5b7165fe94b8
- SSDEEP 192:R028pLBEZhFclPNtrmAPk9/1QbDEVpll/eEYyHDX4O6LHLf5xHXcp6:26ZhFc7QtcsJJY689xJ
- TLSH T1BB82954BF582DD3EC9C2D374A61BCE6462B6F05057B2CF6371108B791E5278C2A1BA4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Net/VMProtect.SDK.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 45fe37b2620a1b5483756805034fe3af1295b5c059a772e6e5c361c92cb0ae96
- MD5 16e690b198fc88cbbecef2731007c656
- SHA1 8eb4fd5499e3105477fa250a51b927f4b4993612
- SHA512 6c35f29c508daada8a38c22095243d740df6a5915fac5cac87c4b3b630a6f72e085d503e5ea8fabdb57e737e5eea57ff3e2cf76d289f8b7a2ff2c74847cfa5b4
- SSDEEP 96:tbeBWY8lNW5lleUWbgjaJvbdI8cH4YJNSscbNVOz8RpFxrPOPXCr3c7qsLtFSVF:7Y8zWUUOgjSjR+JxzwFxrV88
- TLSH T1CB22B712B3E8A156F5FB67356D7211310BB7BA994A72CE3F148D010F0B37A546BA0B63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Lib/Windows/BCC64ELF/VMProtectSDK64.lib
- SHA256 140e8c6cab8594e4ce0b024a8fc4064b0bdb4c5e8a18f76290a123c612ed638d
- MD5 ed45b52471fa7475112c2f42db4af182
- SHA1 93b0cc98e88dd1838930a701add57a12f743233f
- SHA512 bd19fae8cddc2a2ce8d94c74f440f4e0593fc720bd4eb1dd9785209f59baf8a184440aed80bd0e33165d1b2d80823f0ed8f0f5f883c47abee32ee794ef91ac69
- TLSH T1676198189590392FC9EA91FA372BDDA86370A40901F5C757710E13A00F633CF6717A8B
- MD5 SHA1 SHA512 TLSH
Lib/Windows/MinGW/VMProtectSDK32.a
- SHA256 67d6b962f090e561ed26fabc3dde4b67ceef7e3d1988f24e64177f617c8c37f3
- MD5 dd4b1a89d7091268b58e244a2ccdc3a6
- SHA1 38f61d7609b5ee37d168b46c643eca07d4b668f5
- SHA512 11180041e06816c0699e1e338548fb9396b5f56a9c232cdb8624b6c746c22cda502ddfa322685328e31c93e569990749519feeff14c6b78b87cb0fb2e7ba42a9
- SSDEEP 192:cP6gR2mbkCjpJF5vsRmdMTNVz1j5OrLUJojcWkC03J2fgt7j:clR2K1uTS7y3
- TLSH T1D7B2B0B2B2526DDBD27240B99597EF15273CF0D159A7CB23332C65A00BE1D893EC2947
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Windows/MinGW/VMProtectSDK64.a
- SHA256 56b2750693a3d48edf1858563c3534a6e2a9520d3504bbb95c1be05460601db2
- MD5 3b6810aa95b4c4510633811726608b39
- SHA1 ebd8f1c5f2f1fdd40e48c90d11faad55998444dc
- SHA512 30f51d749709d962093bc0af95a77050f23228fd0212036446fae9eb4efdb455c60ee3006761931b5303318c607d31983aa874e9adcdf0eb9deb034217715477
- SSDEEP 192:KZ5Q2BAtKEmUYXlC4OqQUuI4vBxyQL1R8m8g7hJA:3A/
- TLSH T151B214B6F6A21C8BD67681BD5657EF25273CF0D20166CB23322C1A610F92E857FC1987
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Windows/OMF/VMProtectSDK32.lib
- SHA256 b97dca70e9c32cb36db0cc10c0249e66e9079f73bd2ad8d859310f97e5a20724
- MD5 69f0a43d904a4fe5685b1085b6be622d
- SHA1 0f4edcb1e253fabd0b7fb32b91254a33df2ea4ba
- SHA512 c7cf2f08acdd6ad1a17fdd2a8920cfbd470415365821df9a2dad9b29758dcbab8d49eef800d40ac9c33e6507b6b5cc931a0826e3f556448e9c0c4fe81a51c074
- TLSH T14781063A15503A6FC8D390FA2A6BCD9DF6B471951AF1C573A6A101EF0F7E08C3626447
- MD5 SHA1 SHA512 TLSH
Lib/Windows/VMProtectARM64.dll
- SHA256 8d4e2d63190e46aae14cbeb89b774b58f2a1514cd199070f66e8ec9471200e77
- MD5 e9f0ad9e1c13b1cc96a37fa42f0802f4
- SHA1 f488139055f4d57e6c0b61353479fa6fc978b756
- SHA512 aa417d5049daec5525c19e715740137eebdd8b18e8d4fe91768bf0dcacc0d06e480a5e71ce021f6b4e357d58d625489d768dcaff0455e0e00634c1be215d9be5
- SSDEEP 1536:AU+1J51mU+VWmfsLm0wTYJ6k+i+jpCJKQ/TvTsWH0dh0JpoSW:AU+1J/2WYKm0RJnFnTVeiJO
- TLSH T1E9B34C53A79D2807E1E2DB38F8674F50633FB93484248E4AB202425CDD97BC99F76D92
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Windows/VMProtectARM64.lib
- SHA256 82c0fbc28e2179ea0c8f9f22e3555f12d63b85827f9bcc884e707e77d2141085
- MD5 b6986bbc363ffb7a31755a08d65a3f03
- SHA1 1ead6cd90c6d0810e2be1bc429cb813983c138cb
- SHA512 aa39d5f7d568f94e7b4c93c6e162741bc1a4c52d30c4c01501cc41da9a3bfb0769a0cb5d26a8366a43e12cb8b20b9a0e87a5c709206ae88f33c2673e8477d882
- SSDEEP 48:qeQ0FT/k5RLRzRCRPB6cI156dc/sRcRU15T17RLRLIBrJcX43KNyAOoIKAI5/KwU:qeVk2B7c/o16rZ3KGK/KwMWBNdZ/+
- TLSH T16902433A9450BC2FD4DA94FA2B72DDA879BD040902F2C07B724D27D247B275F5683A47
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Windows/VMProtectDDK32.lib
- SHA256 4c2520c31e61fa6fc8c321139c29c99b1d956ab50dd30975766e8c7479c00771
- MD5 c2ba004268c2af6b66f8d69b8b5fca09
- SHA1 a6139e654cc8917389a3a2acf1e0d1a69f9a2732
- SHA512 d2285bf71bf4d4a008612684b098a0af268839adb26459373193c776ee92d0ee440a4926002737a79b933c4cc1292f89ff346800c8555aafbf5105f496eb0ad8
- SSDEEP 192:PKVlkYhMbEB2TzSd5G6DxXlotSdH2/SHioFkw9:PKVlkYhMo
- TLSH T11E12743AA822BD2FC5F6D8FAE6E7DC99317C344E00F1D423B01E12C157B94AD6696907
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Windows/VMProtectDDK32.sys
- SHA256 bd60bcbd18e6dd94daf16599b9925d21327cdd4f2d63d2cc6d6ec261b117b562
- MD5 801c3a81dac9a230e8c0b07e8296c375
- SHA1 b334f29ec37a95942702cd5c257f753507449f60
- SHA512 68415d3839b8ecd867034c119fff0643735a4742669fc9dd19bb95bfbec78abdef8915ea82e78c0a4466160deabac8adfc6d6d7afbafe34118b577768374f587
- TLSH T1617165099561B63FC49A80F93B7BDC2E30B0440243F5C2D3A71147662B523EF353AA8B
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectFunction
VMProtectFunctionMutation
VMProtectFunctionUltra
VMProtectFunctionUltraLockByKey
VMProtectFunctionVirtualization
VMProtectFunctionVirtualizationLockByKey
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=261, version=27054,
count=1, id=256, version=27054,
count=1, id=258, version=27054,
Lib/Windows/VMProtectDDK64.lib
- SHA256 d833d93966162426858a473c91484938ae380a9182993f5e98b048bae0724809
- MD5 a3edd3ac3699229375be6d487f1cd5b2
- SHA1 43b46caf20dddb6e1fcdad2b89ada38bc4da0106
- SHA512 96b1ef31750d0c85a8eeca0c65cfd5edc7932f52d1332f0300f0849cb0b94eb63e0f4aaee9b277c3175426b054f81fd2a4da04794840cd97899c5b2aaaf11809
- SSDEEP 48:qeQ0FZ/k5RLRzRCRPB6cI156dc/sRcRU15T1sRLRLIBrzX4PK7yAOFcKff5HK2tC:qezk2B7c/o1/r8PKfKRK2KVz7XQE
- TLSH T1E0023739A461BC2FC6EA90F66B73ECA87ABD040501F2D467344D2BD187B276E5243A07
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Windows/VMProtectDDK64.sys
- SHA256 9fe7f7a832fc44b658db3ec819c91f30f46fb264dbab0a29969e3336e0a03c63
- MD5 c9b49f24bcd57e8ccc11d44abc349f60
- SHA1 502a8173bb282b966de37631c230521c8f0cfe05
- SHA512 4d0bcefee483109a8efb1e382504d6a54f6dc60aeb9a709568df86d214fcf68b4cf627a82720cb5b24da6c4e29590c71ffaf9c8475f8ffdac393bcf3e8f80adb
- TLSH T1295142089451792FC49A90F93B6BDC693070040503F6C2D3AB2287A51F523DF227AE8B
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectFunction
VMProtectFunctionMutation
VMProtectFunctionUltra
VMProtectFunctionUltraLockByKey
VMProtectFunctionVirtualization
VMProtectFunctionVirtualizationLockByKey
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
512B
Virtual Size
118B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=261, version=27054,
count=1, id=256, version=27054,
count=1, id=258, version=27054,
Lib/Windows/VMProtectSDK32.dll
- IMPHASH 781c13f048d2bf6b139522decf232cb3
- SHA256 e874589579fea1eaf406ea3f5aa073752b404fdc8ea2b01f956252856cb4d3eb
- MD5 47b913d2515361f4360291856fddfc9c
- SHA1 686d90265de64b80f03c30cf25f52e42893a8022
- SHA512 c67226af8f2ea1e2c37fc23210049fefbf22a9277364d5f7f13b7581c891dad15434a9bf91d37a07a4490ed06acc2131cd1e8f8607b6ac75a70f9e72a7f29097
- SSDEEP 1536:1C7jQC2mCJP23AHO0z8XeT2aZhG1FfnyWU+XTJqPQMCZsWA4czcdWXSIDg+:mQC2mCJP7z8WtH4N/XhM8cCWXSIDg
- TLSH T109A36B1074D1C432E0BE19380475C5A14B3E7830EF65ADAF73581A7A9FB42D1AE36E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
8237
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStringTypeW
HeapAlloc
HeapFree
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectFunction
VMProtectFunctionMutation
VMProtectFunctionUltra
VMProtectFunctionUltraLockByKey
VMProtectFunctionVirtualization
VMProtectFunctionVirtualizationLockByKey
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=126, id=243, version=40116,
count=25, id=242, version=40116,
count=28, id=261, version=26706,
count=16, id=260, version=26706,
count=18, id=259, version=26706,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=89, id=1, productName=Unmarked objects,
count=2, id=261, version=27054,
count=1, id=256, version=27054,
count=1, id=255, version=27054,
count=1, id=258, version=27054,
Lib/Windows/VMProtectSDK32.lib
- SHA256 4842b380895ad3f2778478098118f53d99a0287c5fdf33d464316148ca057e47
- MD5 896e8d0aef20422a33132f9cef036bda
- SHA1 b609d8df558876150d72f9f58310eccaf75f1fd6
- SHA512 b04cf591de7c9b203315ec27b638b1f84ea8e0acb806e1d25952416e74c18c859f5f9ec0385f0bf97a62fefe5beff44b04e46b45b71a24f2e042868d3f4a7459
- SSDEEP 192:PsVlLYhT+s5iTbOFRKGvZ7t0x+F7qXOzKEZcUl:PsVlLYhTv
- TLSH T10212523B28227D2FC4F694FAF6A7DD99757C344A04F1E02370AE12C217BA49E6647907
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/Windows/VMProtectSDK64.dll
- IMPHASH 2fb0b2bfb0867e1887381b1def6e092e
- SHA256 7abfe7f485cdd1363775740077203665443335923b1a7acca146b9745338972d
- MD5 1eb9534a018d9b61ffdfe62a335f11f7
- SHA1 d01e6476dda1c43a1b80dc377259a09dafb0edf9
- SHA512 494a559f9b12cc8df04897189a60e394f8b4305dbcab3dc2764f96fab8a798d0141d184dd3a5f015b629eba7f93ee7e3908383c584415bea081b0791a2a4792e
- SSDEEP 3072:G/Z81EVEQMIRZj5mrUItNXJaHUdwkf4N:guEVEQMIRzZItWkw
- TLSH T1D4C35C5B73E540BBE173C639C9638A55D7B278110B749BAF07A402162F233D18E7AB72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
8804
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStringTypeW
HeapAlloc
HeapFree
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectFunction
VMProtectFunctionMutation
VMProtectFunctionUltra
VMProtectFunctionUltraLockByKey
VMProtectFunctionVirtualization
VMProtectFunctionVirtualizationLockByKey
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=241, version=40116,
count=126, id=243, version=40116,
count=14, id=242, version=40116,
count=29, id=261, version=26706,
count=15, id=260, version=26706,
count=8, id=259, version=26706,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=93, id=1, productName=Unmarked objects,
count=2, id=261, version=27054,
count=1, id=256, version=27054,
count=1, id=255, version=27054,
count=1, id=258, version=27054,
Lib/Windows/VMProtectSDK64.lib
- SHA256 5caf28059c4ff63167ead890f88469fa2a50084c77775b8d82b9695100c735a7
- MD5 817f2593cd0b74563cc96f13ec144109
- SHA1 f30177e67d33dbd04ce8aa01695dd7a35df4c745
- SHA512 ffa5ae92a578bb94c16878b1a20ef1342b7e7cf97c272459738681531218a72326831cbdecf3bc7d96eb54ecc180a66be9d8e464392efbb3ce30065a441a8ca5
- SSDEEP 48:qeQ0F3/k5RLRzRCRPB6cI156dc/sRcRU15T1tRLRLIBrgX4/K/yAO3gKff5nKXtG:qeBk2B7c/o1wrP/KtKFKX2d7LXsE
- TLSH T1BC02523DA5A07C3FC5EA91F66B62DDA87EBD040501F2D067318D2B82477661FA343A07
- MD5 SHA1 SHA512 SSDEEP TLSH
Lib/macOS/libVMProtectSDK.dylib
- SHA256 c75163b0febc55bc43589b84b0d865e90c76b34f03e0af1eb3c7c723e6862837
- MD5 1455494a33d9c338f4c3d31f18c546e2
- SHA1 d6ce976ec0bf69e0ba16a4da48388937a6d3ef7f
- SHA512 f9763d13769df091f046aa5b7f5e2cf2984af7f51dfca06549175b45df927fc8ceeae7cb2a79e78aa07242e7f63b3ae2a85c96cf70a80ee3f9e5d5733bff222c
- SSDEEP 768:NrVCnQJilSwZI2LB8S4Jab8pSl8QwLw58qMab8P56h2PGQ8vCo5V8Lab8:uSwTyKzl8C5FMKQ6SGx6AV6K
- TLSH T141F33B871B547836EEC990F112CFEFA3B933F2941AA2855771A1C4F41F51BB8392981E
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect.exe
- IMPHASH 64663a853eead00c70a1aaa228bfc7cb
- SHA256 7a5c1008ee18bade0c10a70507951e483fbe1606c4c7447753fe8fc32cd50d8f
- MD5 04d3d46691adf8e4bbda1b1146f5d6b7
- SHA1 17dca85228df065d798add8dac36b388dc34f953
- SHA512 9f095f058ab7354c8a0b8fae8e100d11c3f3efb404656d3be97ea8c835dd2aba7a9b1803c021972954ba302c85ef70916502dcf04a7ecd6c091af905be3cb177
- SSDEEP 786432:SnyE4XSkvjMFBmSTFNhjEy0LogfUNR97fjeH6lCDpXDiRgz6ziG7voS:SyE4XSejMFBL3FEtUgcnBeJDpXuR86zP
- TLSH T1879723961894467EC4C8C23AD15F0AFAE1C97D79CCB7480BBFC669012E36957CCF6622
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8f:48:96:98:36:3f:29:22:3a:ad:f5:94:5d:98:f0:da:ac:41:86:79:af:9c:c3:6b:fb:8d:1f:3c:13:af:33:01
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovsk Oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
Chains
Jul 20, 2026
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovsk Oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovsk Oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovsk Oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
Serial Number
36:3f:37:1c:99:bc:67:2c:9c:da:7d:2e
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 1, 2026 - Jul 18, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
2
Major OS version
5
Entry point
83474502
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
winmm
PlaySoundW
imm32
ImmReleaseContext
opengl32
glDepthRange
ws2_32
WSAAsyncSelect
kernel32
GetSystemTime
user32
MessageBeep
gdi32
RemoveFontMemResourceEx
advapi32
CryptGenKey
shell32
SHGetFolderPathW
ole32
OleSetClipboard
oleaut32
SysAllocString
psapi
GetModuleFileNameExW
Name
.text
Size
Virtual Size
11.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
20.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
570KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.qtmetad
Size
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.{B0
Size
Virtual Size
19.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.N%C
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.&LM
Size
39.9MB
Virtual Size
39.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
339KB
Virtual Size
338KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
VMProtect_Con.exe
- IMPHASH 78de5d4bedefb8fb9ca17c2d5d4c26a2
- SHA256 1747138391b94f57cd9b98ef0da7290e0a5a8ef220b6ea83ad0e2d6dfde1852c
- MD5 31e164d4d7d6a76073bc970af9508abd
- SHA1 72a9cea87836cb81db5cbf6c0311e2ca169b8990
- SHA512 8cb5f3740665a2c85c9a2d1d0d5a989a23968567533747698435cf62cfb2cf55f269f41fa3c5157b3b80e3ba6d4de0de4c7816abcd19400288cbcc9807ceb015
- SSDEEP 786432:oIkCJrQxAB6t7CMUnbezEldN4G1bPnrNI0ulosFB:OCJrO+6RCMUnl42bvxI0uloQ
- TLSH T11077229A68E491DDCB04C970E60549ECF0DE7C898CBE482ABF876901AA35D57CCF5D32
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
41:4c:02:84:c8:10:29:84:20:e3:35:8e:9c:3a:ff:91:34:72:3b:6e:b1:8e:e8:47:44:88:97:69:6e:9a:fd:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovsk Oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
Chains
Jul 20, 2026
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovsk Oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovsk Oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovsk Oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
Serial Number
36:3f:37:1c:99:bc:67:2c:9c:da:7d:2e
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 1, 2026 - Jul 18, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
2
Major OS version
5
Entry point
57267375
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetVersionExW
ole32
CoCreateInstance
shell32
CommandLineToArgvW
Name
.text
Size
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
16.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.~Y]
Size
Virtual Size
18.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.gvt
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
."1*
Size
33.9MB
Virtual Size
33.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
339KB
Virtual Size
338KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
unins000.dat
- SHA256 ed233a8bed495406b4627becaff50ef2fb62a980400bc1f167189f4d801eda92
- MD5 5ded810a8e61197bbb5bec8660414db0
- SHA1 6742849e354d6bc31e414aceb388c961a26a5868
- SHA512 c78bb88513f43f3a6a29fefe70ecacf9abd49928e3d8ee18ab4fbd743c7e5952982c6fb1b972a223fe5605248fa5ce0f076e5f43cc41b554e3e6494af1d2164b
- SSDEEP 384:mT9BbPIsuG6WFpR/n1n4n5nKQY4pxF5uSWSFDfz4XbkAnn7P787M7T7pTninZnX7:mJBbwG6WFX145KEuwzvI5zE
- TLSH T1E4630B5073F87664FBFB2E792FB906605E3778215F11E50E1594828E0929F9ACE24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
unins000.exe
- IMPHASH f62b90e31eca404f228fcf7068b00f31
- SHA256 dc906edae1b80bdbc2d5e324d6fec654051751ef807c0cefce758a51fd139d37
- MD5 dc113da1266bac11d533f07ee7db23be
- SHA1 fa67fafa52f2b9b803784cf3812bc340041cf92b
- SHA512 be24c79ffa1132422cab0434bb38f5ebf58031559a55be8974f2b0fe9ed2dc9109470b02ce517a20bcef92187ccd0f63872a2cf316f2f51676e61f04ec287f02
- SSDEEP 24576:cKbqslNoiGO+h84C6f8HSCNFfoJMpNOErZTOzu5xTxyte:zwY6fULNntNXd
- TLSH T1E4451822A3E68437E5732E759D6BC2945C267D202E74E44E7EF88E0C4E79B40BD35392
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1048580
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
GetErrorInfo
GetActiveObject
RegisterTypeLib
LoadTypeLib
SysFreeString
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
SysFreeString
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
InitializeSecurityDescriptor
GetUserNameW
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
AdjustTokenPrivileges
user32
GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
WindowFromPoint
WaitMessage
WaitForInputIdle
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRectEmpty
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongW
SetCapture
SetActiveWindow
SendNotifyMessageW
SendMessageTimeoutW
SendMessageA
SendMessageW
ScrollWindowEx
ScrollWindow
ScreenToClient
ReplyMessage
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PtInRect
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OffsetRect
OemToCharBuffA
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageA
IsDialogMessageW
IsChild
InvalidateRect
IntersectRect
InsertMenuItemW
InsertMenuW
InflateRect
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageW
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClientRect
GetClassLongW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
ExitWindowsEx
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CharUpperBuffW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BringWindowToTop
BeginPaint
AppendMenuW
CharToOemBuffA
AdjustWindowRectEx
ActivateKeyboardLayout
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
SetCurrentDirectoryW
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCurrentDirectoryW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringW
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
lstrcpyW
lstrcmpW
WriteProfileStringW
WritePrivateProfileStringW
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualFree
VirtualAlloc
TransactNamedPipe
TerminateProcess
SwitchToThread
SizeofResource
SignalObjectAndWait
SetThreadLocale
SetNamedPipeHandleState
SetLastError
SetFileTime
SetFilePointer
SetFileAttributesW
SetEvent
SetErrorMode
SetEndOfFile
SetCurrentDirectoryW
ResumeThread
ResetEvent
RemoveDirectoryW
ReleaseMutex
ReadFile
QueryPerformanceCounter
OpenProcess
OpenMutexW
MultiByteToWideChar
MulDiv
MoveFileExW
MoveFileW
LockResource
LocalFree
LocalFileTimeToFileTime
LoadResource
LoadLibraryExW
LoadLibraryW
LeaveCriticalSection
IsDBCSLeadByte
IsBadWritePtr
InitializeCriticalSection
GlobalFindAtomW
GlobalDeleteAtom
GlobalAddAtomW
GetWindowsDirectoryW
GetVersionExW
GetVersion
GetUserDefaultLangID
GetTickCount
GetThreadLocale
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryW
GetStdHandle
GetShortPathNameW
GetProfileStringW
GetProcAddress
GetPrivateProfileStringW
GetOverlappedResult
GetModuleHandleW
GetModuleFileNameW
GetLogicalDrives
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeThread
GetExitCodeProcess
GetEnvironmentVariableW
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetComputerNameW
GetCommandLineW
GetCPInfo
FreeResource
InterlockedIncrement
InterlockedExchangeAdd
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FlushFileBuffers
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
EnumCalendarInfoW
EnterCriticalSection
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreateNamedPipeW
CreateMutexW
CreateFileW
CreateEventW
CreateDirectoryW
CopyFileW
CompareStringW
CompareFileTime
CloseHandle
Sleep
msimg32
AlphaBlend
gdi32
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RoundRect
RestoreDC
RemoveFontResourceW
Rectangle
RectVisible
RealizePalette
Polyline
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
LineDDA
IntersectClipRect
GetWindowOrgEx
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectW
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
FrameRgn
ExtTextOutW
ExtFloodFill
ExcludeClipRect
EnumFontsW
Ellipse
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
Chord
BitBlt
Arc
AddFontResourceW
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
mpr
WNetOpenEnumW
WNetGetUniversalNameW
WNetGetConnectionW
WNetEnumResourceW
WNetCloseEnum
comctl32
InitCommonControls
InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControls
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CLSIDFromProgID
CLSIDFromString
StringFromCLSID
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize
CoInitialize
IsEqualGUID
CoDisconnectObject
shell32
ShellExecuteExW
ShellExecuteW
SHGetFileInfoW
ExtractIconW
SHGetPathFromIDListW
SHGetMalloc
SHChangeNotify
SHBrowseForFolderW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
Name
.text
Size
1015KB
Virtual Size
1014KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
60B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ