fnaf-world-ultra.7z
- SHA256 88aa95762a6d0d88fd815783f58b14e8fd340c8877142c366a23adc54eb57e15
Overview
overview
3Static
static
3Fnaf World Ultra.exe
windows10-2004-x64
3Fnaf World Ultra.exe
windows11-ltsc_2024-x64
3Modules/Android.dll
windows10-2004-x64
3Modules/Android.dll
windows11-ltsc_2024-x64
3Modules/DRPC.dll
windows10-2004-x64
3Modules/DRPC.dll
windows11-ltsc_2024-x64
3Modules/Fo...er.dll
windows10-2004-x64
3Modules/Fo...er.dll
windows11-ltsc_2024-x64
3Modules/InAndOut.dll
windows10-2004-x64
3Modules/InAndOut.dll
windows11-ltsc_2024-x64
3Modules/KcCursor.dll
windows10-2004-x64
3Modules/KcCursor.dll
windows11-ltsc_2024-x64
3Modules/Layer.dll
windows10-2004-x64
3Modules/Layer.dll
windows11-ltsc_2024-x64
3Modules/Mu...ch.dll
windows10-2004-x64
3Modules/Mu...ch.dll
windows11-ltsc_2024-x64
3Modules/aviflt.dll
windows10-2004-x64
3Modules/aviflt.dll
windows11-ltsc_2024-x64
3Modules/bmpflt.dll
windows10-2004-x64
3Modules/bmpflt.dll
windows11-ltsc_2024-x64
3Modules/cctrans.dll
windows10-2004-x64
3Modules/cctrans.dll
windows11-ltsc_2024-x64
3Modules/cl...ar.dll
windows10-2004-x64
3Modules/cl...ar.dll
windows11-ltsc_2024-x64
3Modules/fliflt.dll
windows10-2004-x64
3Modules/fliflt.dll
windows11-ltsc_2024-x64
3Modules/fontembed.dll
windows10-2004-x64
3Modules/fontembed.dll
windows11-ltsc_2024-x64
3Modules/gifflt.dll
windows10-2004-x64
3Modules/gifflt.dll
windows11-ltsc_2024-x64
3Modules/jpgflt.dll
windows10-2004-x64
3Modules/jpgflt.dll
windows11-ltsc_2024-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Fnaf World Ultra.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fnaf World Ultra.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Modules/Android.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Modules/Android.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
Modules/DRPC.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Modules/DRPC.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
Modules/FontPacker.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
Modules/FontPacker.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
Modules/InAndOut.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
Modules/InAndOut.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
Modules/KcCursor.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
Modules/KcCursor.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
Modules/Layer.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
Modules/Layer.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
Modules/MultipleTouch.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
Modules/MultipleTouch.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
Modules/aviflt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
Modules/aviflt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
Modules/bmpflt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
Modules/bmpflt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
Modules/cctrans.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
Modules/cctrans.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
Modules/clickteam-circular.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
Modules/clickteam-circular.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
Modules/fliflt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
Modules/fliflt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
Modules/fontembed.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
Modules/fontembed.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
Modules/gifflt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
Modules/gifflt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
Modules/jpgflt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
Modules/jpgflt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target fnaf-world-ultra.7z
- Size 436.3MB
- Sample261011-krdddaywbs
- SHA256 88aa95762a6d0d88fd815783f58b14e8fd340c8877142c366a23adc54eb57e15
- MD5 5b3c9b9cfd077b85fc4c2511b1822401
- SHA1 af3b362c09cfec2825f4cf77a95b6576f40cb5fe
- SHA512 b0479ce6d627298db5237a208450d514157456fae8b7c85ece61ad8c4eca31ac2f1666f91cc45a83869237c859a0d70728fb363d5f6fec18f375ca4149275a53
- SSDEEP 12582912:bbiUlRUuFf2n4Dysykp+YtkQcV/PqfHN5JTngXD/JO:fbpZu4eIvkQ6EHP5L
- TLSH T13029331416405EE6852B164E43CE2453F8B4ADAC99868DF77F8E44D83ADF73B392C18B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 5 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/Modules/Layer.mfx unpack001/Modules/cctrans.dll unpack001/Modules/mmf2d3d8.dll unpack001/Modules/mmf2d3d9.dll unpack001/Modules/mmfs2.dll - Unsigned PE 26 IoCs
Checks for missing Authenticode signature.
resource unpack001/Fnaf World Ultra.exe unpack001/Modules/Android.mfx unpack001/Modules/DRPC.mfx unpack001/Modules/FontPacker.mfx unpack001/Modules/InAndOut.mvx unpack001/Modules/KcCursor.mfx unpack001/Modules/MultipleTouch.mfx unpack001/Modules/aviflt.ift unpack001/Modules/bmpflt.ift unpack001/Modules/clickteam-circular.mvx unpack001/Modules/fliflt.ift unpack001/Modules/fontembed.mfx unpack001/Modules/gifflt.ift unpack001/Modules/jpgflt.ift unpack001/Modules/kcini.mfx unpack001/Modules/kclist.mfx unpack001/Modules/kcpict.mfx unpack001/Modules/kcwctrl.mfx unpack001/Modules/mp3flt.sft unpack001/Modules/oggflt.sft unpack001/Modules/pcxflt.ift unpack001/Modules/pinball.mvx unpack001/Modules/pngflt.ift unpack001/Modules/tgaflt.ift unpack001/Modules/ultimatefullscreen.mfx unpack001/Modules/waveFlt.sft
File Explorer
-
fnaf-world-ultra.7z.7z 436.3MB
-
Fnaf World Ultra.dat595.1MB
-
Fnaf World Ultra.exe.exe 939KB
-
Modules/Android.json18KB
-
Modules/Android.mfx.dll 129KB
-
Modules/DRPC.mfx.dll 865KB
-
Modules/FontPacker.mfx.dll 336KB
-
Modules/InAndOut.mvx.dll 68KB
-
Modules/KcCursor.mfx.dll 36KB
-
Modules/Layer.mfx.dll 140KB
-
Modules/MultipleTouch.mfx.dll 48KB
-
Modules/aviflt.ift.dll 24KB
-
Modules/bmpflt.ift.dll 24KB
-
Modules/cctrans.dll.dll 141KB
-
Modules/clickteam-circular.mvx.dll 28KB
-
Modules/fliflt.ift.dll 28KB
-
Modules/fontembed.mfx.dll 15KB
-
Modules/gifflt.ift.dll 28KB
-
Modules/jpgflt.ift.dll 96KB
-
Modules/kcini.mfx.dll 114KB
-
Modules/kclist.mfx.dll 32KB
-
Modules/kcpict.mfx.dll 24KB
-
Modules/kcwctrl.mfx.dll 79KB
-
Modules/mmf2d3d8.dll.dll 446KB
-
Modules/mmf2d3d9.dll.dll 1.1MB
-
Modules/mmfs2.dll.dll 510KB
-
Modules/mp3flt.sft.dll 24KB
-
Modules/oggflt.sft.dll 130KB
-
Modules/pcxflt.ift.dll 24KB
-
Modules/pinball.mvx.dll 68KB
-
Modules/pngflt.ift.dll 288KB
-
Modules/tgaflt.ift.dll 24KB
-
Modules/ultimatefullscreen.mfx.dll 73KB
-
Modules/waveFlt.sft.dll 8KB
Fnaf World Ultra.dat
- SHA256 8eb8557a1d386e9ba97db3e71371c8ee10ce89b6a33be814f6ca05b5a05a6d04
- MD5 7f6789bb690720c6d745bb8c06410e24
- SHA1 dcec55aeeb79e01f6fae0e5747de6d29df7e4963
- SHA512 388f4d18946469000ca086202cd84e879366f62369a7029b41227fcc9c96e25a0e6b886e2477750ebc7700c16d5c934f2ca7f8536f0718fb187daf9cca47ef2a
- SSDEEP 6291456:74uQYzx8KLQhFBlYNQXBqTn/fdobYWoSrOxhJXI0AurRxbkm2Zo1k:74uBz+tJXBQLpp14ORVkmEo1k
- TLSH T1FA592350C3C68533D7B1B9BBC9E708FB816E7E516257600F96907D0DBCB6A38A9123B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Fnaf World Ultra.exe
- IMPHASH 1c4661ad7d3fc8350c55edf0f712d992
- SHA256 f09a9397c3316c4443712bc36891b80ce42845f9065b9b1f1b1f32efc0741ae9
- MD5 1e2377a280ab310b0afc69698efff8c6
- SHA1 d51506ce067a5bdddca672794dd7cc5ebe845679
- SHA512 81dcbe30d58e35d177078f5cd206417421ba1622745e4429a33e26b49d7d5febbace2eae891197e5776300dbd4ddf73a11333157e34025aefb45560b47266d4e
- SSDEEP 12288:eacp1LPvpmdRi9HWd+OD07TecFVnScX3FW02JhZIdXhVbd8vSSn8/:eF1LCp0hxW02JhZId2PY
- TLSH T1E7152973E47560ADFAE508349378C976243D98189B6D02D38EC0AEFE7C60DC5AD3A563
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
399595
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ord17
winmm
timeBeginPeriod
joyGetDevCapsW
joyGetPosEx
timeEndPeriod
kernel32
WideCharToMultiByte
GlobalAddAtomW
GlobalDeleteAtom
lstrlenW
GetCommandLineW
GetExitCodeProcess
GlobalAlloc
GlobalLock
GlobalUnlock
SetErrorMode
GetCurrentDirectoryW
GlobalFree
LoadLibraryW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindNextFileA
FindFirstFileExA
DecodePointer
GetFileType
GetProcessHeap
LCMapStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetOEMCP
IsValidCodePage
GetStringTypeW
GetCPInfo
HeapFree
HeapReAlloc
HeapAlloc
GetStdHandle
MultiByteToWideChar
GetModuleHandleExW
ExitProcess
SetEnvironmentVariableW
DeleteFileW
HeapSize
GetACP
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RtlUnwind
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryExA
GetModuleHandleW
VirtualQuery
VirtualProtect
GetSystemInfo
RaiseException
SetCurrentDirectoryW
FindNextFileW
CreateMutexW
WriteFile
GetModuleFileNameW
Sleep
ReleaseMutex
WaitForSingleObject
FindClose
FindFirstFileW
CloseHandle
SetFilePointer
GetLastError
ReadFile
CreateFileW
CreateDirectoryW
GetTempFileNameW
GetTempPathW
WriteConsoleW
RemoveDirectoryW
GetVersionExW
GetLocaleInfoW
FreeLibrary
GetProcAddress
LoadLibraryExW
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
GetModuleFileNameA
user32
OffsetRect
DestroyWindow
PostQuitMessage
DrawTextW
FillRect
GetUpdateRect
DefMDIChildProcW
EndPaint
BeginPaint
InflateRect
GetClassNameW
GetDlgItemTextW
SendDlgItemMessageW
EndDialog
GetDlgItem
SetDlgItemTextW
DrawEdge
MapVirtualKeyW
GetInputState
DrawMenuBar
SetMenuInfo
DestroyMenu
LoadMenuIndirectW
GetMenuItemCount
SetWindowPlacement
GetWindowPlacement
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetDesktopWindow
GetSystemMenu
UpdateWindow
GetWindow
RegisterClassW
GetTabbedTextExtentW
ModifyMenuW
GetMenuStringW
DialogBoxIndirectParamW
GetMenuItemID
RegisterClassExW
LoadImageW
LoadIconW
GetMonitorInfoW
MonitorFromWindow
GetSystemMetrics
RedrawWindow
IsIconic
IsDialogMessageW
SetTimer
GetClipboardData
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
IsClipboardFormatAvailable
CheckMenuItem
EnableMenuItem
GetMenu
PtInRect
PostMessageW
InvalidateRect
SetFocus
GetFocus
CallWindowProcW
RemovePropW
SetPropW
SetWindowLongW
GetPropW
MessageBoxW
GetParent
GetActiveWindow
ShowCursor
SetCapture
ReleaseCapture
GetKeyState
GetWindowRect
GetWindowDC
SetCursorPos
ClientToScreen
ScreenToClient
GetCursorPos
LoadStringW
MapWindowPoints
SetWindowPos
IsZoomed
GetWindowLongW
AdjustWindowRectEx
SendMessageW
LockWindowUpdate
ShowWindow
IsWindowVisible
GetClientRect
SetWindowTextW
wsprintfW
IntersectRect
KillTimer
DestroyIcon
GetSubMenu
DeleteMenu
GetMenuState
LoadCursorW
SetCursor
SystemParametersInfoW
GetSysColor
ReleaseDC
CreateIconIndirect
GetDC
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
TranslateMDISysAccel
GetMessageW
PeekMessageW
DialogBoxParamW
gdi32
CreatePalette
SelectPalette
RealizePalette
EnumFontFamiliesExW
GetStockObject
SelectObject
GetTextExtentPointW
GetDeviceCaps
GetObjectW
CreateFontIndirectW
DeleteObject
CreatePen
Rectangle
LineTo
SetBkColor
ExtTextOutW
SetTextColor
SetBkMode
CreateRectRgn
GetClipRgn
ExcludeClipRect
SelectClipRgn
SetDIBits
CreateCompatibleBitmap
CreateSolidBrush
CreateBitmap
comdlg32
GetSaveFileNameW
GetOpenFileNameW
shell32
DragFinish
DragQueryFileW
ShellExecuteExW
DragAcceptFiles
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
Name
.text
Size
521KB
Virtual Size
520KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
289KB
Virtual Size
288KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=241, version=40116,
count=139, id=243, version=40116,
count=35, id=242, version=40116,
count=20, id=259, version=26706,
count=20, id=260, version=26706,
count=43, id=261, version=26706,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=618, id=1, productName=Unmarked objects,
count=43, id=265, version=27049,
count=1, id=256, version=27049,
count=1, id=255, version=27049,
count=1, id=258, version=27049,
Modules/Android.json
- SHA256 9f75821b82108de4531deb5ae5a9cdd0895ac46e7a44662f5796b2c6dafca3c0
- MD5 bcb41e6b9bbce7210b41b6c062949712
- SHA1 15b4ae548a9ed81e3c9ccf7150aa5fa6f9504b64
- SHA512 82733844360df381c73373ab6a2e7d50d94585148ac892f9bbcf574eedbfd471beb49c111ff91407e3c10d8c80936fef4be6221403afca0485bbbcb915dbfea5
- SSDEEP 192:6Xl/sN2xY94CnXvztwmyZj96r1hr2d22iLXlITkaGkmu5QqEeeTJ1Z:6X1sAK9VzemGMJhKDRGa0J1Z
- TLSH T10B823D36CEB61C2A01BB73306D5A964BFB24076FA148584F767C600C0FBBC578799A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Modules/Android.mfx
- IMPHASH a8719d7d584e2f0457c461b24a4a2fba
- SHA256 69369bfc2772841e292b79d9c17ba3f855a4dc0652a61e4ec71f29d1c1b4e044
- MD5 f77d2502f0e60c9bab9470c0e4a1a127
- SHA1 557b146a5ba0b7b09ef85c9461ab0faa34fddf46
- SHA512 a190ec98d35c910a79cff84829558ce88530af05460f8cc53abbc36d6f227a61259908d01c0d1fadf0bda336a59f1cc3cc9ab8d5f2f4690425b39d68a558ebee
- SSDEEP 3072:UbOHpWCmObGPFt/zSipM+cRhexZ3ITKR:2OH1mgG9t/3pMo4KR
- TLSH T198D3692236D0D071D4BE063D19248A264B7EBE72DAB49C47B79C5A4D5F742C0EF26B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
28684
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LockResource
FreeLibrary
LoadResource
SizeofResource
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
GetFileAttributesW
MultiByteToWideChar
WriteConsoleW
CreateFileW
GetConsoleCP
FlushFileBuffers
SetStdHandle
GetStringTypeW
HeapReAlloc
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetLastError
HeapFree
HeapAlloc
ReadFile
GetCommandLineA
GetCurrentThreadId
GetStdHandle
WriteFile
IsProcessorFeaturePresent
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetProcAddress
HeapSize
Sleep
IsDebuggerPresent
SetLastError
InterlockedIncrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GetConsoleMode
ReadConsoleW
SetFilePointer
SetFilePointerEx
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
OutputDebugStringW
LoadLibraryW
LCMapStringW
SetEndOfFile
user32
MessageBoxW
MessageBoxA
AppendMenuW
CreatePopupMenu
CreateMenu
LoadStringW
ContinueRunObject
CreateFromFile
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
DuplicateObject
EditDebugItem
EditObject
EditParameter
EditProp
EditorDisplay
EndApp
EndFrame
Free
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetDebugItem
GetDebugTree
GetDependencies
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionParam
GetExpressionString
GetExpressionTitle
GetFilters
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetParameterString
GetPropCheck
GetPropCreateParam
GetPropValue
GetProperties
GetRunObjectDataSize
GetRunObjectInfos
GetTextAlignment
GetTextCaps
GetTextClr
GetTextFont
HandleRunObject
InitParameter
Initialize
IsPropEnabled
IsTransparent
LoadObject
LoadRunObject
MakeIconEx
PauseRunObject
PrepareFlexBuild
PrepareToWriteObject
PutObject
ReleasePropCreateParam
ReleaseProperties
RemoveObject
SaveRunObject
SetPropCheck
SetPropValue
SetTextAlignment
SetTextClr
SetTextFont
StartApp
StartFrame
UnloadObject
UpdateEditStructure
UpdateFileNames
UsesFile
Name
.text
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=205, version=50929,
count=133, id=206, version=50929,
count=49, id=207, version=50929,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=98, id=1, productName=Unmarked objects,
count=12, id=207, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=206, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Modules/DRPC.mfx
- IMPHASH a8d217c89c35ecd6bcf235c9dbeaa1de
- SHA256 48d5e7246d3e0b2e1da65f5307a1c920e56d372cb2fb112db70ce51d87afeceb
- MD5 eed9557c1f52908027e672a4e1c2282d
- SHA1 3a9bfc8f04638ff0eab599f5b1e14b3eeb25bb8f
- SHA512 47662c59ace0d416b0aba032cfc84ae10f903fc83338bdb1214204cdf0097888110ad5040336d691c4896a0c1f1fc4bc72ecda2c9de14382e08928b79727b069
- SSDEEP 24576:vnTIrjNZMHz1JOYti/T7N345ivEilDrhJ35MI2v+G:vnTIXNZMHz1JOYU545ibf7P2+G
- TLSH T1B6159D213D85C033CB6F31304C28F76796BEA9720E329ADB779C267E2F70582A625557
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
199421
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Backup\edif\MFX\Data\Runtime\Unicode\DRPC_Full.pdb
kernel32
SetEvent
GetFileAttributesW
DebugBreak
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
CreateEventW
LockResource
SizeofResource
FindResourceW
CreateDirectoryW
FindClose
FindFirstFileW
FindNextFileW
CopyFileW
CreateThread
WaitForSingleObject
OutputDebugStringA
WideCharToMultiByte
LoadResource
MultiByteToWideChar
WriteConsoleW
lstrlenW
CreateFileW
ReadFile
WriteFile
CloseHandle
GetLastError
PeekNamedPipe
WaitNamedPipeW
GetCurrentProcessId
FormatMessageA
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
LocalFree
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
SetProcessAffinityMask
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
WaitForMultipleObjectsEx
LoadLibraryW
RaiseException
RtlUnwind
HeapSize
ExitThread
ResumeThread
GetModuleHandleExW
ExitProcess
HeapAlloc
HeapFree
GetProcessHeap
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
SetConsoleCtrlHandler
GetFileSizeEx
HeapReAlloc
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FlushFileBuffers
GetConsoleOutputCP
SetStdHandle
SetEndOfFile
RtlCaptureStackBackTrace
user32
CreateMenu
LoadStringW
MessageBoxA
CreatePopupMenu
AppendMenuW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
ContinueRunObject
CreateFromFile
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
DuplicateObject
EditDebugItem
EditObject
EditParameter
EditProp
EditorDisplay
EndApp
EndFrame
Free
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetDebugItem
GetDebugTree
GetDependencies
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionParam
GetExpressionString
GetExpressionTitle
GetFilters
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetParameterString
GetPropCheck
GetPropCreateParam
GetPropValue
GetProperties
GetRunObjectDataSize
GetRunObjectInfos
GetTextAlignment
GetTextCaps
GetTextClr
GetTextFont
HandleRunObject
InitParameter
Initialize
IsPropEnabled
IsTransparent
LoadObject
LoadRunObject
MakeIconEx
PauseRunObject
PrepareFlexBuild
PrepareToWriteObject
PutObject
ReleasePropCreateParam
ReleaseProperties
RemoveObject
SaveRunObject
SetPropCheck
SetPropValue
SetTextAlignment
SetTextClr
SetTextFont
StartApp
StartFrame
UnloadObject
UpdateEditStructure
UpdateFileNames
UsesFile
Name
.text
Size
669KB
Virtual Size
669KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
131KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=259, version=27412,
count=177, id=261, version=27412,
count=26, id=260, version=27412,
count=16, id=260, version=28920,
count=25, id=259, version=28920,
count=138, id=261, version=28920,
count=5, id=261, version=25019,
count=7, id=257, version=27412,
count=152, id=1, productName=Unmarked objects,
count=22, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=260, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=256, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
Modules/FontPacker.mfx
- IMPHASH 76f45860d23d8f7c04b07e2c626700d4
- SHA256 b8a015a6ed17ab139af609499b2698bf4a1209fcf0c6627959d84684c175d5bb
- MD5 5b67c71f84089cd352cfb73a3ddcbca5
- SHA1 188a1420a5575903757f3dfd427c66b37802d911
- SHA512 317f660db33d2470ffc13fae29e0beb4aec76fc069fd1e4e0869746a9b8ef4b33511ce2750dae7c1863ff6656cdedd82c8dad8188ac6123e4aa2815519669160
- SSDEEP 6144:3cun79OAqLEB4e4s+Wx8+nTZBfkOxVp1n0LiV47zSU:3cu5eEB4e0We+TZB5Vp10o4qU
- TLSH T13F748D11B9C08031C27B38345978E6B22EADB8312D74DB8F5798097A5F74591FA39B2F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
14981
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
G:\mmf2_refresh_unicode\cf25exts\FontPacker\Obj\Run_Only_Unicode\FontPacker.pdb
kernel32
OutputDebugStringA
DecodePointer
SetEndOfFile
OutputDebugStringW
WaitForSingleObjectEx
GlobalAlloc
GetWindowsDirectoryW
GetFileAttributesW
FormatMessageW
HeapReAlloc
HeapSize
WriteConsoleW
FlushFileBuffers
SetStdHandle
CreateFileW
SetConsoleCtrlHandler
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ReadFile
MultiByteToWideChar
GetACP
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
WideCharToMultiByte
GetCurrentThread
HeapAlloc
HeapFree
GetStdHandle
GetFileType
CloseHandle
GetConsoleMode
ReadConsoleW
SetFilePointerEx
WriteFile
GetConsoleCP
GetCPInfo
GetStringTypeW
IsValidCodePage
GetOEMCP
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetProcessHeap
CreateThread
user32
MessageBoxW
GetPropW
wsprintfW
gdi32
SelectObject
GetOutlineTextMetricsW
DeleteObject
CreateCompatibleDC
CreateFontIndirectW
DeleteDC
advapi32
RegEnumValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysAllocString
SysFreeString
ContinueRunObject
CreateFromFile
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
DuplicateObject
EditDebugItem
EditObject
EditParameter
EditProp
EndApp
EndFrame
Free
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetDebugItem
GetDebugTree
GetDependencies
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionParam
GetExpressionString
GetExpressionTitle
GetFilters
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetParameterString
GetPropCheck
GetPropCreateParam
GetPropValue
GetProperties
GetRunObjectDataSize
GetRunObjectInfos
GetTextCaps
HandleRunObject
InitParameter
Initialize
IsPropEnabled
IsTransparent
LoadObject
PauseRunObject
PrepareAndroidBuild
PrepareToWriteObject
PutObject
ReleasePropCreateParam
ReleaseProperties
RemoveObject
SetPropCheck
SetPropValue
StartApp
StartFrame
UnloadObject
UpdateEditStructure
UpdateFileNames
UsesFile
Name
.text
Size
263KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=139, id=243, version=40116,
count=24, id=242, version=40116,
count=15, id=260, version=26706,
count=20, id=259, version=26706,
count=31, id=261, version=26706,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=110, id=1, productName=Unmarked objects,
count=5, id=261, version=27048,
count=1, id=256, version=27048,
count=1, id=255, version=27048,
count=1, id=151,
count=1, id=258, version=27048,
Modules/InAndOut.mvx
- IMPHASH 2e7630bda7c38440c3a53ca53dff40be
- SHA256 678073eea715bdb105d7316a2ccbdfbf6185b6bd23c3cd9528ebfeafb9ade716
- MD5 e0a46539bf68ea083867457c962b0edb
- SHA1 1345276d8a0e2ffbc90bfd7a1aa7f75d9b908b77
- SHA512 d23a7e70602bdcd5e3de488c86d83a97038762fa42d588d385cd0ef00a60f32b2344c730a3208352cd0b7fd9de9534e6e8527e8d1e9a5bb36da315724e602e21
- SSDEEP 768:2orQYHSHsbXIQGQTZ0g6yaeRwh2To3PrFPb/5ZiB9ov9/XoKxRrGolluXGCgVEvN:2ocYcNQTZbXwioTFPT9PdRlggWvY
- TLSH T1CB637D1276E180B2D16F117519A54B3BA6BEBD100BF589874FA4EDDE5F30AE0C53A313
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8883
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WriteFile
ReadFile
RtlUnwind
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
RaiseException
user32
LoadStringW
LoadIconW
CreateMvt
GetMvtID
GetMvtIcon
GetMvtName
GetNumberOfMvts
IsUnicode
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=11, version=8047,
count=26, id=14, version=7299,
count=78, id=10, version=8047,
count=5, id=93, version=2179,
count=73, id=1, productName=Unmarked objects,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/KcCursor.mfx
- IMPHASH 8eb8728ab2c20139beacdfa6f33a7240
- SHA256 947a3320e1d7d5d48dd4e86c76238c37f9e67388ceb24732023c47802733f873
- MD5 7f13cd709928cf74d10925042a674e1e
- SHA1 3e831d6b162a606368ed173807fe75029052e0ed
- SHA512 9a4c3b6420f70f5bbd994091fa6634bbb05f7b8e891bab71556a703c768870ef8271b27b88749d9eddbd006dfeaed0fb86950543f347ef71c27dfa4920040001
- SSDEEP 192:xF0hMD06Tll97BR8XnshWbv+pgt77wZOUQesSRaD/IPQ+9s9rUa0KGP6ZWlLbxY:b06DRTdXPQ+9Ra3GP6ZS
- TLSH T1E8F28622E3B58069F4B6AB750DBA4231A736FDA39939DF070290FA0D6D31791AC14733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9751
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
ReadFile
GlobalAlloc
WriteFile
user32
DestroyCursor
LoadImageW
SetCursor
ReleaseDC
CreateIconIndirect
GetDC
GetSystemMetrics
LoadStringW
gdi32
SetDIBits
CreateCompatibleBitmap
CreateBitmap
DeleteObject
mmfs2
ord286
ord585
ord520
ord487
ord264
ord24
ord153
ord169
ord710
ord491
ord170
ord572
ord342
ord445
ord571
ord172
ord372
msvcrt
wcscmp
_adjust_fdiv
_initterm
free
wcsncpy
_wcsicmp
??2@YAPAXI@Z
realloc
malloc
memmove
wcscpy
??3@YAXPAX@Z
ContinueRunObject
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
EnumElts
Free
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionString
GetExpressionTitle
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetRunObjectDataSize
GetRunObjectInfos
HandleRunObject
Initialize
LoadRunObject
PauseRunObject
ReInitRunObject
SaveRunObject
SelectPopup
UpdateEditStructure
WindowProc
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
484B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=257, version=27044,
count=47, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=1, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/Layer.mfx
- IMPHASH d82a75f35f09c2900baf6b3b35d9f046
- SHA256 b8612eb76d8967e49e9ba74a2cbd557096bacfbdb2c6e84d69d381b76d42052e
- MD5 ef12eb1b8b4a804bca741734787fdfd2
- SHA1 43b8f7571067bfd2d7762f6d5c69fb6978894f37
- SHA512 55c2aa823ff69bea48948b04912e1d31465d9a9817ef53fda2957d44451d58fdb2efcf3c40c8431d26d8663f70729e57bbddaeca848ab4d6658f0d5b211d2f2d
- SSDEEP 3072:JLkEGK6OJm7Y+VvdRTOIXsR6hkCXHip+glO2kkM/9W0Ol1OtKweNmfx6TJ:FkEZ5J8jVvSIcR1Cyp463fN
- TLSH T1AAE38C11B9D18032E9A71A31497C9A711AADB910BFB4DDDF535C523D0F703D0AA38BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
64:15:0f:6f:ad:e1:fb:5f:f8:25:d4:9b:e8:18:91:e5:d8:b8:7a:be
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Clickteam SAS,O=Clickteam SAS,L=Boulogne Billancourt,C=FR
Chains
May 27, 2023
CN=Clickteam SAS,O=Clickteam SAS,L=Boulogne Billancourt,C=FR
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Clickteam SAS,O=Clickteam SAS,L=Boulogne Billancourt,C=FR
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=Clickteam SAS,O=Clickteam SAS,L=Boulogne Billancourt,C=FR
Serial Number
08:44:a1:db:15:21:35:40:ff:50:83:0f:00:86:1a:f6
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 5, 2023 - Feb 11, 2025
Minor OS version
1
Major OS version
5
Entry point
25975
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord1036
ord1048
ord945
ord76
kernel32
WriteFile
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
RtlUnwind
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
HeapAlloc
HeapFree
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
DecodePointer
WriteConsoleW
ContinueRunObject
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
EndApp
EndFrame
Free
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionParam
GetExpressionString
GetExpressionTitle
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetRunObjectDataSize
GetRunObjectInfos
GetTextAlignment
GetTextCaps
GetTextClr
GetTextFont
HandleRunObject
Initialize
PauseRunObject
SelectPopup
SetTextAlignment
SetTextClr
SetTextFont
StartApp
StartFrame
UpdateEditStructure
Name
.text
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=118, id=243, version=40116,
count=24, id=242, version=40116,
count=31, id=261, version=26706,
count=15, id=260, version=26706,
count=18, id=259, version=26706,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=27044,
count=89, id=1, productName=Unmarked objects,
count=6, id=261, version=27049,
count=1, id=256, version=27049,
count=1, id=255, version=27049,
count=1, id=151,
count=1, id=258, version=27049,
Modules/MultipleTouch.mfx
- IMPHASH e17197dce00e8773d0873c29323a508f
- SHA256 019f2e914559265745cf2e001deda58f54410d6df0313de4a64e71b4ea2efc2b
- MD5 9b13c38bf349aa5b74e80a3cdd7fd145
- SHA1 db7966a98ad70408c552c30933a9f8c096934e5d
- SHA512 431b06ea6bd4b152e78eb805153309fe8092e5437e12bc8b323f66b495e19a32ed16d5f478d70307716e9d123b5d768cd8dcc15cd13df8e0ed07eebbf5f563ec
- SSDEEP 768:ll84Q4o1jJhQDDoyZTve7NqvwTVJzaZ3djCEYa:lG4QZFhQDDDTMNuu
- TLSH T10023F81297F401B4E9A16E7A547E2236EE39FD534839D12B8310F97E2E73600EE18763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20355
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcAddress
LoadLibraryW
MultiByteToWideChar
ReadFile
GlobalUnlock
GlobalLock
GlobalAlloc
user32
GetClientRect
ScreenToClient
PtInRect
GetWindowRect
GetKeyState
GetActiveWindow
DestroyMenu
GetMenuStringW
LoadMenuW
LoadStringW
mmfs2
ord79
ord82
ord80
ord286
ord34
ord487
ord47
ord77
ord70
ord1057
ord372
ord264
ord172
msvcrt
malloc
_adjust_fdiv
_initterm
_CIpow
wcscmp
realloc
calloc
wcscpy
wcsrchr
_ftol
??2@YAPAXI@Z
??3@YAXPAX@Z
free
wcschr
wcslen
_wtoi
wcsncpy
ContinueRunObject
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
EditorDisplay
Free
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionParam
GetExpressionString
GetExpressionTitle
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetPropCheck
GetPropValue
GetProperties
GetRunObjectDataSize
GetRunObjectInfos
HandleRunObject
Initialize
IsPropEnabled
LoadRunObject
PauseRunObject
ReInitRunObject
SaveRunObject
SetEditSize
SetPropCheck
SetPropValue
UpdateEditStructure
WindowProc
Name
.text
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1004B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
714B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=257, version=27044,
count=57, id=1, productName=Unmarked objects,
count=5, id=93, version=2179,
count=1, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/aviflt.ift
- IMPHASH 71306f7eea1cffe44ecde8ca7a9eb18f
- SHA256 cb5f43c24df39973b983b7fda4abcef60f425061d880c7dd9514b501b84790f8
- MD5 97b3b613ed1f994389b1a963b6e781c9
- SHA1 13b38afdfd6ea283a2012bb8e5c652e13175440c
- SHA512 97cb23d76d926fe03573c127862b738217f91b0cb61517df7514597fdc50844ccb3d4f799b9a8b23b8da37a2b802ee2bd1e56b5e9fdb699bc3d511868ffd417c
- SSDEEP 96:MPg8rc9zp9HvjsedGNPUNAjtPq8y37QgavioyUuBdqaIZiMUj4epz5WY8FfH:MdcBvvjsedaPUctzyihSIZ80+dWBf
- TLSH T1D9B2B539B38205ABFF1A0E71989733B35730F9B09B9682D75F10E98D2C61613D819B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7563
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord815
ord544
ord482
ord485
ord549
ord518
ord583
ord349
ord347
ord358
ord817
ord589
ord237
ord270
ord357
ord11
ord334
ord360
ord729
ord479
ord538
ord574
ord577
ord579
ord463
ord514
ord528
ord531
ord376
ord706
ord727
ord331
kernel32
GetVersionExW
GetLastError
avifil32
AVIFileInit
AVIStreamOpenFromFileA
AVIStreamReadFormat
AVIStreamInfoW
AVIStreamInfoA
AVIStreamLength
AVIStreamRead
AVIStreamRelease
AVIFileExit
AVIStreamOpenFromFileW
msvfw32
ICClose
ICSendMessage
ICDecompress
ICLocate
msvcrt
__CxxFrameHandler
_adjust_fdiv
malloc
??3@YAXPAX@Z
free
??2@YAPAXI@Z
calloc
_initterm
CanReadFile
CreateFilter
GetFilterExts
GetFilterID
GetFilterName
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
346B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=6, id=93, version=2179,
count=58, id=1, productName=Unmarked objects,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/bmpflt.ift
- IMPHASH 170db9ebe595f9cd844916df22bbd8d7
- SHA256 02d03c4847e34c9029cca452e37ada5ef40167406d4474a9393e11aace024c3d
- MD5 a73a9c8e91ef95cf4eabadf8f7334abf
- SHA1 763195d19f5467c593ab638dbdd0a0277a3048f3
- SHA512 cb5f451d8e637d466fec2dde865d5daac5a15ea44b6e2ce0506070c123ffad506f5f9739a9ea440f01c8f331cc9d42802cc14f82e1252ac667fa7318bcdf3acb
- SSDEEP 96:vw4ZE3IPfFPLM2MF9dDm47Rz9gB+pOvi6FXKxQM5/b:vw+E3IPNK9JP6EgqvGW/b
- TLSH T127B2D532A7D605B2EE978F3116A263325271FAF01BA0D3C74F94EA1E4D36443E8357A5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7403
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord331
ord706
ord376
ord692
ord531
ord528
ord514
ord463
ord579
ord577
ord574
ord479
ord538
ord600
ord729
ord358
ord815
ord544
ord482
ord485
ord549
ord518
ord583
ord642
ord641
ord349
ord409
ord727
ord817
ord589
ord237
ord270
ord334
ord357
ord360
ord775
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
free
malloc
_initterm
_adjust_fdiv
CanReadFile
CreateFilter
GetFilterExts
GetFilterID
GetFilterName
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
934B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
308B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=45, id=1, productName=Unmarked objects,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/cctrans.dll
- IMPHASH 10f7671c7ae2b31eb10c6a797d2a33e9
- SHA256 55e75e784e436cccd978192fba869656f879f0f126e99b375c3849c99872ec56
- MD5 ce3a36f85d2ea504b6d19c5f366c3f47
- SHA1 972629c730b65c17ac2c751aafeb612d0c7432f2
- SHA512 c6df293b4373552c3165ac27f2070973a8278bc72001a8c10f300ea30699a03811dc6a84864ff22aaa2b35d1ec75d41ceb2a8fee85b5404d4a5bbfd8333f248c
- SSDEEP 3072:EjqYJijkm4k6wR/NQzjFEgYfriCJ+7NgGWb9UetPTztsYsRn:UqoY4sNQFE1fJZNTZxg
- TLSH T11FE35B00BAA08830E6FB543D08B5DBA52B7E79A4CFB08DDB2B54177D4E702C15F35A1A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
d5:10:d9:1b:0e:fe:f4:d0:ca:dd:07:4a:40:60:4a:e6:00:42:0f:de
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Clickteam S.A.R.L.,O=Clickteam S.A.R.L.,L=BOULOGNE BILLANCOURT,ST=Paris,C=FR
Chains
Oct 23, 2020
CN=Clickteam S.A.R.L.,O=Clickteam S.A.R.L.,L=BOULOGNE BILLANCOURT,ST=Paris,C=FR
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Clickteam S.A.R.L.,O=Clickteam S.A.R.L.,L=BOULOGNE BILLANCOURT,ST=Paris,C=FR
Serial Number
6d:a5:3f:b9:e4:d2:d3:75:06:fc:f3:31:68:db:11:10
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2018 - Dec 5, 2020
Minor OS version
1
Major OS version
5
Entry point
41786
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord753
ord585
ord520
ord342
ord343
ord756
ord493
ord341
ord417
ord344
ord757
ord172
ord264
ord286
ord372
ord487
ord740
ord546
ord571
ord610
winmm
timeGetTime
user32
SetWindowLongW
GetWindowLongW
CheckRadioButton
IsDlgButtonChecked
SetDlgItemInt
GetDlgItemInt
SendDlgItemMessageW
CheckDlgButton
wsprintfW
SetDlgItemTextW
LoadStringW
IsWindow
DestroyWindow
CreateDialogParamW
kernel32
InitializeCriticalSectionAndSpinCount
CreateFileW
DecodePointer
WriteConsoleW
CloseHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
LCMapStringW
CreateTransition
GetModuleID
GetModuleName
GetModuleType
GetTransCount
GetTransID
GetTransMode
GetTransName
IsUnicode
Name
.text
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=241, version=40116,
count=119, id=243, version=40116,
count=25, id=242, version=40116,
count=30, id=261, version=26706,
count=15, id=260, version=26706,
count=19, id=259, version=26706,
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=27043,
count=119, id=1, productName=Unmarked objects,
count=24, id=261, version=27043,
count=1, id=256, version=27043,
count=1, id=255, version=27043,
count=1, id=258, version=27043,
Modules/clickteam-circular.mvx
- IMPHASH 63689c0ff7201b0aa220fa220473dc4e
- SHA256 671a01a39fa56a32fc0a43b16038d3077202734a7beacd50d73439011a74a4cb
- MD5 670cfc229784a242beb960a430ae9764
- SHA1 9818a8a255e58e28c1e7617aa7ab38f29067e4f5
- SHA512 7eb59b4391fed479803c2c2ba075d3fa4581473495f2458b0a86fc3d27f8b7e56a012b920bf2b5f1697b4eb498c8d16de17ebed9f10eb55686048cd4f96df1a1
- SSDEEP 192:GaIqUB58KXfpShtO3ouyuokFTxdg+AiQp:3UrNXhS7O35JXFTxdLAiQ
- TLSH T13BD24E16D3DB00A4F1B62A761C7ACE37563AFC1199F9866E0F10E2DD3D71A15CE21B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7825
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ReadFile
WriteFile
user32
LoadStringW
LoadIconW
msvcrt
_adjust_fdiv
??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
__CxxFrameHandler
_ftol
free
_initterm
malloc
CreateMvt
GetMvtHelpFileName
GetMvtID
GetMvtIcon
GetMvtName
GetNumberOfMvts
IsUnicode
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
506B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=15, id=1, productName=Unmarked objects,
count=5, id=93, version=2179,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/fliflt.ift
- IMPHASH a97d8bdd63c6ba7900f6b409d8e5a0b9
- SHA256 4b651eaa60da09038984a9b7027826941f61f6da58d3f57d11349c8c1896a6d4
- MD5 91b37f29180a7bcca82dd4682d677b3d
- SHA1 bca27cb7ddb271e6649f264777e04970f5ad1276
- SHA512 2fb10952f2671e6a42a9748279aa94e9ce9b307d57d562f9ebbaaa88e27ca96eda36a5fa209df0f791adab7e8d896916b30330ba759b9278cac4bff43600d6e2
- SSDEEP 96:yGmPknHTCymEDV/P8JWYrP2YQaVfsOtUpHtdwReGp6FZiZz5Gu:b3nt1V/EJHrP2YPtsfttGzwidGu
- TLSH T1E1D22956E3D554F6E96B857052D75A339230BDB84F88CA8BCF51CE4D0C23242AC25BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8497
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord331
ord706
ord376
ord531
ord528
ord514
ord463
ord579
ord577
ord479
ord538
ord729
ord358
ord815
ord544
ord482
ord485
ord549
ord518
ord583
ord642
ord641
ord704
ord349
ord347
ord410
ord727
ord817
ord589
ord237
ord270
ord334
ord357
ord360
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_ftol
free
malloc
_initterm
_adjust_fdiv
CanReadFile
CreateFilter
GetFilterExts
GetFilterID
GetFilterName
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
934B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
342B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=44, id=1, productName=Unmarked objects,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/fontembed.mfx
- IMPHASH c150b2454acabaf1dacf1f7276e4936e
- SHA256 38b5dba1524e47ff474d29bb0fb3d7b0476e554cdb82f2de09c4a761ab5645b1
- MD5 f38352c344bd71eb21a78a1b69dcade8
- SHA1 eca1053fa4ce77f96752f400d4ffac8f2f158d15
- SHA512 70134d7e2d4c589fc3ca5c52e005852d07e6b3cce91db00d32bf121611480601d007ead98c3e2febfdd1ca03a0c723fa46e9b73c0f497b315a6cdcb9f15afd56
- SSDEEP 192:u02nHzUUsdbrkCqEhgU8ylfCV8VAvu5TcyiExS3fZLDJ65/e3XPEqR26gJx0DvNq:9e9sdcCTaU8YfnAvMTcqsKC/hQJx0Jq
- TLSH T199622821AF8682B2D553057E2E2B42761A7E920273D77CDFCB42A31E5DA13D32D31179
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
9177
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
gdi32
RemoveFontResourceExA
AddFontResourceExA
msvcr90
_malloc_crt
_encoded_null
_initterm
_initterm_e
_decode_pointer
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
__CxxFrameHandler3
??_U@YAPAXI@Z
realloc
free
malloc
_amsg_exit
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
ContinueRunObject
CreateFromFile
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
DuplicateObject
EditDebugItem
EditObject
EditParameter
EditProp
EndApp
EndFrame
Free
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetDebugItem
GetDebugTree
GetDependencies
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionParam
GetExpressionString
GetExpressionTitle
GetFilters
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetParameterString
GetPropCheck
GetPropCreateParam
GetPropValue
GetProperties
GetRegID
GetRunObjectDataSize
GetRunObjectInfos
GetTextAlignment
GetTextCaps
GetTextClr
GetTextFont
HandleRunObject
InitParameter
Initialize
IsPropEnabled
IsTransparent
LoadObject
PauseRunObject
PrepareToWriteObject
PutObject
ReleasePropCreateParam
ReleaseProperties
RemoveObject
SetPropCheck
SetPropValue
SetTextAlignment
SetTextClr
SetTextFont
StartApp
StartFrame
UnloadObject
UpdateEditStructure
UpdateFileNames
UsesFile
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
768B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=39, id=1, productName=Unmarked objects,
count=6, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Modules/gifflt.ift
- IMPHASH 12f8256339348c205f6d48bb4e491a8f
- SHA256 8fadc250c2afc00b0430c5df576cfd2d444367ad928027334c5d03829241cf92
- MD5 9a1a0b8e7045c06c47abeb52d861c377
- SHA1 6a1c36eb8354f62d5eab6d7c62316fd7d0e1aa92
- SHA512 918a672f82be50a42c237eeb361b971c724a1d7b11cab183dfd5125bdb7663cae588fa92b142dc99a88407a133bbe58bd7bc0c5c60d93287c470375fc094f079
- SSDEEP 192:KwanxqXUW6VDpwYMJP0R40392Wtcg4G9MsryrwfI:lUDiJ00WP9MOuw
- TLSH T163D21A4797544DB6E24582F0265E7B37467237A04FA18B47CCE1DE5E2C22282ED38B37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9995
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord331
ord706
ord376
ord531
ord463
ord579
ord577
ord479
ord538
ord729
ord358
ord544
ord482
ord485
ord549
ord518
ord583
ord642
ord641
ord349
ord347
ord727
ord817
ord589
ord237
ord270
ord357
ord334
ord574
ord360
ord635
msvcrt
??3@YAXPAX@Z
free
??2@YAPAXI@Z
__CxxFrameHandler
realloc
calloc
malloc
_initterm
_adjust_fdiv
CanReadFile
CreateFilter
GetFilterExts
GetFilterID
GetFilterName
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
934B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
346B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=42, id=1, productName=Unmarked objects,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/jpgflt.ift
- IMPHASH dbbd88f111f221490799fbe41aeebecb
- SHA256 5bcaaff4c698581603d4165308260412b38ac6cf708486b53bda3bc76241098d
- MD5 ba4a1f5006fc3fc33f30e82a964cd7b3
- SHA1 8099283e645b6ef523757afdf552da3dc9b72924
- SHA512 8eaa1bae465a0ddd498372fcc9bd9c2b3bd9ba861abcc9158a0e3b8cf14f2a6fc8aae8fb129f96ea090c023247dec56524b2f42fa25239c08145dbe7c664a11e
- SSDEEP 1536:XVVotZiwEws9BGEumoVmLRhDeCKvmP7D50vBxJbdy01FLWdC:XUtZiLJ3GENTheRvu+HFLCC
- TLSH T1A9A36CC1BA8740F1D9852B7060ABA7739F391B07158FDB93D725ED625C23622FC253A8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
77605
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord331
ord706
ord376
ord692
ord531
ord528
ord514
ord463
ord579
ord577
ord574
ord479
ord538
ord600
ord729
ord358
ord815
ord544
ord482
ord485
ord549
ord518
ord583
ord642
ord349
ord409
ord817
ord589
ord237
ord270
ord357
ord360
msvcrt
_ftol
exit
sscanf
getenv
malloc
free
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
CanReadFile
CreateFilter
GetFilterExts
GetFilterID
GetFilterName
Name
.text
Size
76KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=1, id=11, version=8047,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=50, id=1, productName=Unmarked objects,
count=46, id=48, version=9044,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/kcini.mfx
- IMPHASH e2787d9a548bd0a3d6305062f94cc683
- SHA256 d1471b2685d45956c323baa2cab11dfe479eb1021f04e2949f03557527c5fc84
- MD5 7c0cb7fdc0d3519520cd4b8137edbd80
- SHA1 bd4eddd8316a51baf4a3ae68b56acfbba734f46c
- SHA512 601c16892bef77d5842e0778f27d4f82e19ae66333b2b75c9a34b3ba6441169946e1167ceb21ed270bddba305abfe50f2e8f8ab2e9dc410c96a31944e597034a
- SSDEEP 3072:pMHMC6xa0D4hBC3lwTu45NI6WRZG3vR5ULU:pMHMCIMhrlrJlRF
- TLSH T145B36C50B682C431E5BE0A314878EFA98A7DB9500F714DFB6398026D4F346D26F35E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
29503
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
WriteFile
ReadFile
FindClose
OpenFile
GetPrivateProfileStringA
GetPrivateProfileStringW
WritePrivateProfileStringA
WritePrivateProfileStringW
GetWindowsDirectoryW
SetCurrentDirectoryW
GetCurrentDirectoryW
FindFirstFileW
CopyFileW
GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
WriteConsoleW
CloseHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
RtlUnwind
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
SetEnvironmentVariableW
CreateDirectoryW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapAlloc
HeapFree
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
CreateFileW
user32
wsprintfW
shell32
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ContinueRunObject
CreateFromFile
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
EditDebugItem
EditObject
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetDebugItem
GetDebugTree
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionParam
GetExpressionString
GetExpressionTitle
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetPropCheck
GetPropValue
GetProperties
GetRunObjectDataSize
GetRunObjectInfos
HandleRunObject
Initialize
IsPropEnabled
LoadRunObject
PauseRunObject
ReInitRunObject
SaveRunObject
SetPropCheck
SetPropValue
UpdateEditStructure
UpdateFileNames
UsesFile
WToA
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=125, id=243, version=40116,
count=24, id=242, version=40116,
count=16, id=260, version=26706,
count=18, id=259, version=26706,
count=31, id=261, version=26706,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=116, id=1, productName=Unmarked objects,
count=3, id=261, version=27045,
count=1, id=256, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Modules/kclist.mfx
- IMPHASH a5c593c4385b38deaa1e81d1b807f282
- SHA256 c83bcec56f1666d6871e077cc54d0ee7f6462773c03afbb301b9180a4ad0a31a
- MD5 de7d289ea419cc82784cefc87e652c70
- SHA1 9035cf539cd9d3c14fdda73eb2c23452750cfade
- SHA512 f02d5aa3822218517d3c6f9114f0fb90c37ed7281ab09f3a868f251e2975d6da10bd1616a9e13eab0e1f138f2bd2e7953686d3cf7e18e2a67b1bba9fbd762ea0
- SSDEEP 192:lME7dUtmvkkZx+CjaAGnI2469E+750SXv+rKaw6OXOGS3xy8z5m9m:mE7dUTMeAuxWw5aYXOGShy8zs
- TLSH T107E239A39B426CA6CEC64C78DC9F353BE328DED747CD588305E2C9391662116BC14BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13969
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFree
GlobalLock
MultiByteToWideChar
GlobalUnlock
GlobalAlloc
MulDiv
FindFirstFileW
FindNextFileW
FindClose
ReadFile
WideCharToMultiByte
WriteFile
user32
GetSysColor
InvalidateRect
SetFocus
GetDC
wsprintfW
GetWindowDC
ReleaseDC
GetFocus
GetPropW
EnableWindow
GetClientRect
SetWindowPos
ShowWindow
UpdateWindow
DestroyWindow
CreateWindowExW
SendMessageW
gdi32
CreateSolidBrush
DeleteObject
SetBkColor
SetBkMode
SetTextColor
EnumFontFamiliesExW
GetDeviceCaps
EnumFontFamiliesW
CreateFontIndirectW
mmfs2
ord47
ord17
ord1076
ord1075
ord16
msvcrt
wcslen
_ftol
free
wcscpy
wcscat
swprintf
calloc
_initterm
_adjust_fdiv
malloc
ContinueRunObject
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
EditObject
EditorDisplay
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetDebugItem
GetDebugTree
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionParam
GetExpressionString
GetExpressionTitle
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetPropCheck
GetPropValue
GetProperties
GetRunObjectDataSize
GetRunObjectFont
GetRunObjectInfos
GetRunObjectTextColor
GetTextCaps
GetTextClr
GetTextFont
HandleRunObject
IsPropEnabled
LoadRunObject
PauseRunObject
ReInitRunObject
SaveRunObject
SetEditSize
SetPropCheck
SetPropValue
SetRunObjectFont
SetRunObjectTextColor
SetTextClr
SetTextFont
UpdateEditStructure
WToA
WindowProc
Name
.text
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
644B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=257, version=27044,
count=55, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=2, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/kcpict.mfx
- IMPHASH 3ea058a5f52abca1ee0c47206f609c58
- SHA256 d08aa180cc79d9cfe25f6ee76df2c217a6fb895899571ab9bb6199bec1cc37b7
- MD5 e23176095077b8238989ca7e3bced3db
- SHA1 d1419432a2e1f244f8af454d9d351ba976ee30cd
- SHA512 940a858f05f7acc332cc91f223ad946e23ee118dd6b6e4328f71f35e23e6da9cf10cb796a3cab1d00190523c0344080d749ae765eb355cf81855c4d2ed449511
- SSDEEP 96:2vDOpnWhRjCBusVeRLH4Vn9qjtyQqKY3taSOf0DZUaD4aD2FhIMwkNQpVousO7Ef:UDOZWhRjp+el0McV6fQmaEaMhc4Qy1t
- TLSH T1FFB2E7A3BA8444E5C08A44B549FF5A7AB375EBA74F6FE1570650D12D1823381FC0BE72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7963
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ReadFile
GlobalUnlock
GlobalLock
GlobalAlloc
MultiByteToWideChar
GlobalFree
WriteFile
mmfs2
ord272
ord274
ord174
ord342
ord571
ord384
ord137
ord713
ord753
ord739
ord445
ord372
ord173
ord356
ord519
ord584
ord645
ord1140
ord245
ord1144
ord241
ord172
ord487
ord493
ord34
ord757
ord1023
msvcrt
free
calloc
wcscpy
_wcsicmp
_initterm
malloc
_adjust_fdiv
ContinueRunObject
CreateFromFile
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
EditObject
EditorDisplay
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetDebugItem
GetDebugTree
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionString
GetExpressionTitle
GetFilters
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetPropCheck
GetPropValue
GetProperties
GetRunObjectCollisionMask
GetRunObjectDataSize
GetRunObjectInfos
HandleRunObject
IsPropEnabled
LoadRunObject
MakeIconEx
PauseRunObject
ReInitRunObject
SaveRunObject
SetEditSize
SetPropCheck
SetPropValue
UpdateEditStructure
UpdateFileNames
UsesFile
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
362B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=257, version=27044,
count=43, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=1, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/kcwctrl.mfx
- IMPHASH 92322080accb4919c9d313df6d7159b4
- SHA256 a0ada42e3a4760097c1c2f98905f12b19de47159543aa21e1c604dbcac7337f2
- MD5 2c34e977f898ab60eddb72075c4be223
- SHA1 adf883dd06e5ae340a03e6c22a56a4c0caf909ea
- SHA512 73402857d09e5a0e8049bb7adf3bbfdfc9ac65966217751cbf6db2bf532aa3f92ffc3a1a5dcda638e83d6ede29ebe6e760cbad74d27aa6fa006c9296607d3c37
- SSDEEP 1536:cwk3FPBc4adaq8YUb9OB8CIE3sWoCcd0x47DGGGGfxKo:G1PB6daNFC8n70x47DGGGGfxKo
- TLSH T1D7836A00B9D2C072D4722E314D75E6A59B2E7801CA619E7F3748022E5E363DDAB39E77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
11173
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord19
ord101
ord102
ord103
ord16
ord32
ord173
ord174
ord372
ord610
ord493
ord341
ord417
ord342
ord445
ord361
ord1000
ord982
ord63
user32
GetActiveWindow
SetFocus
IsZoomed
IsIconic
GetSystemMetrics
SetWindowPos
FlashWindow
ShowWindow
IsWindow
SendMessageW
GetFocus
GetDC
ReleaseDC
InvalidateRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
GetWindowRect
AdjustWindowRect
ScreenToClient
MapWindowPoints
GetWindowLongW
GetParent
SetParent
FindWindowW
MonitorFromWindow
GetMonitorInfoW
IsWindowVisible
gdi32
GetDeviceCaps
kernel32
DecodePointer
WriteConsoleW
CloseHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
CreateFileW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
HeapFree
HeapAlloc
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
GetEnvironmentStringsW
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetModuleFileNameA
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
ContinueRunObject
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetDebugItem
GetDebugTree
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionString
GetExpressionTitle
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetRunObjectDataSize
GetRunObjectInfos
HandleRunObject
PauseRunObject
ReInitRunObject
WindowProc
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=118, id=243, version=40116,
count=24, id=242, version=40116,
count=28, id=261, version=26706,
count=15, id=260, version=26706,
count=18, id=259, version=26706,
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=27044,
count=133, id=1, productName=Unmarked objects,
count=1, id=261, version=27044,
count=1, id=256, version=27044,
count=1, id=255, version=27044,
count=1, id=258, version=27044,
Modules/mmf2d3d8.dll
- IMPHASH 64b0686318eee36fb6b5e0aeeba27718
- SHA256 9cba4d670209c69039d0d92598aab6d916d9fbd215b634012ff9cef55bfaf559
- MD5 59aeab50440b9f50389a997bc6c44866
- SHA1 61e7a377a98df935bc4a0c94776cf8e4b49c4cb8
- SHA512 fd0c8a94d47af3149ac32406294c4ef25e741249126e0fdd0f8e3ea46a7a85e83921edd08d26b17beec00afe102bb9a897664e17da58e8c2ece2d277e058275f
- SSDEEP 12288:FET+JrnmtBKpjh7RhObbSstL7pDt35JXF/GRK:FA+Jrakjh710HpDt3nVuRK
- TLSH T174A4BE00B5D28432C0FB0630056D6BAB77BE6E204B5CD9DBABD859BF2E701C55732796
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
fb:80:97:cd:2c:62:ef:b6:15:81:d8:a9:14:ce:d6:f1:9c:dc:58:58
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Clickteam SARL,O=Clickteam SARL,L=Boulogne Billancourt,ST=Ile de France,C=FR
Chains
Feb 25, 2022
CN=Clickteam SARL,O=Clickteam SARL,L=Boulogne Billancourt,ST=Ile de France,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=Clickteam SARL,O=Clickteam SARL,L=Boulogne Billancourt,ST=Ile de France,C=FR
Serial Number
05:06:71:9c:4a:1a:31:e2:5f:f2:72:51:72:f1:b6:3c
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 23, 2020 - Jan 8, 2023
Minor OS version
1
Major OS version
5
Entry point
208487
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord397
ord395
ord751
ord568
ord610
ord286
ord264
ord1112
ord1111
ord1110
ord971
ord969
ord978
ord1095
ord966
ord965
ord1018
ord962
ord961
ord1138
ord960
ord1107
ord956
ord955
ord952
ord951
ord950
ord949
ord977
ord947
ord946
ord903
ord943
ord941
ord940
ord1001
ord396
ord836
ord838
ord925
ord844
ord924
ord968
ord855
ord394
ord981
ord1137
ord1100
ord845
ord846
ord850
ord851
ord852
ord939
ord938
ord937
ord936
ord935
ord1005
ord934
ord1103
ord933
ord932
ord1002
ord931
ord930
ord1109
ord928
ord624
ord926
ord922
ord921
ord920
ord919
ord918
ord1102
ord917
ord995
ord915
ord912
ord993
ord992
ord908
ord907
ord906
ord987
ord904
ord1015
ord902
ord899
ord898
ord892
ord891
ord890
ord889
ord888
ord887
ord886
ord879
ord877
ord1013
ord874
ord973
ord873
ord872
ord871
ord870
ord869
ord1090
ord868
ord1136
ord863
ord862
ord861
ord860
ord857
ord854
ord853
d3d8
Direct3DCreate8
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
DecodePointer
GetStringTypeW
HeapAlloc
GetACP
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
InterlockedFlushSList
RaiseException
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileType
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
IsProcessorFeaturePresent
WriteFile
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetProcessHeap
HeapFree
CloseHandle
GetVersionExA
CreateFileW
GetLastError
WideCharToMultiByte
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentThreadId
MultiByteToWideChar
Sleep
user32
DrawTextW
DrawTextA
GetMonitorInfoA
MonitorFromWindow
SystemParametersInfoA
GetParent
SetWindowLongA
GetWindowLongA
OffsetRect
ShowWindow
ReleaseDC
GetDC
DrawTextExW
GetSystemMetrics
SetWindowPos
GetWindowRect
gdi32
SetBkColor
DeleteDC
CreateDIBSection
CreateCompatibleDC
CreateFontIndirectA
DeleteObject
SetBkMode
SetTextColor
SelectObject
GetObjectA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyA
SEFree
SEGetSIPrototype
SEInitialize
Name
.text
Size
313KB
Virtual Size
312KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=241, version=40116,
count=130, id=243, version=40116,
count=29, id=242, version=40116,
count=17, id=260, version=26706,
count=21, id=259, version=26706,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=1, id=18, version=8444,
count=90, id=29, version=9178,
count=8, productName=Unmarked objects (old),
count=3, id=257, version=27045,
count=255, id=1, productName=Unmarked objects,
count=34, id=261, version=26706,
count=5, id=261, version=27045,
count=1, id=256, version=27045,
count=1, id=255, version=27045,
count=1, id=258, version=27045,
Modules/mmf2d3d9.dll
- IMPHASH 180c83ab59795576d7f7665df0409410
- SHA256 3cde7a9181ab63a42cd3535d279d0ab1397b7b78fa3ddddef832757ab2024101
- MD5 72bb9180f8905c0da95566b778cdac5e
- SHA1 e96145e8120514092b35f67f1f120b958997f921
- SHA512 c2c8d8c74c53a78545e69f27a7fe1a6d1291888158962e93e16e6ec9950f86e74c68bd2eb50d04db0bff58e8dc93455aa384245991c5afe34abee36fef53710f
- SSDEEP 24576:EE6cfv6jilsTCw8RCmttZtcJPFGySBDmXA4HwLSJcl:CyA8omXGSFmdkl
- TLSH T14135BE51F292C036C0AB23710657A3B932BDAF251D7585CB1A88BDBA3F345E147293DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
d5:63:e3:05:16:c5:02:56:ce:72:6c:97:3e:4e:65:0c:5a:21:38:2f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Clickteam SARL,O=Clickteam SARL,L=Boulogne Billancourt,ST=Ile de France,C=FR
Chains
Jan 3, 2023
CN=Clickteam SARL,O=Clickteam SARL,L=Boulogne Billancourt,ST=Ile de France,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Clickteam SARL,O=Clickteam SARL,L=Boulogne Billancourt,ST=Ile de France,C=FR
Serial Number
05:06:71:9c:4a:1a:31:e2:5f:f2:72:51:72:f1:b6:3c
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 23, 2020 - Jan 8, 2023
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
1
Major OS version
5
Entry point
786425
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord397
ord395
ord751
ord568
ord610
ord286
ord264
ord1112
ord1111
ord1110
ord971
ord969
ord978
ord1095
ord966
ord965
ord1018
ord926
ord396
ord836
ord838
ord925
ord844
ord924
ord968
ord855
ord394
ord981
ord1137
ord1100
ord845
ord846
ord850
ord851
ord962
ord961
ord1138
ord960
ord1107
ord956
ord955
ord952
ord951
ord950
ord949
ord977
ord947
ord946
ord903
ord943
ord941
ord940
ord939
ord938
ord937
ord936
ord935
ord1005
ord934
ord1103
ord933
ord932
ord1002
ord931
ord930
ord1109
ord928
ord1001
ord624
ord922
ord921
ord920
ord919
ord918
ord1102
ord917
ord995
ord915
ord912
ord993
ord992
ord908
ord907
ord906
ord987
ord904
ord1015
ord902
ord899
ord898
ord892
ord891
ord890
ord889
ord888
ord887
ord886
ord879
ord877
ord1013
ord874
ord973
ord873
ord872
ord871
ord870
ord869
ord1090
ord868
ord1136
ord863
ord862
ord861
ord860
ord857
ord854
ord853
ord852
d3d9
Direct3DCreate9
kernel32
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
DecodePointer
GetStringTypeW
GetACP
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
LoadLibraryExW
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
VirtualQuery
EncodePointer
SetLastError
InterlockedFlushSList
RaiseException
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileType
GetConsoleCP
FindClose
SetFilePointerEx
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW
HeapSize
HeapReAlloc
FreeLibrary
GetFullPathNameA
HeapFree
GetProcessHeap
HeapAlloc
lstrcmpiA
WriteFile
OutputDebugStringA
UnmapViewOfFile
CloseHandle
CreateFileW
CreateFileA
CreateFileMappingA
GetFileSize
MapViewOfFile
Sleep
MultiByteToWideChar
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetVersionExA
WideCharToMultiByte
GetSystemInfo
IsProcessorFeaturePresent
LoadLibraryA
GetModuleHandleA
GetProcAddress
VirtualFree
VirtualAlloc
InterlockedExchange
InterlockedCompareExchange
GetLastError
user32
GetMonitorInfoA
MonitorFromWindow
SystemParametersInfoA
GetParent
SetWindowLongA
GetWindowLongA
OffsetRect
GetWindowRect
ShowWindow
GetDC
GetTabbedTextExtentW
DrawTextExW
GetSystemMetrics
SetWindowPos
ReleaseDC
gdi32
CreateDIBSection
DeleteDC
DeleteObject
GetCharacterPlacementA
GetCharacterPlacementW
SetTextColor
SetBkColor
SetBkMode
GetGlyphOutlineA
GetFontLanguageInfo
CreateFontIndirectA
CreateFontIndirectW
SetTextAlign
SetMapMode
CreateCompatibleDC
ExtTextOutA
MoveToEx
ExtTextOutW
GetTextMetricsA
GetObjectW
GetTextMetricsW
SelectObject
GetObjectA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyA
SEFree
SEGetSIPrototype
SEInitialize
Name
.text
Size
877KB
Virtual Size
876KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
168KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
41KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=241, version=40116,
count=151, id=243, version=40116,
count=34, id=242, version=40116,
count=20, id=260, version=26706,
count=23, id=259, version=26706,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=95, version=2067,
count=6, id=18, version=8444,
count=126, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=257, version=27048,
count=273, id=1, productName=Unmarked objects,
count=34, id=261, version=26706,
count=5, id=261, version=27048,
count=1, id=256, version=27048,
count=1, id=255, version=27048,
count=1, id=258, version=27048,
Modules/mmfs2.dll
- IMPHASH fb76a0ebed426f70a384439c25a3c837
- SHA256 6c9ff6036404e71b0bc2c12bc739eeef0d9200925f5796487af2aa4ef5c5ef97
- MD5 1e0e5acec2f2d3567c40491e39aa8f50
- SHA1 101ec3bbd32c005b12b38c0f7988faa9329a019f
- SHA512 80bbdd2dcc44494a53b14098b7e99db7c20b40650938454105b423e70906ad7371274ed73d3fccd114b9396112a695aebf37f6916976a972154cd562d10e01de
- SSDEEP 12288:tl2w5SNFe2TMNMfeZJyxqNEQ8W7zf+IL2SUoOHxwVoipcVDNLTrgLiFs+:edNFe2TMNMG4qNEQ8W7zGWYd1DLTEWy+
- TLSH T198B4AE10B982C231E4EA51B28AFDBFBE152C677047B858D75B4859BD1D301E32F3266B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
bf:e3:ab:6d:70:47:a9:85:28:35:06:1e:41:52:b0:f8:38:c5:e4:a0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Clickteam SAS,O=Clickteam SAS,L=Boulogne Billancourt,C=FR
Chains
Nov 9, 2023
CN=Clickteam SAS,O=Clickteam SAS,L=Boulogne Billancourt,C=FR
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Clickteam SAS,O=Clickteam SAS,L=Boulogne Billancourt,C=FR
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=Clickteam SAS,O=Clickteam SAS,L=Boulogne Billancourt,C=FR
Serial Number
08:44:a1:db:15:21:35:40:ff:50:83:0f:00:86:1a:f6
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 5, 2023 - Feb 11, 2025
Minor OS version
1
Major OS version
5
Entry point
357370
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
winmm
timeSetEvent
timeGetTime
mciSendCommandW
mciSendCommandA
timeKillEvent
ddraw
DirectDrawCreate
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExA
LCMapStringW
DecodePointer
GetProcessHeap
HeapReAlloc
GetACP
GetStdHandle
HeapAlloc
GetModuleHandleExW
ExitProcess
HeapCompact
HeapSize
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
InterlockedFlushSList
RaiseException
RtlUnwind
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetFileType
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetVersion
InterlockedExchange
LocalFree
LocalAlloc
WriteConsoleW
SetErrorMode
GetCurrentProcessId
FindResourceA
GetSystemInfo
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentThreadId
FreeResource
CreateFileW
CreateFileA
CloseHandle
SetFilePointerEx
SetFilePointer
ReadFile
WriteFile
GetLastError
GetVersionExW
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
LoadLibraryW
LoadLibraryA
FindClose
GetProcAddress
FreeLibrary
GetVersionExA
FindResourceW
LoadResource
LockResource
Sleep
GetModuleFileNameA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
WideCharToMultiByte
MultiByteToWideChar
HeapFree
user32
GetWindow
SetActiveWindow
RegisterClassExA
RegisterClassA
PeekMessageA
DispatchMessageA
TranslateMessage
ChangeDisplaySettingsA
ClientToScreen
GetClassNameA
GetWindowDC
CreateIconIndirect
IntersectRect
DrawTextExW
DrawTextExA
SetRect
LoadStringW
LoadStringA
SetDlgItemTextW
GetWindowLongA
GetSysColor
ScreenToClient
MessageBoxW
InvalidateRect
SetDlgItemTextA
SetDlgItemInt
GetDlgItem
ShowWindow
DrawEdge
wsprintfW
CopyRect
DrawFocusRect
SendMessageW
DefMDIChildProcW
DefMDIChildProcA
DefFrameProcW
DefFrameProcA
GetClassNameW
GetParent
FillRect
EndPaint
BeginPaint
IsIconic
DefWindowProcW
DefWindowProcA
EnumDisplaySettingsA
LoadCursorA
SetWindowLongW
SetWindowLongA
SetCursor
AdjustWindowRectEx
GetWindowRect
GetClientRect
ReleaseDC
GetDC
SetMenu
GetSystemMetrics
GetKeyboardState
SetWindowPos
DestroyWindow
CreateWindowExW
CreateWindowExA
SendMessageA
gdi32
BitBlt
SetDIBits
SelectClipRgn
IntersectClipRect
GetDIBits
GetClipRgn
DeleteDC
CreateRectRgn
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
ExtTextOutW
ExtTextOutA
GetObjectW
GetObjectA
SetTextAlign
SetTextColor
GetTextAlign
CreateFontIndirectW
StretchBlt
RealizePalette
GetPaletteEntries
CreatePalette
GdiFlush
Polyline
SetROP2
SetBkMode
SetBkColor
SelectObject
Rectangle
GetClipBox
SetPixel
SelectPalette
GetSystemPaletteEntries
GetStockObject
GetPixel
GetDeviceCaps
DeleteObject
CreateFontIndirectA
StretchDIBits
MoveToEx
Polygon
CreateDIBSection
SetDIBColorTable
SetWindowOrgEx
CreateSolidBrush
Ellipse
CreateHalftonePalette
CreatePen
LineTo
comdlg32
GetOpenFileNameW
GetSaveFileNameW
GetSaveFileNameA
GetOpenFileNameA
dsound
ord1
Name
.text
Size
405KB
Virtual Size
405KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=241, version=40116,
count=124, id=243, version=40116,
count=27, id=242, version=40116,
count=15, id=260, version=26706,
count=20, id=259, version=26706,
count=36, id=261, version=26706,
count=11, id=260, version=27049,
count=6, productName=Unmarked objects (old),
count=2, id=25, version=9210,
count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=235, id=1, productName=Unmarked objects,
count=3, id=259, version=27049,
count=48, id=261, version=27049,
count=1, id=256, version=27049,
count=1, id=255, version=27049,
count=1, id=151,
count=1, id=258, version=27049,
Modules/mp3flt.sft
- IMPHASH f4e44e69456f6a20409ba6250920533d
- SHA256 ddeafda7b28bf7545e3ba164aa4a74219eb961c36bb974e0f5085a07daf18f44
- MD5 dadc138be9d36e6e4b8e4bf9ef2de4bc
- SHA1 2758db786c544ec7889f26edf9bc4634c9240af0
- SHA512 63a21c5eda225c7fb8a67595c3180d4fdc1bc37d3b45f839e1b562ef946bf5b2237a9ff17c3f6f5de489779bbb9652ac2a1a74b83f153883bd436756acf249e1
- SSDEEP 96:YDe4ApKjaU5qIu9my5F3hM+EX0025ZpMx07/nYwHZLoDK585qQ+5l:YDhAc2uXw32rX0ffMxdINoD5zEl
- TLSH T1E3B21A22B7A50CF6E1564E317DDB0377A57AFF9457A462479E82C23D0C33A02981B673
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7623
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord259
ord283
ord738
msacm32
acmStreamPrepareHeader
acmStreamClose
acmStreamSize
acmStreamOpen
acmMetrics
acmStreamUnprepareHeader
acmStreamConvert
msvcrt
??3@YAXPAX@Z
__CxxFrameHandler
??2@YAPAXI@Z
free
calloc
_ftol
_initterm
malloc
_adjust_fdiv
CanReadFile
CreateFilter
GetFilterExts
GetFilterID
GetFilterName
GetPriority
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=93, version=2179,
count=25, id=1, productName=Unmarked objects,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/oggflt.sft
- IMPHASH 8c071a971a35f2e806d3d72ab5fda000
- SHA256 9e589f86317d840df9bb74f6ee20c24ca65afe58f4009740382f63a0f5531941
- MD5 0c8c1ee3ba92189f4ce21d1b396a2765
- SHA1 b7daa4a6e16416151dccbb0a89f304961b6cb627
- SHA512 0a4339092ac55bac3b1bdfaaa3401020f8f49918bd2fdb14524f3d558eb840b876aedfdeb54a1da163fa36393abf3fe8ab7e112a34ea9d891e82a22e96c85ddc
- SSDEEP 1536:Ww+JHBmul5IMIPkmLnFfUs3OF+KQ51PGTUBHnEJj0AtDLPJwdMSIiRaEUsXxTTUI:CCul5jEkSbOF+31PGTUBwoA8uMR0IjD
- TLSH T142D39E529687A0FEE8CE1978146F367FDE261A0D7218CD539314EEF69C61E10BE1930B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70737
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord259
ord283
ord738
msvcrt
malloc
realloc
memmove
free
memchr
floor
_ftol
calloc
qsort
exit
frexp
ceil
_CIpow
ldexp
_errno
??3@YAXPAX@Z
__CxxFrameHandler
??2@YAPAXI@Z
_initterm
_adjust_fdiv
CanReadFile
CreateFilter
GetFilterExts
GetFilterID
GetFilterName
Name
.text
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=35, id=1, productName=Unmarked objects,
count=22, id=48, version=9044,
count=4, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/pcxflt.ift
- IMPHASH 5bc99a60c87ad3f48e853bfa515bd95b
- SHA256 c9e1db8689c11a87f9ab30ebc705eeccc0fbd909ca493a6f589d6a9a5c2a1b15
- MD5 56f80b514fa7cc1dd7fb24ef195c30eb
- SHA1 e61d7dcbbb623219c625bc67ed0f382f26308600
- SHA512 f391e04bd3e67317b3bb1f9541c94782d14e8b8287f5fd3e2f753688d85cc38bf5164c8faa5dc85b8c44a480f81462a4ddc16aafe64313601d21a608b546e721
- SSDEEP 48:CGVoIxd/dFALrcgFTudzDVQLwYdHf29btyU+CgjENjwXmwG8gjw6FnpJ0nwwlums:x/uq/YNufyU+9kw3CE6Fnn0wKJz5mB
- TLSH T1A8B29433B3A605B6EF5B4E7065E2A2335775B9E05FA8C2871F41EA9D1C26943EC20713
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5947
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord331
ord706
ord376
ord692
ord531
ord528
ord514
ord463
ord579
ord577
ord574
ord479
ord538
ord600
ord729
ord358
ord815
ord544
ord482
ord485
ord549
ord518
ord583
ord642
ord641
ord349
ord347
ord409
ord727
ord817
ord589
ord237
ord270
ord334
ord357
ord360
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
free
malloc
_initterm
_adjust_fdiv
CanReadFile
CreateFilter
GetFilterExts
GetFilterID
GetFilterName
GetPriority
Name
.text
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
956B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
302B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=45, id=1, productName=Unmarked objects,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/pinball.mvx
- IMPHASH ca8eef23eee6f5638768c2df268843f8
- SHA256 827d9ee5cae13f2171cc8b81732169863d4f8165ef98ef728e7afc0a8eb9c641
- MD5 0597b150423fa15c0aabcef39bd6dda6
- SHA1 7d523c8fec817f18d5b0bb1b658fba4e00361655
- SHA512 90573975ba4f3322d1f10240cf992b02aa386f3572e6ba5c38e8e73d48503d1a725b44035b8e17adbed38c28774622df379f98bffcef1d56a07abebacb427a2e
- SSDEEP 1536:BxWlcqNG5Ty5rk3MGJcAD9cD5lRvRKCQ:zjnJHcD5lRvICQ
- TLSH T1E6637D22F7E180F2D19A037159A94B37AA7EFD11CAE189C74F65DE0A1E32AE0D535307
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10740
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WriteFile
ReadFile
RtlUnwind
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
RaiseException
user32
LoadStringW
LoadIconW
CreateMvt
GetMvtID
GetMvtIcon
GetMvtName
GetNumberOfMvts
IsUnicode
Name
.text
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=11, version=8047,
count=26, id=14, version=7299,
count=79, id=10, version=8047,
count=5, id=93, version=2179,
count=73, id=1, productName=Unmarked objects,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/pngflt.ift
- IMPHASH bd36738c7a82e43a1deb87054f1744d9
- SHA256 df948630fdb53ddad68d66994f5d2b18a67df32478b6b8b3720c28f40bde7b1f
- MD5 d57365ca275388910be7b09d95ee65b9
- SHA1 477e9afa81c0ba97323be56d15ade8fb17c45d78
- SHA512 b6a7266c47245cdd5ccc1e4c1b490a22996cac3db53500405354d1a5892896f66aba255ff725808770489a199626a844a86cb80e081a47ed27671bd82ca1cfbb
- SSDEEP 6144:1wgm0uEIwmYcu8zvsLe7RyAObcAOa8qYF:1wgm0uEIJ97RyKCYF
- TLSH T18554AE52B4E2C033E4F60271B47C9B7A0A7D3A32137DC4FB6BD819986D342E1A635766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
138543
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord729
ord727
ord706
ord692
ord642
ord641
ord600
ord589
ord583
ord817
ord579
ord577
ord574
ord815
ord549
ord544
ord538
ord531
ord528
ord518
ord514
ord485
ord482
ord479
ord463
ord409
ord376
ord358
ord349
ord331
ord360
ord334
ord357
ord270
ord237
ord210
ord213
ord207
ord209
ord219
ord217
ord216
ord226
ord206
ord220
kernel32
SetUnhandledExceptionFilter
CreateFileW
LCMapStringW
HeapSize
WriteConsoleW
SetFilePointerEx
LoadLibraryW
OutputDebugStringW
GetStringTypeW
HeapReAlloc
LoadLibraryExW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
DeleteFileW
GetConsoleCP
WideCharToMultiByte
FlushFileBuffers
ReadConsoleW
GetConsoleMode
ReadFile
GetModuleFileNameW
WriteFile
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InterlockedIncrement
GetFileType
GetStdHandle
Sleep
ExitProcess
GetLastError
HeapFree
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
RaiseException
GetCommandLineA
GetCurrentThreadId
GetProcessHeap
EncodePointer
DecodePointer
CloseHandle
UnhandledExceptionFilter
SetEndOfFile
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
InterlockedDecrement
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
DeleteCriticalSection
CanReadFile
CreateFilter
GetFilterExts
GetFilterID
GetFilterName
png_access_version_number
png_benign_error
png_build_grayscale_palette
png_calloc
png_chunk_benign_error
png_chunk_error
png_chunk_warning
png_convert_from_struct_tm
png_convert_from_time_t
png_convert_to_rfc1123
png_convert_to_rfc1123_buffer
png_create_info_struct
png_create_read_struct
png_create_read_struct_2
png_create_write_struct
png_create_write_struct_2
png_data_freer
png_destroy_info_struct
png_destroy_read_struct
png_destroy_write_struct
png_error
png_free
png_free_data
png_free_default
png_get_IHDR
png_get_PLTE
png_get_bKGD
png_get_bit_depth
png_get_cHRM
png_get_cHRM_XYZ
png_get_cHRM_XYZ_fixed
png_get_cHRM_fixed
png_get_channels
png_get_chunk_cache_max
png_get_chunk_malloc_max
png_get_color_type
png_get_compression_buffer_size
png_get_compression_type
png_get_copyright
png_get_current_pass_number
png_get_current_row_number
png_get_error_ptr
png_get_filter_type
png_get_gAMA
png_get_gAMA_fixed
png_get_hIST
png_get_header_ver
png_get_header_version
png_get_iCCP
png_get_image_height
png_get_image_width
png_get_int_32
png_get_interlace_type
png_get_io_chunk_type
png_get_io_ptr
png_get_io_state
png_get_libpng_ver
png_get_mem_ptr
png_get_oFFs
png_get_pCAL
png_get_pHYs
png_get_pHYs_dpi
png_get_palette_max
png_get_pixel_aspect_ratio
png_get_pixel_aspect_ratio_fixed
png_get_pixels_per_inch
png_get_pixels_per_meter
png_get_progressive_ptr
png_get_rgb_to_gray_status
png_get_rowbytes
png_get_rows
png_get_sBIT
png_get_sCAL
png_get_sCAL_fixed
png_get_sCAL_s
png_get_sPLT
png_get_sRGB
png_get_signature
png_get_tIME
png_get_tRNS
png_get_text
png_get_uint_16
png_get_uint_31
png_get_uint_32
png_get_unknown_chunks
png_get_user_chunk_ptr
png_get_user_height_max
png_get_user_transform_ptr
png_get_user_width_max
png_get_valid
png_get_x_offset_inches
png_get_x_offset_inches_fixed
png_get_x_offset_microns
png_get_x_offset_pixels
png_get_x_pixels_per_inch
png_get_x_pixels_per_meter
png_get_y_offset_inches
png_get_y_offset_inches_fixed
png_get_y_offset_microns
png_get_y_offset_pixels
png_get_y_pixels_per_inch
png_get_y_pixels_per_meter
png_handle_as_unknown
png_image_begin_read_from_file
png_image_begin_read_from_memory
png_image_begin_read_from_stdio
png_image_finish_read
png_image_free
png_image_write_to_file
png_image_write_to_memory
png_image_write_to_stdio
png_info_init_3
png_init_io
png_longjmp
png_malloc
png_malloc_default
png_malloc_warn
png_permit_mng_features
png_process_data
png_process_data_pause
png_process_data_skip
png_progressive_combine_row
png_read_end
png_read_image
png_read_info
png_read_png
png_read_row
png_read_rows
png_read_update_info
png_reset_zstream
png_save_int_32
png_save_uint_16
png_save_uint_32
png_set_IHDR
png_set_PLTE
png_set_add_alpha
png_set_alpha_mode
png_set_alpha_mode_fixed
png_set_bKGD
png_set_background
png_set_background_fixed
png_set_benign_errors
png_set_bgr
png_set_cHRM
png_set_cHRM_XYZ
png_set_cHRM_XYZ_fixed
png_set_cHRM_fixed
png_set_check_for_invalid_index
png_set_chunk_cache_max
png_set_chunk_malloc_max
png_set_compression_buffer_size
png_set_compression_level
png_set_compression_mem_level
png_set_compression_method
png_set_compression_strategy
png_set_compression_window_bits
png_set_crc_action
png_set_error_fn
png_set_expand
png_set_expand_16
png_set_expand_gray_1_2_4_to_8
png_set_filler
png_set_filter
png_set_filter_heuristics
png_set_filter_heuristics_fixed
png_set_flush
png_set_gAMA
png_set_gAMA_fixed
png_set_gamma
png_set_gamma_fixed
png_set_gray_to_rgb
png_set_hIST
png_set_iCCP
png_set_interlace_handling
png_set_invalid
png_set_invert_alpha
png_set_invert_mono
png_set_keep_unknown_chunks
png_set_longjmp_fn
png_set_mem_fn
png_set_oFFs
png_set_option
png_set_pCAL
png_set_pHYs
png_set_packing
png_set_packswap
png_set_palette_to_rgb
png_set_progressive_read_fn
png_set_quantize
png_set_read_fn
png_set_read_status_fn
png_set_read_user_chunk_fn
png_set_read_user_transform_fn
png_set_rgb_to_gray
png_set_rgb_to_gray_fixed
png_set_rows
png_set_sBIT
png_set_sCAL
png_set_sCAL_fixed
png_set_sCAL_s
png_set_sPLT
png_set_sRGB
png_set_sRGB_gAMA_and_cHRM
png_set_scale_16
png_set_shift
png_set_sig_bytes
png_set_strip_16
png_set_strip_alpha
png_set_swap
png_set_swap_alpha
png_set_tIME
png_set_tRNS
png_set_tRNS_to_alpha
png_set_text
png_set_text_compression_level
png_set_text_compression_mem_level
png_set_text_compression_method
png_set_text_compression_strategy
png_set_text_compression_window_bits
png_set_unknown_chunk_location
png_set_unknown_chunks
png_set_user_limits
png_set_user_transform_info
png_set_write_fn
png_set_write_status_fn
png_set_write_user_transform_fn
png_sig_cmp
png_start_read_image
png_warning
png_write_chunk
png_write_chunk_data
png_write_chunk_end
png_write_chunk_start
png_write_end
png_write_flush
png_write_image
png_write_info
png_write_info_before_PLTE
png_write_png
png_write_row
png_write_rows
png_write_sig
Name
.text
Size
194KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=207, version=50929,
count=30, id=205, version=50929,
count=145, id=206, version=50929,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=127, id=1, productName=Unmarked objects,
count=15, id=206, productName=VS2012 UPD4 build 61030, version=61030,
count=3, id=207, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Modules/tgaflt.ift
- IMPHASH 5bc99a60c87ad3f48e853bfa515bd95b
- SHA256 756725f247592504d42c67257c3957e972ee490af06f12b00467b389e0ee6bbc
- MD5 00a5f50c4a0f8a2c8704fb0640dfcfb6
- SHA1 960ff3909de1395de49bd9f36600b989851591ea
- SHA512 2be74193a33f1b70f39be9a5565326d425ce02b6eb98b783f8749a209b95fdcbe8724c38c9dbd33e4a12b40756c5ad9177e557f62748b52be2cd7c4bc344b577
- SSDEEP 96:Ew31ACNxdaqSRKuUyU+xfE6FoQJz5mpn4/:ErCNxxZ0SFUdmpn4/
- TLSH T1BCB2B43167AA1AB7EF970E3824FA62335779B9B01BE0C7864F80C61E0C36543ED51722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6603
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord331
ord706
ord376
ord692
ord531
ord528
ord514
ord463
ord579
ord577
ord574
ord479
ord538
ord600
ord729
ord358
ord815
ord544
ord482
ord485
ord549
ord518
ord583
ord642
ord641
ord349
ord347
ord409
ord727
ord817
ord589
ord237
ord270
ord334
ord357
ord360
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
free
malloc
_initterm
_adjust_fdiv
CanReadFile
CreateFilter
GetFilterExts
GetFilterID
GetFilterName
Name
.text
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
934B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
344B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=45, id=1, productName=Unmarked objects,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Modules/ultimatefullscreen.mfx
- IMPHASH a1fe34352ff57d72053d98e08e863984
- SHA256 fd179783ff6e6eb0959185087f33ed4a1b256e58762d9817bcb16888e20f7058
- MD5 96059dbec69c3904e4d7ce734a4b38d0
- SHA1 5169934f8d89b0dba963861dcbae55e78fc21dfc
- SHA512 82977b2c249e47ca37d6fd62f416ed995b4b5f953bc5c18c84bfbdacc2c5b17fdc50c1e736fafcac242a3f8921b5000e0ec84302bc4e0077d6eeee3aa43cc520
- SSDEEP 768:SZfXhNSu1qUKsek7uCZCbMh09RzRLh5xjEnR114TkeWeBg7RIAyEDVyncXBwfSV0:aSZc091RLh5xwnl4TkKBUuAMWHwn+q
- TLSH T1A1738E2072D0C072E0AB1679587666705ABE68129BF440CF6FA9067E7FE07E01E79377
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14709
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord753
user32
ShowWindow
SetWindowPos
GetWindowRect
GetSystemMetrics
IsZoomed
kernel32
IsDebuggerPresent
GetStringTypeW
MultiByteToWideChar
LCMapStringW
IsValidCodePage
HeapAlloc
GetLastError
HeapFree
HeapReAlloc
RtlUnwind
EncodePointer
DecodePointer
GetCurrentThreadId
GetCommandLineA
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
HeapSize
IsProcessorFeaturePresent
RaiseException
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
ContinueRunObject
CreateFromFile
CreateObject
CreateRunObject
DestroyRunObject
DisplayRunObject
DuplicateObject
EditDebugItem
EditObject
EditParameter
EditProp
EditorDisplay
EndApp
EndFrame
Free
GetActionCodeFromMenu
GetActionInfos
GetActionMenu
GetActionString
GetActionTitle
GetConditionCodeFromMenu
GetConditionInfos
GetConditionMenu
GetConditionString
GetConditionTitle
GetDebugItem
GetDebugTree
GetDependencies
GetExpressionCodeFromMenu
GetExpressionInfos
GetExpressionMenu
GetExpressionParam
GetExpressionString
GetExpressionTitle
GetFilters
GetHelpFileName
GetInfos
GetObjInfos
GetObjectRect
GetParameterString
GetPropCheck
GetPropCreateParam
GetPropValue
GetProperties
GetRegID
GetRunObjectDataSize
GetRunObjectInfos
GetTextAlignment
GetTextCaps
GetTextClr
GetTextFont
HandleRunObject
InitParameter
Initialize
IsPropEnabled
IsTransparent
LoadObject
MakeIconEx
PauseRunObject
PrepareToWriteObject
PutObject
ReleasePropCreateParam
ReleaseProperties
RemoveObject
SetPropCheck
SetPropValue
SetTextAlignment
SetTextClr
SetTextFont
StartApp
StartFrame
UnloadObject
UpdateEditStructure
UpdateFileNames
UsesFile
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=80, id=170, productName=VS2010 build 30319, version=30319,
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
count=73, id=1, productName=Unmarked objects,
count=36, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Modules/waveFlt.sft
- IMPHASH a37b82eab5fe34efed01d6399d87638b
- SHA256 92a5053cf5973a6aa228c738d55387f12f1dfa8a837d7b938c60f05b6b56b3ad
- MD5 57ea61dd14314ef155e80c6a0be8a664
- SHA1 963b0ef2fe976ff77044a821fe1e29be4a8cf8a7
- SHA512 cc23cb30d76d22500c3ed7ce9ee0388588309d0779441b95559fce25a42f1eff52ca285c347655f8b33c15b75f9d2067738a151f81f605d3b563799a3a06c9a9
- SSDEEP 96:vLor1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6N/8cKH+ewp:v26Dj9t2ubTVdGJgOcGvw
- TLSH T16FF11B12A7A500F5F8DD0B7134B7627BE875FA285B11C24FC580DE6C0C301E2D928BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7559
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mmfs2
ord259
ord283
ord738
msvcrt
??3@YAXPAX@Z
__CxxFrameHandler
??2@YAPAXI@Z
malloc
_ftol
free
_initterm
_adjust_fdiv
CanReadFile
CreateFilter
GetFilterExts
GetFilterID
GetFilterName
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
583B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
182B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=13, id=1, productName=Unmarked objects,
count=4, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,