Game[.]exe | Triage™

resource
Game.exe
unpack001/$PLUGINSDIR/System.dll

Game.exe

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 0168fb5df2839eb85282afb39d1f5c73e4319eaa141d9592122511f73037ec06
MD5 617b560ff5b82a7ef6953c0da35f2aea
SHA1 ad9a1f0501d9294073ac19abba418438db6fbc4b
SHA512 1fac562fe3beeaeb803a4861814a3e2f05ac71dd53ac28891de8fd9cbfe6c8e3b31e7073ad74dc033e21880b9f1f25f133e3c6d8d86d1f1faae4d50667a40487
SSDEEP 98304:qr9eoj1s5PvP3c0k3toUhQ+QeYeiFf9sJZR6qAXKp:qrQK1S3dk3tpQ+QeYeiOZC6p
TLSH
T15C26339C14E8CA2FEACF0F3834B89B54C7C7CD54A518ABCFA06C7853753521B10AAB65
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/temp_cleanup.ico

SHA256 f3ca0866c22c802a2e562d2d3c299ab16b0a480687add02880b553fe9d1f3b5b
MD5 c8902a54bbf2b6eef30b18c39632da06
SHA1 830d1dacfca896933b120a7623c87c9538285a95
SHA512 8784ca999ffe2922a58ce71856a54f66db2bd59bc8f29eeccc3bc730e8069ccada0a121c9f9725faaf10f46bb8dd1e1bfc6b9cb43d1e553fdbfa7f6c00d427f2
TLSH
T108417F3D6403C4FFD72075641001FD97365ABAA3F7D89979B6EB1728E9C7C20814980D
MD5 SHA1 SHA512 TLSH

$TEMP/tidy.bat

SHA256 4306c2771929f739eb95ccb194a7eb433fb384703db9b10e0460abb996bad142
MD5 e3166d068f5fbd5f2d4cf876b6570023
SHA1 76838b5dd4f056426438ea57a7f53ab95426a9fd
SHA512 f20a753d47cb787474202c42f08f77c4fcbf1bcb26ccaf3543fca7e93acd891ac67aa18c660331350b8c25cb2b60f13e126ad68571b3837e1b7e936daf66a0ec
SSDEEP 192:uMWapyx5oB++XpcHK5fAdGbHZgQvnZ53jkRO6UZrbNsOi2v3G839ufIl3AQ694mc:uMMU/Xpc0AdK/NufckGSYvuE1EGl0GlD
TLSH
T1EE22649E35039AE603769BACCDE36C10D66DA2A9C1B1D1DCF4CCD3CD83D9697828225C
MD5 SHA1 SHA512 SSDEEP TLSH

$_2_/DiagnosticsNET/configuration.tmp

SHA256 868f30d544d375eb85b51f0b0e9c95a466505cfba19b1d31103da5067e968d0c
MD5 0a011fde5ef12a6aedd47d625852fda3
SHA1 2e10b5f268c94ab48bf30074bc346cbf513eaec2
SHA512 6b6755f1401b46a8be216c1220b74c02567df409af718b1980f2ac99e87963b0077fc3fe9413155c9e73eb30da3e538f2e40fee35e1e6b00990324864d7b1de6
TLSH
T10B41DC446E06AA6299B21B35D5C612BCFB1A103F472E0160B6AD17946FF6036CA6CF4C
MD5 SHA1 SHA512 TLSH

$_2_/DiagnosticsNET/update.tmp

SHA256 484b1303209287c51520b6b2952f34b8f21085f51a9c9de1d21a8551fc850e69
MD5 bf7546635574ef69ad6aea52341f2ed1
SHA1 f5e0a5515e81872365e1e33112452c0fc9f5a2e8
SHA512 32bde069a96b7354c5f013aeb9bbabf84aa5e27cb69f07e04be8c4d366d7059521852f2da7631f80f18d885f4ff8c453d99668745079d326e60145b55f180bf8
TLSH
T174F02695BD8AE231B4568B0A4276C9AC075501D9231AE4283AC556C43C26B888FB038A
MD5 SHA1 SHA512 TLSH

$_2_/Features/update.tmp

SHA256 ee50f0f2f925cc1221c2d9f0582b3c35f2520ff191d9c55b652b3342a5c73d6d
MD5 a27e6fa62fe9a021ea9b8743ac1c4f25
SHA1 5ffbf5e69895916e94bfb6bed0542b9660c68a5a
SHA512 f9e3913fa529104ff7e169abf39239a8e88c837f20ede5a904301848be8893fc6c7638079a233e0d4e5a2f13f0f47cad2a28edd91b73e3dc5fe8a526d88a77d6
TLSH
T1CF312503F44088E691729F69B6C6164AFE59057F820A13017FBCC34F6FB083E9BD9968
MD5 SHA1 SHA512 TLSH

$_2_/Features/x/_locales/en/messages.json

SHA256 3d1f24feae65b13919ce27d72dbf37d2445ebba4c485b1d2f4582bc1858a34ed
MD5 e7909dcc8014f623d623ff3d8535c7d7
SHA1 2e8dc1d113df9aabcfba5bfcc6bd66e0bf688567
SHA512 e3a249608313f832125f7842a42914afaca276bb62a0c25a44f6c2eefa867a1748a608180aa6e79379daa0dffdcd34a45c3744776a7628373fceb11b18511bfb
TLSH
T1F9A00294D0B52D2B034F12BF30ED7004B6F04BE240583C6FF2BA091D6B99C5105EE398
MD5 SHA1 SHA512 TLSH

$_2_/Features/x/icon.png

SHA256 481b23eeff4060874cbc24281dad4f42b5326ded9e06a5b547c9b6dbc63d6245
MD5 5f62e1708f9891439ed643945fd4752f
SHA1 d9f8adccc718e9555dbf968912d53db909479679
SHA512 34206a35f31e2496caa1ec05a41e2c7b12d7572c9433f6dc099a1da9e489250a3dcc84c3960da8fb97fe5e1df199a59af40b4b8709bf181ca0bf966e0894ac7d
TLSH
T165511DD64170DB9CCB63D766876A335A4730F5FBC941125E819F957924C116D330EC17
MD5 SHA1 SHA512 TLSH

$_2_/Features/x/icon2.png

SHA256 38e9c3c929f36ec22beb6a7562a6272816d226c1dff2818499413a91912ab55d
MD5 2c9317bbdf91f7e4fe7d785e45f47210
SHA1 02e2166007e5d8628310800854121b9afbe95723
SHA512 56d9ea681353eafebf1ad9f0d3f7ceaaf5ba56fef58f6020b7cb743edaa0d903ed760169d29ced849c1cc0fd7e2cb766eccf89e2f8af4d251cf92c40177d05e5
SSDEEP 96:WS/knmWIePPOfnNVHNOuH+AEgdixP8nW1NxfnbvQc:WS/knsnNVt11EgK8wLvbvQc
TLSH
T10B915B266E552D9191CCF92239E38647573393D8DEC2968FECCE4C472834231B8AD4E3
MD5 SHA1 SHA512 SSDEEP TLSH

$_2_/Features/x/interface.html

SHA256 75c49ec78f92a8c7e1f98c579f693bb1a3a2fb1c4e695a1ed5912bfbb33f5a86
MD5 654bd04df4f45643537d9c5e0fd3d351
SHA1 ad180ca3831f29284c647096de0ddd632f8bb102
SHA512 e71017186ba40e1b7a732d1bd3b876344d90a48779e09e92decc250a79e6ee5387bea8ca17fa77a193e60ec23163026d56b18c149949b960c36588c8ef571584
TLSH
T14F21C00695C02803707BC37887A18211FFB60107C3021239799DF26B0FB7550C9DBBA8
MD5 SHA1 SHA512 TLSH

$_2_/Features/x/interface.js

SHA256 7f9c676741a178b703e32515abbffc422f7d0e58a745e97b2c05e0f0717cbed5
MD5 833ef87f0265c87a2cdb6600a0ed39cb
SHA1 c10cccff915578b9d85687a97df4b834f395e7c7
SHA512 fd47d272d0d8503c4d351fd538729113438d06dd57774a3c8bbd4ce9376ab3296be476bf7e2d018f57e60a54e7a433c5847c5465bc9a8691f020b85d86a5372d
TLSH
T1DD219C5A7141313A8AF7626157938C66FF3910C768420A22319CD5450F375C4C1FBEEF
MD5 SHA1 SHA512 TLSH

$_2_/Features/x/manifest.json

SHA256 b4cbc6bc3025a41fb8003f4f8f8d859576f009827554cb99d07c892572e7b2c1
MD5 eb905bf14a8a0c383e50c8422fbf3d60
SHA1 d678e59cec2ed35357a82a84186005479b1b27ab
SHA512 c60ffe336c0439080477828a78399fb6d3682daf29f7fb74e40f70581fed1795745c13015400b0f91c9bc4b03e6d38fe346842f9fdd714eca7e1021e3f1141a3
SSDEEP 48:/sVzydyu6F0TiqB4IZffZHHjpdOES8ylgkcr:/Tjd5/9U+
TLSH
T14AF112EBAA18892612E4C5F0A431B31CB72315CFACC875C6BB4D88795FA8DEF00655DD
MD5 SHA1 SHA512 SSDEEP TLSH

$_2_/Features/x/script.js

SHA256 90fd9b7f029dd2968c69a03d98fd8f86dd529b0c507898e687abf39807eaed2e
MD5 5c38641814eaf858f45080f8d3bb0a0a
SHA1 f11cd28229415a4f868832abc57ab276bdb5e561
SHA512 1f3f862c40cc06ea6a5f1687c9776838c0b771167e44dcef38d1dacd01f01006c871fbd8951b8121225efa0175b168e5767f69c65c4615fd276bf56db064398f
TLSH
T1F7E0C23F59675A344E2301867531E6D43D7A10261163E61E688CE81D9F18FC50C28D90
MD5 SHA1 SHA512 TLSH

$_2_/Features/x/security.js

SHA256 b63078647279770a6ee5e73c5b78f6958acfa5cca56951dc2807f2ddf601f9db
MD5 b4020d683acf7468ba58f0025848891b
SHA1 2b377ef71fd3cc6840d4f72d3e31dd9976246a42
SHA512 f7eb1f2483f6e6cfaf332ddd0342f613e245b2fff51316ed0c8fdbdddaa63da159e3cab0ab57f94b4569477e36e3710a73f7da55a083028afcad2f4640c865b9
SSDEEP 768:GHqX3W5r4SL+7OFEKNkEpTyWJezPSyngKyCE:GKcrm+k1WwzKf
TLSH
T1BCE2736A25F7183609A7706DBB5BB0413230E01B3589CC9C7E4EA6506F4C6798AB4FEC
MD5 SHA1 SHA512 SSDEEP TLSH

$_2_/Features/x/web_accessible_resource.js

SHA256 2a6ad4faebce67af0c5751780e10bb5ff676195445e0418a20174b6033a2638d
MD5 dcc592cf6d40300bd8e61e650438dcda
SHA1 d2b2627dfe836c838f7143e8bad4b7da3a160454
SHA512 9600aa79fb92fe6d3a5f01972c2aa43022f300b193cd6ab430a5ce67589594d0242c22262c7e6355a86efde8be827eacdfe459523d595583c5ccf9ab4a0d1164
TLSH
T14031AC781C2B853259BB366E5A36F20DFB5621272451E3563ECC840C1FB4F924C45EC8
MD5 SHA1 SHA512 TLSH

$_2_/GameSavings/Windows/win_libraries/32/dll/aplt.dll

IMPHASH be8a6df0b2190ef0dfa3991886ee723e
SHA256 43440b15e2863f53483d61bb2f219e0a7e76b5b575b3b63ba166d94ea81e0c1f
MD5 c673c311f3733e3ff49b381b2ce0e66f
SHA1 6289753f51222af4b7da9d5c2717db9895cc816e
SHA512 8e4ede3a68895d3cd631088cb21dce922c578fc4262d7612ccfefa5493b6a9bb2a6bd6f542fd0f169ef458f4942b0569ef46f87864d694ac181f8833547c6aa6
SSDEEP 49152:eScQ3mB3o6Q7P1wJIFAM4fIRHsrN/EoG9W9ZauQudLfQWRsdenarH0WHiOiupWY:eSvmqNP1rFAOHw69i6udLidenarHiOl
TLSH
T114567C42B702A0FBC24F4170F19D973DDB234A5843648EEB93946D78BCE6F911D62A2D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

85:c5:17:e1:ad:7e:bf:1c:44:84:3f:dd:61:70:62:be:7d:c9:41:23:79:42:8a:ce:60:59:db:f1:07:59:a4:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=305782095,CN=Beellet UAB,O=Beellet UAB,L=Vilnius,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

Chains

Apr 29, 2026

SERIALNUMBER=305782095,CN=Beellet UAB,O=Beellet UAB,L=Vilnius,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=305782095,CN=Beellet UAB,O=Beellet UAB,L=Vilnius,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=305782095,CN=Beellet UAB,O=Beellet UAB,L=Vilnius,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

Serial Number

09:02:1b:30:10:d1:99:10:f7:ed:06:a3:89:8c:2f:04

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 17, 2026 - Mar 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

4853323

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

appsalt.pdb

kernel32

LoadLibraryExA DuplicateHandle SetHandleInformation LoadLibraryA GetProcAddress CloseHandle SetLastError GetModuleHandleW GetModuleHandleA GetModuleFileNameW GetLastError FreeLibrary LoadLibraryExW GetModuleHandleExW GetTimeZoneInformationForYear LCMapStringW VirtualProtect InitializeCriticalSectionEx GetFileType FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW GetStringTypeW HeapSize SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP SetFilePointerEx FlsFree SetThreadStackGuarantee GetProcessHeap HeapFree TlsGetValue TlsSetValue AcquireSRWLockExclusive ReleaseSRWLockExclusive HeapReAlloc WaitForSingleObject ReleaseMutex HeapAlloc CreateMutexW GetExitCodeProcess GetSystemInfo SwitchToThread QueryPerformanceCounter TryAcquireSRWLockExclusive CreateWaitableTimerExW SetWaitableTimer Sleep GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes GetFinalPathNameByHandleW GetNativeSystemInfo GetCurrentProcess PostQueuedCompletionStatus WakeAllConditionVariable WakeConditionVariable SleepConditionVariableSRW InitOnceBeginInitialize TlsAlloc InitOnceComplete TlsFree GetStdHandle GetConsoleMode MultiByteToWideChar WriteConsoleW GetCurrentThreadId GetCurrentThread RtlCaptureContext GetCurrentDirectoryW WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA WideCharToMultiByte GetEnvironmentVariableW CreateDirectoryW GetFullPathNameW FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx CreateFileW SetFileInformationByHandle FormatMessageW QueryPerformanceFrequency CreateThread SleepEx ReadFileEx WriteFileEx GetSystemTimeAsFileTime CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DecodePointer ExitProcess InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer InterlockedFlushSList RtlUnwind RaiseException TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead

user32

ShowWindow SetWindowPos LoadImageW AdjustWindowRect GetCursorPos CreateWindowExW LoadCursorW SetWindowLongW TranslateMessage DispatchMessageW GetSystemMetrics SendMessageW PeekMessageW TranslateAcceleratorW GetWindowLongW SetCursor DefWindowProcW DestroyWindow InvalidateRect ScreenToClient GetDC ReleaseDC ValidateRect RegisterClassW

ntdll

NtCreateFile RtlNtStatusToDosError NtDeviceIoControlFile NtWriteFile NtCancelIoFileEx NtOpenFile NtCreateNamedPipeFile

oleaut32

SysStringLen GetErrorInfo SysFreeString

advapi32

RegOpenKeyExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegSetValueExW SystemFunction036

gdi32

DeleteObject SelectObject Rectangle StretchDIBits CreateSolidBrush

ws2_32

bind getaddrinfo closesocket connect getsockopt WSASendMsg ioctlsocket getpeername socket WSAStartup WSACleanup WSASocketW WSAGetLastError shutdown WSASend send getsockname recv WSAIoctl setsockopt freeaddrinfo

bcrypt

BCryptGenRandom

Name

.text

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1004KB

Virtual Size

1003KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

169KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_2_/GameSavings/Windows/win_libraries/64/dll/aplt.dll

IMPHASH e1598fab9d6f855eadc2db4cb81e82f8
SHA256 f0cc602460e122c431e0c47b484c8917ef7b38483ad470f5a6540d5acdc37a8b
MD5 6b81344f9de5e0f9b50d18b091e4403e
SHA1 d96f0648a29e6f4a743706ab62178125553d37d1
SHA512 5f5e8351ffb0a123bed229afb49b2927db19ab845701beff8fb5e7bf63642c1b83112dcc655087e8760b425eeee085b3ad7037a68d664ff72fda893a9d4efac4
SSDEEP 98304:ms9RoXoYBPn+FWLBGBbVL+ipFC5uDnXnV3n+PV:QLkpoyXV3a
TLSH
T1FA761911BA5B98ADD15AC87483478A735E2170DB0B36B9FF41D482383F69BF02B39719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

98:0c:dc:bc:89:6e:81:2e:b4:eb:39:fa:4b:35:91:c6:bd:c7:35:46:31:6e:0b:bc:04:98:e8:31:68:f8:91:09

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=305782095,CN=Beellet UAB,O=Beellet UAB,L=Vilnius,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

Chains

Apr 29, 2026

SERIALNUMBER=305782095,CN=Beellet UAB,O=Beellet UAB,L=Vilnius,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=305782095,CN=Beellet UAB,O=Beellet UAB,L=Vilnius,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=305782095,CN=Beellet UAB,O=Beellet UAB,L=Vilnius,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

Serial Number

09:02:1b:30:10:d1:99:10:f7:ed:06:a3:89:8c:2f:04

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 17, 2026 - Mar 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

5385760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

appsalt.pdb

kernel32

LoadLibraryExA LoadLibraryA DuplicateHandle GetModuleFileNameW SetHandleInformation GetProcAddress FreeLibrary LoadLibraryExW GetModuleHandleExW CloseHandle SetLastError GetModuleHandleW GetLastError GetModuleHandleA GetTimeZoneInformationForYear GetFileType LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage GetStringTypeW HeapSize SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP SetFilePointerEx CompareStringOrdinal GetProcessHeap HeapFree AcquireSRWLockExclusive ReleaseSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter HeapReAlloc WaitForSingleObject ReleaseMutex HeapAlloc CreateMutexW GetExitCodeProcess SwitchToThread CreateWaitableTimerExW SetWaitableTimer Sleep GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes GetFinalPathNameByHandleW GetSystemInfo GetNativeSystemInfo PostQueuedCompletionStatus WakeAllConditionVariable WakeConditionVariable SleepConditionVariableSRW GetStdHandle GetConsoleMode MultiByteToWideChar WriteConsoleW GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA RtlVirtualUnwind GetCurrentDirectoryW WideCharToMultiByte GetEnvironmentVariableW CreateDirectoryW GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW FindClose CreateFileW SetFileInformationByHandle FormatMessageW QueryPerformanceFrequency CreateThread SetThreadStackGuarantee GetCurrentThread WriteFileEx SleepEx ReadFileEx GetSystemTimeAsFileTime GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW FindNextFileW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer InterlockedFlushSList RaiseException RtlPcToFileHeader RtlUnwindEx TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead

user32

LoadImageW SendMessageW DestroyWindow ShowWindow GetCursorPos SetWindowPos CreateWindowExW SetWindowLongPtrW PeekMessageW TranslateAcceleratorW AdjustWindowRect GetSystemMetrics TranslateMessage DispatchMessageW GetWindowLongPtrW SetCursor LoadCursorW DefWindowProcW InvalidateRect ScreenToClient ReleaseDC RegisterClassW ValidateRect GetDC

ntdll

NtWriteFile NtOpenFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateNamedPipeFile NtCreateFile

oleaut32

SysStringLen GetErrorInfo SysFreeString

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW SystemFunction036 RegSetValueExW RegCreateKeyExW

gdi32

DeleteObject SelectObject Rectangle StretchDIBits CreateSolidBrush

ws2_32

getsockopt ioctlsocket WSAStartup WSACleanup socket shutdown WSAGetLastError getpeername WSASend getsockname setsockopt WSASocketW connect recv send closesocket WSAIoctl freeaddrinfo WSASendMsg getaddrinfo bind

bcrypt

BCryptGenRandom

Name

.text

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_2_/GameSavings/Windows/win_libraries/update.tmp

SHA256 67c0081a99cc2f2bccd00a5b0df92460ddb0843bd7bddb1d8c90a89a08d2ab42
MD5 84b4ed0b6882be985d81dfceff59a9bc
SHA1 33dfd51b594d5f9e131f611ede57a735b0ee0cbd
SHA512 981b7279aedb6dbde018e154665f352ef0941f86c15ebbd29518cfad441867296c84552a5cc79bbe1e03afa00fcb4c69d04a62d30b68bcc12b78590285cd0a3d
TLSH
T176F0F995BD8AE631B4568B0A4276C5AD074501D9631AE4283BC557C87C26F889FF43CA
MD5 SHA1 SHA512 TLSH

$_2_/GameSavings/Windows/win_libraries/updater.tmp

SHA256 77142f53bb0bddb4a8bd57701f65dd90d1cda8804c3e995bf23934653bf7d1cc
MD5 9696b2c7cf128ae6ffcc4d82f33d5b71
SHA1 29b6f15c524c456112bcf79febbff57a7d525364
SHA512 5716eedf31b7f54a5ca5aba19ee31f7ec89a5a5d011561bc2964cef66fbbb8489a8ce55ce06ed48b08501a1bbacb653046671899342e73c8568967be915687b0
SSDEEP 192:oJkbGDL67REEWI6/sTirEBADMqCCWA16PhY4cyEGoiJfUA/eQ:oa7REBI0clA1cp
TLSH
T1A25251146D43661A0AF6D72DEE99902CFF0B403F5A791220B9AC47082F76069967CF6E
MD5 SHA1 SHA512 SSDEEP TLSH

$_2_/SdkWin/update.tmp

SHA256 84b1661621ebe8992cab26c32b67d83d42f6d74e9926b69ed347b83185895278
MD5 43e825f9f6cfe537a3e623343b2a7d5b
SHA1 f0f33f66637f30f992797973a80d8063f6687869
SHA512 5a136ce51087e044c84521d63a69db91c754b9ef9c207992c5a739fa4ab09b8baf690eccaddb04dd9e9810fdbb0b2aa4796caa2f249949e67db3a9701f4663e2
TLSH
T15E410C266966647944B36739E8B24004FF2A112B4ABD0002B8AC41D97FF0DB5D379FAE
MD5 SHA1 SHA512 TLSH

$_2_/SdkWin/updater.tmp

SHA256 51e30dfc40b2b4627c447471d8ab53ba3cb7bb8215afc6277bf92943e40a4d0d
MD5 fd8d3308a986f6d8b9e4c12d456a9d78
SHA1 02c1a64cf15b0836694ac87e0e477266ec13cde7
SHA512 eb65c7cefb4ea30515e6fdced698f23014fb02636b05c412d57ef597b3ab4e7ea262607c4ac7e8ac19adbc3f4ec19425479878c118fed1388e77113adc745e93
TLSH
T14CF0F995BD8AE231B4568B1A4276C5AD074501D9631AE4283BC557C47C26F889FF43CA
MD5 SHA1 SHA512 TLSH

$_2_/UpdatesWin/update.tmp

SHA256 12936009703fa8a7ada0700fcbd138db700b2a46a0108e1580b375f291a0d376
MD5 61dc418765d441f7232b00730315b1e2
SHA1 525fd9916c49301fcf7ddca2315dd6428f50dda5
SHA512 588f0e0f9ba4bca50b8e9d06a5d85dc8da75bc7ebf15489eb17bbdf2ef5bb0529180fca567766d0f9d665847494ff1330a294927359d52b545bee0e36782070b
TLSH
T10151412B691A6125D37223B1D6966418EE3BC01F9E59404070DDE589FFB067443FDFE1
MD5 SHA1 SHA512 TLSH

$_2_/UpdatesWin/updater.tmp

SHA256 8345cf16434236ab88e012de3006b20f81fb2f0e5f6452cb3942e792e2b1aef1
MD5 67191b1c8799ed6712c59f0f0d626e9c
SHA1 0cef5b0472ea9608f6af457a73abf82700a1a9d1
SHA512 ff251471395547180f50761288df2d3d9c044263fef4cc26a987a06efc2ca01d701e55664a5e6a25af082137184b768910f081afdbf64845d82afb81d0580a63
TLSH
T1915114499A13512042B3D37E95B2D278EB3F811F021A0114B1FC62823F31A7C4BDAFE8
MD5 SHA1 SHA512 TLSH

$_2_/WinPackages/update.tmp

SHA256 67c0081a99cc2f2bccd00a5b0df92460ddb0843bd7bddb1d8c90a89a08d2ab42
MD5 84b4ed0b6882be985d81dfceff59a9bc
SHA1 33dfd51b594d5f9e131f611ede57a735b0ee0cbd
SHA512 981b7279aedb6dbde018e154665f352ef0941f86c15ebbd29518cfad441867296c84552a5cc79bbe1e03afa00fcb4c69d04a62d30b68bcc12b78590285cd0a3d
TLSH
T176F0F995BD8AE631B4568B0A4276C5AD074501D9631AE4283BC557C87C26F889FF43CA
MD5 SHA1 SHA512 TLSH

$_2_/WinPackages/updater.tmp

SHA256 d95edae2c06c2b95acee8d185dcf9893927844cce7fded48a8be79f06d12aa7b
MD5 5e5e4d02fe7c654034d3162a025d2253
SHA1 948eac93af9d2193b9c5496339bb365c35a6105e
SHA512 42aca00445db83bc893e8b1a3d112ca3db17bf4916955af0f2bac130f807db62fecb91632a65976c5b4d3eca9d404f9227aa49029b64856366427857632efa29
SSDEEP 96:5XVekJrC7j9JXaPzBcZLDN4N1jFOXHB/Jw/z9WYgW9vylVL11THroqNCdEa4XUTW:5XV9J2V9N4NNFeHB/2/w7Vx1TtgEaHTW
TLSH
T198B1D6A1321EE534A66094129DC3D648FF366622436D99F4F48CDA01FFF540DC279EA6
MD5 SHA1 SHA512 SSDEEP TLSH

$_3_/Game.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d77741a4dbc562e2ac98adf2d4aa036feb7736ce0fe1aecf48ac247de783df9d
MD5 c2f26dcf03ce79d120884cb0ec4b8090
SHA1 4171105b1ebb52591129e8389831fe3083e9083e
SHA512 3459d0d31fbe789a47ca2a38e126cdf4802e247bab564ab7b40b1f9ec52c4bf0f63e377a9eec0b2c95bd8d0748538c6cad996f99d0a2ed73c9211bcd8074e78c
SSDEEP 1536:v0RG7xBqKIlsDbULGXBgVP6n/7brxxi483zK:v0RG7xBtpBoyn/vrQ32
TLSH
T142735C9163AC4C17C4BF567DA6B0922207F1F7832660FBAA1DC8A4C906E77D197503AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Digest

f7:8c:ae:0f:8e:fa:73:f5:ad:00:7d:e9:a6:7f:1d:c4:9a:79:d5:30:29:ac:fd:c8:19:01:cd:71:fd:d0:68:22

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 26, 2024

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

f7:8c:ae:0f:8e:fa:73:f5:ad:00:7d:e9:a6:7f:1d:c4:9a:79:d5:30:29:ac:fd:c8:19:01:cd:71:fd:d0:68:22

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

Chains

Mar 9, 2024

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

Serial Number

02:22:a8:d6:0b:06:b0:4f:af:fb:da:53:ef:fd:57:95

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 19, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:08:e2:33:7a:56:70:40:c0:d5:00:00:00:00:01:08

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 14, 2023 - Sep 4, 2024

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ee:05:d3:02:30:b2:9a:9d:a7:00:01:00:00:01:ee

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

61310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\agent\_work\171\s\hallasan-smart-printerdriver\Source\V4\UI\PrinterExtension\obj\x86\Release\HP.OneDriver.V4.PrinterExtension.pdb

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Game.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$TEMP/temp_cleanup.ico

$TEMP/tidy.bat

$_2_/DiagnosticsNET/configuration.tmp

$_2_/DiagnosticsNET/update.tmp

$_2_/Features/update.tmp

$_2_/Features/x/_locales/en/messages.json

$_2_/Features/x/icon.png

$_2_/Features/x/icon2.png

$_2_/Features/x/interface.html

$_2_/Features/x/interface.js

$_2_/Features/x/manifest.json

$_2_/Features/x/script.js

$_2_/Features/x/security.js

$_2_/Features/x/web_accessible_resource.js

$_2_/GameSavings/Windows/win_libraries/32/dll/aplt.dll

kernel32

user32

ntdll

oleaut32

advapi32

gdi32

ws2_32

bcrypt

generic

$_2_/GameSavings/Windows/win_libraries/64/dll/aplt.dll

kernel32

user32

ntdll

oleaut32

advapi32

gdi32

ws2_32

bcrypt

generic

$_2_/GameSavings/Windows/win_libraries/update.tmp

$_2_/GameSavings/Windows/win_libraries/updater.tmp

$_2_/SdkWin/update.tmp

$_2_/SdkWin/updater.tmp

$_2_/UpdatesWin/update.tmp

$_2_/UpdatesWin/updater.tmp

$_2_/WinPackages/update.tmp

$_2_/WinPackages/updater.tmp

$_3_/Game.exe

mscoree

dotnet