Nodura1488.ZapretUltimate-win-Portable.zip
- SHA256 4d71fa5f1bedc947a25c77aba9c8244e087e1fd40cbdc7d358b79b538a75cb30
Overview
overview
8Static
static
3Update.exe
windows10-2004-x64
3Update.exe
windows11-ltsc_2024-x64
3ZAPRET ULTIMATE.exe
windows10-2004-x64
8ZAPRET ULTIMATE.exe
windows11-ltsc_2024-x64
8current/Mi...ET.dll
windows10-2004-x64
1current/Mi...ET.dll
windows11-ltsc_2024-x64
1current/Velopack.dll
windows10-2004-x64
1current/Velopack.dll
windows11-ltsc_2024-x64
1current/Wi...me.dll
windows10-2004-x64
1current/Wi...me.dll
windows11-ltsc_2024-x64
1current/Za...re.dll
windows10-2004-x64
1current/Za...re.dll
windows11-ltsc_2024-x64
1current/Za...te.exe
windows10-2004-x64
1current/Za...te.exe
windows11-ltsc_2024-x64
1current/Za...te.exe
windows10-2004-x64
8current/Za...te.exe
windows11-ltsc_2024-x64
8Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Update.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Update.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
ZAPRET ULTIMATE.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
ZAPRET ULTIMATE.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral5
Sample
current/Microsoft.Windows.SDK.NET.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
current/Microsoft.Windows.SDK.NET.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
current/Velopack.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
current/Velopack.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
current/WinRT.Runtime.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
current/WinRT.Runtime.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
current/ZapretUltimate.Core.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
current/ZapretUltimate.Core.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
current/ZapretUltimate.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
current/ZapretUltimate.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
current/ZapretUltimate.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral16
Sample
current/ZapretUltimate.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target Nodura1488.ZapretUltimate-win-Portable.zip
- Size 8.5MB
- Sample261027-1qvt2aee75
- SHA256 4d71fa5f1bedc947a25c77aba9c8244e087e1fd40cbdc7d358b79b538a75cb30
- MD5 fa28c98bddf60f4055ddb456a6f24627
- SHA1 de7633203a93002f0ee91bec2542a4f043215860
- SHA512 36baf278fa0b654e6fdf965f459d4dfcf24127f6b440d6aa926ce15b5deb38802c47e8e82f48afe79760677fe7fa3272beda9efea803a4dd1c68a1cf544eb542
- SSDEEP 196608:6S2Ey2Sh2auZ64BQcXlWEV8ihIuDLmTcObNgbytaQSCuTmv6N9w:6S2EyLIFNXlWi8ihIuDLmlNBSTTmvW9w
- TLSH T1269633BB04BB818F655C8D75CA8E3D8100566FFDB0C27C22D8DC1370D6FAABA564A65C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/Update.exe unpack001/ZAPRET ULTIMATE.exe unpack001/current/Velopack.dll unpack001/current/ZapretUltimate.Core.dll unpack001/current/ZapretUltimate.dll unpack001/current/ZapretUltimate.exe
File Explorer
-
Nodura1488.ZapretUltimate-win-Portable.zip.zip 8.5MB
-
Update.exe.exe 3.7MB
-
ZAPRET ULTIMATE.exe.exe 383KB
-
current/LICENSE.txt1KB
-
current/Microsoft.Windows.SDK.NET.dll.dll 23.7MB
-
current/THIRD-PARTY-NOTICES.md1007B
-
current/Velopack.dll.dll 271KB
-
current/WinRT.Runtime.dll.dll 516KB
-
current/ZapretUltimate.Core.dll.dll 51KB
-
current/ZapretUltimate.deps.json2KB
-
current/ZapretUltimate.dll.exe 160KB
-
current/ZapretUltimate.exe.exe 159KB
-
current/ZapretUltimate.runtimeconfig.json519B
-
current/sq.version.xml 648B
Update.exe
- IMPHASH c06cf0cb9719d4659ab380800e751381
- SHA256 6849325f8fb57ff5d13497c984b9de82e6b5d46ddfbc857145012d104886287f
- MD5 9f90608b7ce7d0a2f726988e42ae7e70
- SHA1 802802cd2e4d5ffb342a0917247585076e98320d
- SHA512 8585215aa63e2fc0e6cb3beb14fe3b289deb45c2b1b8e78a16dec5b9892a9a2e5872014119172f01596f0bc76597831315b89f0da4597f1cf5a77ca141b8c035
- SSDEEP 49152:x0z1f+viTnGsRHs8jVrr3TZlzW1qmHVpFkSZu:m+v0ntHsOnaH
- TLSH T16006AE62FF42D0FBC48A01B6E42DF37D9636A1558B6A85C392A94C4C6CE13B09C5739F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2221449
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
update.pdb
kernel32
GetModuleFileNameW
SetThreadErrorMode
LoadLibraryExW
SetUnhandledExceptionFilter
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformationForYear
CloseHandle
GetCommandLineW
TlsSetValue
UnhandledExceptionFilter
GetFileInformationByHandleEx
SetFileInformationByHandle
FindClose
GetFullPathNameW
TlsGetValue
GetSystemInfo
WakeAllConditionVariable
WakeConditionVariable
SwitchToThread
SleepConditionVariableSRW
GetCurrentProcess
DuplicateHandle
AcquireSRWLockExclusive
GetFileInformationByHandle
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
ReleaseSRWLockExclusive
MultiByteToWideChar
WaitForSingleObject
GetCurrentThread
ReleaseMutex
SetLastError
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
lstrlenW
GetCurrentProcessId
CreateMutexA
WideCharToMultiByte
GetCurrentThreadId
GetEnvironmentVariableW
GetModuleHandleA
CreateThread
GetProcAddress
ReadFileEx
SleepEx
WriteFileEx
CompareStringOrdinal
GetModuleHandleW
CreateFileW
SetFileTime
FindFirstFileExW
SetFilePointerEx
TryAcquireSRWLockExclusive
SetHandleInformation
GetSystemTimeAsFileTime
CreateDirectoryW
ExitProcess
GetExitCodeProcess
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetTempPathW
RemoveDirectoryW
DeleteFileW
CopyFileExW
MoveFileExW
CreateSymbolicLinkW
CreateWaitableTimerExW
SetWaitableTimer
Sleep
SetCurrentDirectoryW
FindNextFileW
GetFileSizeEx
OpenProcess
GetProcessTimes
ExpandEnvironmentStringsW
GetLongPathNameW
HeapSize
TerminateProcess
QueryFullProcessImageNameW
VirtualQuery
GetLastError
IsWow64Process
GetProcessId
GetUserPreferredUILanguages
LoadLibraryExA
VirtualProtect
SetThreadStackGuarantee
GetConsoleOutputCP
FreeLibrary
GetProcessHeap
HeapFree
HeapAlloc
FormatMessageW
GetConsoleMode
GetStdHandle
WriteConsoleW
SetConsoleMode
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
OutputDebugStringA
OutputDebugStringW
AddVectoredExceptionHandler
HeapReAlloc
SetStdHandle
DecodePointer
RtlUnwind
RtlCaptureContext
IsDebuggerPresent
QueryPerformanceFrequency
QueryPerformanceCounter
RaiseException
EncodePointer
GetModuleHandleExW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
WriteFile
GetCommandLineA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetEnvironmentVariableW
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
CompareStringW
LCMapStringW
FlushFileBuffers
ntdll
NtReadFile
NtWriteFile
NtCreateFile
RtlInitUnicodeString
NtOpenFile
NtCreateNamedPipeFile
RtlNtStatusToDosError
NtQueryInformationProcess
user32
EndDialog
AllowSetForegroundWindow
SendMessageW
combase
CoTaskMemFree
CoTaskMemAlloc
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=33145,
count=145, id=261, version=33145,
count=25, id=260, version=33145,
count=21, id=259, version=35207,
count=18, id=260, version=35207,
count=50, id=261, version=35207,
count=27, id=260, version=35220,
count=215, id=1, productName=Unmarked objects,
count=24, productName=Unmarked objects (old),
count=1, id=255, version=35220,
count=1, id=258, version=35220,
ZAPRET ULTIMATE.exe
- IMPHASH 78c016150ecdff5dc7a78e74bd2b3d20
- SHA256 4c534cd6da97532203dc60699b04043eaea3a2e4752ed1857b30736dc9cbda28
- MD5 265a4b60085e0ee319e62f2d636606d2
- SHA1 a461df6fdb5a54c208580399b7de72e476451f1f
- SHA512 3143ba6726403c25f757365f670f7a6b021d1815cafae1d8eebd9c3f486f353aa04ad5808ed746891d12938b5bcd7a259a2799ea7f445f180768010bba908941
- SSDEEP 6144:MnGCgJJkYL+FwHS6thnL5qEW18NoQ2UWASSgNlXgCtBZ19gLz1ulvlDe+dzYufZs:sSJJkYLauS67aQ2UWIgXgCtgLz1uXe+W
- TLSH T19C849D52BF40C0B7D44740729D3DE73ECB3AA1161B11CEE7B3E50A989D357A04E366AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
229617
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
ReleaseSRWLockExclusive
GetConsoleMode
GetStdHandle
WriteConsoleW
WaitForSingleObject
TlsSetValue
GetCurrentProcess
GetCurrentThread
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetProcAddress
GetCurrentThreadId
GetModuleHandleA
SetThreadStackGuarantee
SleepEx
GetModuleHandleW
FormatMessageW
CreateFileW
SetFileTime
SetFileInformationByHandle
GetFullPathNameW
FindFirstFileExW
FindClose
GetFileInformationByHandle
TlsGetValue
TryAcquireSRWLockExclusive
GetSystemTimeAsFileTime
DuplicateHandle
CreateDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetModuleFileNameW
CreateThread
GetTempPathW
CopyFileExW
MoveFileExW
CreateWaitableTimerExW
SetWaitableTimer
Sleep
LoadLibraryExA
AcquireSRWLockExclusive
SystemTimeToFileTime
GetCommandLineW
MultiByteToWideChar
GetCurrentDirectoryW
lstrlenW
WideCharToMultiByte
GetEnvironmentVariableW
ReadFileEx
WriteFileEx
CompareStringOrdinal
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapFree
HeapAlloc
GetProcessId
SystemTimeToTzSpecificLocalTime
GetCurrentProcessId
GetLastError
SetLastError
GetFileInformationByHandleEx
LCMapStringW
CompareStringW
RaiseException
GetSystemInfo
FreeLibrary
IsDebuggerPresent
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
EncodePointer
LoadLibraryExW
ExitProcess
GetModuleHandleExW
FindNextFileW
SetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
FlushFileBuffers
GetConsoleOutputCP
SetFilePointerEx
DecodePointer
InitializeSListHead
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
WriteFile
GetCommandLineA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetEnvironmentVariableW
GetStringTypeW
InitializeCriticalSectionEx
CloseHandle
HeapSize
QueryPerformanceCounter
QueryPerformanceFrequency
RtlCaptureContext
HeapReAlloc
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
VirtualProtect
VirtualQuery
UnhandledExceptionFilter
user32
AllowSetForegroundWindow
ntdll
NtWriteFile
RtlNtStatusToDosError
NtOpenFile
NtReadFile
NtCreateNamedPipeFile
Name
.text
Size
287KB
Virtual Size
287KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33145,
count=141, id=261, version=33145,
count=19, id=260, version=33145,
count=20, id=259, version=35207,
count=17, id=260, version=35207,
count=43, id=261, version=35207,
count=3, id=257, version=33145,
count=145, id=1, productName=Unmarked objects,
count=10, productName=Unmarked objects (old),
count=1, id=258, version=35220,
current/LICENSE.txt
- SHA256 ff616e646eaa8248fbafe39ac3d7848a0a1c8d0328b5cb14be04fcf1f662db11
- MD5 1cb0de16b8e93718a19448d597e31af2
- SHA1 37b09562ab3a1908ba9db9c595bd2a49a933e281
- SHA512 64aa1f1b0b57a89bf8238f1ccacb9c1414101168609a2739400d40e9e988154f14d053ae99943769340f10668f072a9b55b836794321878b28542ddd29a130d2
- TLSH T1EB31A54F720643B21EC252914A9EECCAF22F600A7F5F1844307ED10DA236419CBFF964
- MD5 SHA1 SHA512 TLSH
current/Microsoft.Windows.SDK.NET.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0ec371d93798852e36461c8adddbeadce0f963a04752f0b64e54fe19c1c834a7
- MD5 a00b91c2e00b89e387705af95b72bd6e
- SHA1 eb57d8d9b8c1e4434044c28b608113e49d53ccf9
- SHA512 93b88a2ef85206765144c7c082662da7a3ad57fb08af9f8bbc0355721c12cf52f6a6920adad08778c4d2054652636d24d095b998c282f9b1e92b9234808f3165
- SSDEEP 98304:POCu/R1ZTAk4bl5EUBMXyLImPbjAd+deA/tlCjvT7HiYyhILyV3K3CrLtHOpdGxD:POCu51ZTAFLzbjblIjvT7CThIPPBrYj
- TLSH T15D477E2297A44E3DC98F5773E4B603264335C60AAF4393EA581C979D2F833460B59AF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:92:ea:65:ce:42:ec:d3:9e:55:fe:b1:17:4b:14:f4:94:a2:44:76:0f:c1:66:6c:f3:87:af:03:df:8b:60:88
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 11, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:04:6c:74:06:ff:57:2b:27:72:00:00:00:00:04:04
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e6:d9:42:9e:ea:00:f8:7d:e1:00:01:00:00:01:e6
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
24787186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\NetSDKProjection\Windows\obj\Release\net8.0\Microsoft.Windows.SDK.NET.pdb
mscoree
_CorDllMain
Name
.text
Size
23.7MB
Virtual Size
23.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
current/THIRD-PARTY-NOTICES.md
- SHA256 c5f08f013104bc1371280ce16240efe0948737975c6a7cb62265adccbf0acb07
- MD5 4013b08f6a9e89d85a760caa8a5a0563
- SHA1 ace025d2846fe7208e25a630ea45c410fef8175d
- SHA512 00eebb1b0e35a3412588b0a704138f088efd58a285270352745c4a61574ff73e660f01e419ecdde4b4eeeafda672bee8b9a43110a505f28503edb3ce6b13e6d9
- TLSH T119119EFF1506858E0F5418C3C94AB45BE3291046E9DA1DE870E7D08DE638F1B76D570E
- MD5 SHA1 SHA512 TLSH
current/Velopack.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f22e845bc153e9f7859c36de9df074bb3831db7db08c68739f0cd1e356352ed1
- MD5 909fe47436cd85c1ba16498eb3217d82
- SHA1 5e3e7ebbccc0b84407a0edb9eee5cbb9e9068baf
- SHA512 f6444ef5d5391e04dd22b9893ea50ad3e9614cc245c7580110270d85c125157bce923ad3e4665543a2eddf8ed8310cc7c6974124523b833ff2c14eff87879d32
- SSDEEP 3072:eo+y+mz0SG2JczzlOjBo2N/i3Pn3a9VsQcuKa4E9sKSEQ0RyS+W7OFUqAVauFBvG:eo5+ceTfja4ENSE/RyS+8OFUPVNz
- TLSH T1BD44390023F48227E2BF6F79FCB4244987F5F647F86ADB5D058468ED19633909841BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
283382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/build/obj/Velopack/Release/net10.0/Velopack.pdb
mscoree
_CorDllMain
Name
.text
Size
269KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
current/WinRT.Runtime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
- MD5 edb1f8d15fe41838cd449141187ae032
- SHA1 c7344afcdaced6911ab5288b0ade76f66dd41203
- SHA512 5756ccbafa1440d114f8d9b163ea0c2678300ba24c9979b837ba232cc6813f74a29fc0a23b9bc1d7f53c6ce5f15cdacd6804a755ac816116536c56cd9ca43c0e
- SSDEEP 12288:A4Yh4z+uZSlne+7/SQ2YaxhaNHav96iTtqen:HRSucPTx2YaxhaW
- TLSH T12CB44A80A7FD9A1AE7BE1334B03416144B71FC17AA13E39F674895B81D637998E40BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
76:8b:0e:cb:49:f8:03:dc:83:d0:6b:9a:fc:b5:4e:a4:af:1a:bc:73:6c:7d:76:5b:48:87:e6:c6:4c:bc:a0:9a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 11, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:03:bd:d5:95:5d:0f:3b:18:ad:00:00:00:00:04:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ef:89:3f:56:a1:58:cc:a8:da:00:01:00:00:01:ef
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
522118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\src\WinRT.Runtime\obj\Release\net8.0\WinRT.Runtime.pdb
mscoree
_CorDllMain
Name
.text
Size
504KB
Virtual Size
503KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
current/ZapretUltimate.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e079500cd703323e5d8de04dbebb9aeea217bfb0684ccf8d9512ad7a4264d450
- MD5 18ae66e69e6eddda2a64e91692e4fe9a
- SHA1 834151a8ae5e6d14a729ab8e65ec890eed636b73
- SHA512 0648301c966c02ade7d51b507e5f2a6eb6386fe07bf5b866374e1beabb5919eb397b182ee9c61a0daa51bbf9e2179e40b8e02d9b5b626db4265f46ad35b29f3f
- SSDEEP 768:oXwhRtRBcu0yS8dmsmc4zLBkuTW/vUAjfNy3muYMmU+4RlzEK78lIIBPhKH0HD:oXQtRzShBkoW/iYlU+4nYu8IIDDD
- TLSH T18233190533AE8727C78E17BDA9644155437AE3267202FFBB5D8878EA3CA33941514BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
58298
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/ZapretUltimate.Core/obj/Release/net10.0/ZapretUltimate.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
current/ZapretUltimate.deps.json
- SHA256 f0773eb460f9cc3a41ae9d00cb47bfe1fa8d449a908439f5f6245186840058f3
- MD5 e9d96f20379b35d620958ffcc3b739f8
- SHA1 a7ac128998a84e6376cbb8b6c8284119a5486058
- SHA512 273601485998180c0dcba8ed17267e0a358b49402ecc999dce43dc38d35a0edd489591409b966f8c8ebe9106e17223069750f50ca41aa5e32fe8728b2dd61f28
- TLSH T1E441246AD8C00DB708B127F6283A9382FAA6437F1041499AB8FC542C8F73E976044F69
- MD5 SHA1 SHA512 TLSH
current/ZapretUltimate.dll
- SHA256 c91d84f29e7d0c0ef2dc369133cf14d0eb5a382ae3a4d39aae223a05fc229f8c
- MD5 7e93147a576029928663460da61125c3
- SHA1 9b7d8561ef143f68bafcc80ac475de3302a12eea
- SHA512 be7859387252ccb5b55c56d279d278629cec6bad630ed6a15cbf6827dabfc0ec82d335e6ddc247a6071ce6e20a28b18fc51aa174a1a337d7d3877811ec635f59
- SSDEEP 3072:1Gv1qlnN4IBZrr9T8xAFP+fy/rbI/0HbC/8knekHyF22roE8:Kqj4K1lPX/rbIUbC/8wetroE
- TLSH T137F39E24A3AC8F63EA2FB77D555001A587B5A30A3D1AFB8D9D8E7CFC1592352E410327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
157KB
Virtual Size
157KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
current/ZapretUltimate.exe
- IMPHASH 53e4e12437621212a425d294842d0a96
- SHA256 8919d1b99b5163a9eda0b80c99d48773db06f619eb0fdd363142b1fe0805ccc7
- MD5 633603e72ced3e60139e39d1b17e6f3e
- SHA1 1e78ebb30f1c07996bf0c563371ba108329d7320
- SHA512 452c8ba46c2d0d653d9d83b4b4d73c9a8f2d3be6998a4e8a4c718fee4cc27d45790593a5d350389b1f36c3ed59faa62a97198687cd619be6bbc3881785837bf1
- SSDEEP 3072:wVDxk88wN1nLVu7dL1Z9Qnlf9rE38wGTbzaAT5sb:cHRu7F1nQnB8KK7
- TLSH T1C4F33B13A6A851FEE1B3D678C9924941FB7278594B71A6CF03504EBA0F77BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35228,
count=1, id=258, version=35228,
current/ZapretUltimate.runtimeconfig.json
- SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
- MD5 7e4444b5a3e3cea574693f055f944011
- SHA1 04dfc98aa994475e2803241a1d55bb4277dbb8da
- SHA512 2fd5e7ffd3b12c6962d3ed7d7b99fa09b870173623701690cc0237529c32b008e219e48818a0bc4b6962fba2e3d161b8fa8ce38c03467329b0ddc9e58ef0ae8b
- TLSH T1BFF0276ACA106DB708B933BAD52AC182EB30532B10041D52B5FC081C6F776B21111F95
- MD5 SHA1 SHA512 TLSH
current/sq.version
- SHA256 06026b53ee1b94aa38ebe0db6ebfaf1ffc7e4d0926211484594b1ee5c9aa6e6c
- MD5 0b8b192973b6fc192f141900e47f30e2
- SHA1 6d15f48d3f96e7d47164e31c80e643fe6b3cc8ca
- SHA512 b2d64dcecba392821b55f8215f044a13d028f122da94938730917630703d45bf6a0dfea7a75114ef0ca3b4bd8b5f5eeaa027113647613a6de356688b4ae91078
- TLSH T151F0DD9A9641F70AD4A3525C98C2420DF7FF7EBE68D14854F8C88C5C22842CE8C3F942
- MD5 SHA1 SHA512 TLSH