NewLifeRoleplay-Setup[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource
NewLifeRoleplay-Setup.exe
unpack001/launcher/nlrp_launcher.exe

NewLifeRoleplay-Setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 57f6b4c1c9073e3cf9b4c50e48687b4bdd73916aa61cc229c6ca58d80bb7cab3
MD5 4845ba9588eda5f264fca24972163cdb
SHA1 b9fcff63da6432793d52ea3b928f3c575079ca35
SHA512 7f007abbda08d6d7e2d7dc1957406d195494c38635c80053804a2beed94e09dd7870a5575960d22218c432885fb95e7eade26fd40ac5031b8aaf175542f8b9e5
SSDEEP 3145728:dktUHWsFF7W8NGINV5+V49Kgez8c5aUzl000QhjQyxmM+iGwY2juefaL:utUHW4pGINVkV4ggMoENtQy7+iGwtE
TLSH
T1627833DEBD9ECAE6DECF0DB2990C69F78D46B521AE7C1A7B7C820A20D0E14533716054
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

ss

PE Signature issue

Digest

c2:bd:cd:83:a3:89:9f:cf:2d:0d:de:4e:d9:b0:dd:10:3a:3e:81:fa:72:1e:4c:52:04:38:8c:fa:66:99:f9:82

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=New Life Roleplay,O=nlrp,C=TN

Chains

Sep 27, 2026

CN=New Life Roleplay,O=nlrp,C=TN

CN=Codegic CA G2,O=Codegic,C=PK

Subject

CN=New Life Roleplay,O=nlrp,C=TN

Serial Number

2f:d6:bd:9d:ee:b4:8c:1e:b2:55:07:22:e2:84:ca:7b:12:2f:1f:b3

Issuer

CN=Codegic CA G2,O=Codegic,C=PK

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 10, 2026 - Oct 9, 2026

Subject

CN=Codegic CA G2,O=Codegic,C=PK

Serial Number

3a:30:76:87:d3:f9:75:27:c0:be:e4:8b:e9:82:cc:f2:fd:0e:e7:3f

Issuer

CN=Codegic Root CA G2,O=Codegic,C=PK

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 7, 2021 - Dec 7, 2049

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/MicrosoftEdgeWebview2Setup.exe

IMPHASH 7899cb8ba886a0690bdc28d8b481bbd1
SHA256 e99838c51bb3379b244654aa77e33032d42fc2b5d224c5babce432d9fd3dcb28
MD5 002a596ef62daba511172aef5db50ce9
SHA1 228de41325881c1efaf96ceed0f2461af983c69d
SHA512 48f544959dab8da09a3f6cf5bee4212cfb1d94a52ae65f8c5f5880265ec57d77fce7cb0d24ed767dd3417a05c36d05ed53c1bd7592384102c066c75fc09957cc
SSDEEP 49152:PeiGf3A0K4SY7DALL/YCHZ8F5jyLsZrQ3Mh1D9b+ts:GiyJe3YI8F5eIqe1DBX
TLSH
T14A752211BAE84032E1B3293069F199F20EBDBC715A755A9B03451D6C1F30BE2E73976B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Password

ss

PE Signature issue

Digest

b4:7f:ad:e3:fc:76:a2:5c:38:f1:c8:0d:3d:48:8f:fa:7c:bd:5e:2c:3b:dd:6d:a5:ae:47:b5:b7:0d:7e:4b:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Chains

Oct 26, 2026

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Digest

b4:7f:ad:e3:fc:76:a2:5c:38:f1:c8:0d:3d:48:8f:fa:7c:bd:5e:2c:3b:dd:6d:a5:ae:47:b5:b7:0d:7e:4b:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 28, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Serial Number

64:57:97:41:81:d1:09:95:4f:1c:10:95:8c:65:4e:63

Issuer

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 15, 2020 - Dec 31, 2039

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

1

Major OS version

5

Entry point

33792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType RaiseException LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW DecodePointer VirtualProtect EncodePointer LoadLibraryExW QueryPerformanceCounter GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStringTypeW CreateDirectoryW SizeofResource FindFirstFileW Wow64DisableWow64FsRedirection RemoveDirectoryW GetTempPathW FormatMessageW Wow64RevertWow64FsRedirection GetFileAttributesExW GetDiskFreeSpaceExW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapDestroy LocalFree VerSetConditionMask CopyFileW VerifyVersionInfoW GetTempFileNameW lstrcmpiW CreateMutexW WaitForSingleObject ReleaseMutex CreateEventW SetEvent CreateThread UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery CreateProcessW GetExitCodeProcess ResetEvent WaitForSingleObjectEx GetSystemInfo LoadLibraryExA

advapi32

RegSetValueExA SetSecurityDescriptorDacl GetAclInformation SetSecurityDescriptorOwner GetSidSubAuthority GetSidLengthRequired CopySid InitializeSid IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD SetSecurityDescriptorGroup RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExW RegOpenKeyExA RegDeleteValueA

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shell32

SHGetKnownFolderPath ord680 CommandLineToArgvW SHGetFolderPathW

user32

CharLowerBuffW MessageBoxW

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

ss

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/codegic-intermediate.cer

SHA256 698552460cb0a799149d80d44dd4deb2d3953752e446e47c917121949b4a01fc
MD5 56b078eae96f224616f73f66487631fc
SHA1 15fdaba008a43bba9e29d8b850bb320148a9002c
SHA512 aac5dbe658a26a9bea1a7bad2a819eca637a40e7dfc9cd650f8fd5536cb3440f25a7e9642333943e59e9bc3920c87d50178c9a5384223dd6e385a10bd47299d2
TLSH
T1E1311B3AD658BB2E6F6F54E4C5940A5F4DB19356110070DCB4158C81F89C3E951EAF09
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/codegic-root.cer

SHA256 1078cfa870ed2b2141294ce562b1890d22f149d5f5323fabc05618bd699ae69f
MD5 b7d206730dee3297ca7e74052f92d599
SHA1 5b60f96e0fd2622e5bbb9518b4dce5a542aa3518
SHA512 4549c0548b3bb98e5517fdbbeba7be2ce251ff1efba2fe9042d26ae2849706a18a18666241819c0e07555b5e4b34eaabe312c972d03a5b43a05b49f939329d8c
TLSH
T1D62174A297BE3319DD59BCE4D14E216E5E0ECA582D086DFB860C5A041B82BF0F65528D
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/dxredist/directx_Jun2010_redist.exe

IMPHASH 3a2e47f2192ee653cedbe5370d5bcce1
SHA256 053f76dcbb28802e23341b6a787e3b0791c0fa5c8d4d011b1044172dbf89c73b
MD5 822e4c516600e81dc7fb16d9a77ec6d4
SHA1 7e5d2e5e1a13fbc47f990cc55cbdb428cd12f759
SHA512 04c6347e6db6cff037a1292a88bf062c3e4042fb265a665afdbe7616aed7936f4955a35637a86c30332731762e0052b6f5c721f9fe7682d147e0965a7fb77a63
SSDEEP 1572864:LeKHwu9mdcsB10CvInhZfiuM3Or17hWocUW1o6vSxfcBLuGgf3FmVOUxXBKYSJTw:fwuAdf0CvIjfiu62hgUW1bSxkQGgPb0p
TLSH
T1622833B3F7708603F9E50F371021965C15E2BC4A18FA96C5B6A9F61BACF97CA2530718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Password

ss

Digest

4a:93:17:cd:9f:1a:f1:8a:97:43:8d:88:82:4c:91:62:af:9c:38:9a:ba:85:14:75:5b:26:b6:f6:99:2b:17:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 17, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

1

Major OS version

6

Entry point

27458

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

FreeSid AllocateAndInitializeSid EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA RegCloseKey RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegQueryInfoKeyA RegSetValueExA RegCreateKeyExA

kernel32

LocalFree LocalAlloc GetLastError GetCurrentProcess lstrlenA _lclose _llseek _lopen WritePrivateProfileStringA GetWindowsDirectoryA CreateDirectoryA GetFileAttributesA GetModuleFileNameA GetSystemDirectoryA RemoveDirectoryA FindClose FindNextFileA DeleteFileA SetFileAttributesA lstrcmpA FindFirstFileA ExpandEnvironmentStringsA GlobalFree GlobalUnlock GlobalLock GlobalAlloc IsDBCSLeadByte GetShortPathNameA GetPrivateProfileStringA GetPrivateProfileIntA CompareStringA GetVersion GetModuleHandleW FreeResource LockResource LoadResource SizeofResource CloseHandle ReadFile WriteFile SetFilePointer SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA SetCurrentDirectoryA GetTempFileNameA GetVolumeInformationA FormatMessageA GetCurrentDirectoryA ExitProcess LoadLibraryExA GetVersionExA GetExitCodeProcess GetProcAddress CreateProcessA GetTempPathA GetSystemInfo CreateMutexA SetEvent CreateEventA CreateThread ResetEvent TerminateThread GetDriveTypeA FindResourceA LoadLibraryA FreeLibrary InterlockedExchange Sleep InterlockedCompareExchange GetStartupInfoA OutputDebugStringA RtlUnwind SetUnhandledExceptionFilter GetModuleHandleA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter EnumResourceLanguagesA MulDiv GetDiskFreeSpaceA WaitForSingleObject

gdi32

GetDeviceCaps

user32

SendDlgItemMessageA GetDlgItem SetForegroundWindow SetWindowTextA MessageBoxA DialogBoxIndirectParamA ShowWindow EnableWindow GetDlgItemTextA GetDC ReleaseDC SetWindowPos SendMessageA PeekMessageA MsgWaitForMultipleObjects DispatchMessageA CallWindowProcA GetWindowLongA SetWindowLongA CharPrevA CharUpperA CharNextA ExitWindowsEx EndDialog GetDesktopWindow LoadStringA SetDlgItemTextA MessageBeep GetWindowRect GetSystemMetrics

msvcrt

_cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _amsg_exit __setusermatherr __p__commode __p__fmode __set_app_type ?terminate@@YAXXZ _controlfp __getmainargs _errno memcpy memset _vsnprintf

comctl32

ord17

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/modern-header.bmp

SHA256 0a91028a3cde8d5725e11070d62bc434a491f384dbab61be7590f7dc8e06e1ad
MD5 f29568eb46e9357bd2947a79905b8186
SHA1 1391515a93eb52bfa9b55c381756d45a033cec45
SHA512 3bfe99b00b1da6fc70a97fbc48aa154574032605944e504790553a4ebce6a20e9aad358e406830ff91b84e5996c69137cfe57bd378443533fb05bcd485a49855
SSDEEP 192:2Mp1kahrOFDJKO1U5nwY+u/cxjhCaLOdrKBkbJJG5SvDtLrOR2yLbpWlYfD4G8Rs:2MasOoWu/QQ0Mm6GR2qpdfQRz8xOxw
TLSH
T115C2C3057726CB21C8791079ACF283EC265CAE94CD0E82DBB44DB76F68F64C94D625B4
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 8726ecb41ddc1b59312e7d7d74de12654bc6326ab5ffe673a62352296919f1a9
MD5 ece4b5cd2be53d212bfcc7b79ec2535e
SHA1 b906778630be74bb3d293d0c59009d49b6793e65
SHA512 9fa324fcc6c613af705b231545daa3b9aeb84918a96060a691c074d47b1a1269d1a76d6c29c6994816caa50e94fafef02a2f181a938bf3fc8c17f1cbf62f5b7c
SSDEEP 1536:eUM3ou/iTstxigPb0Z8/G7mpNLQtNlfaMO06N7J2S5GRP6t9tqDTxoHoz4VodMo7:3M3o03SmpNkBaM8P5tqIoz4+dMobgQ
TLSH
T184E30590358CE667E811F3F18B66563D32005BF563AECD8AC79E6DCC17072A0227F996
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
MD5 cf0351a2ab9128838be6b54cea8238d3
SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
TLSH
T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

ss

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

ss

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/set-lnk-aumid.ps1

SHA256 be2cfd3368b2ec500ed6244f1df7b9da4835486f38171dcd58c400af50f6ae30
MD5 4e7cb7c787a4c0c7c343904c85f0015e
SHA1 b9b6645b92a4692afe6422286ad452d6bb00a3c7
SHA512 57c0d995c340789fe7ca4de453f9210835da6ce5dabbf204faededc604d9c8803b217d7a63dfbc2a81b690c1dcc3be46f25cb1d34a135c97b13a5a0486ea5cce
SSDEEP 96:M/B4zNbkmS9C7Kyb5jz665LJHDviYiVzL4uO4doiFRn4UNntxGaF4tvZDic0D:++N8C7Kyd1lWYiVzLROePRn4U7aDDics
TLSH
T108C109026301107DC1531229DB6E7D98EA07E0730AA7F804BC6DA3EC9F1A76D9134BD9
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/vc_redist.x86.exe

IMPHASH e277f1464e7729ad9df5ec047611738a
SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
MD5 99f52708b06b9c695a8d64a44740bf08
SHA1 c2743ffc36d2af40ade0e370be52d6b202874114
SHA512 d0a609f6b2f05939ab82aa5fde1bb0595206653a2ab2ce859a750f71596c4491a8074bb825484e365a4fbcdb820d5de0346e7209ea22214b090b4fe853098dce
SSDEEP 196608:fLZBJflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4L6f6psSD5YM4565kIgoOgP2edk:lHlptVYmfr7yBG/4L6f6pXc65kngP1
TLSH
T1A8E63332E494413BFFB604336A65E9203E7DA628274149F6E3C8FD4D3A7219267F7612
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Password

ss

Digest

a6:4f:ee:ee:7b:4e:53:e4:b3:2f:0a:99:a8:c2:98:ac:dd:55:07:f4:ad:c7:8d:c2:e2:f1:1e:ad:a5:3c:18:f8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 11, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:03:bd:d5:95:5d:0f:3b:18:ad:00:00:00:00:04:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2024 - Sep 11, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:fe:d0:a8:c2:7b:34:21:0b:01:00:01:00:00:01:fe

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

6

Entry point

197349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb

advapi32

RegCloseKey RegOpenKeyExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownExW GetUserNameW CloseEventLog OpenEventLogW ReportEventW ConvertStringSecurityDescriptorToSecurityDescriptorW CreateWellKnownSid InitializeAcl DecryptFileW SetEntriesInAclW ChangeServiceConfigW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceStatus SetNamedSecurityInfoW CheckTokenMembership AllocateAndInitializeSid SetEntriesInAclA SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW QueryServiceConfigW

user32

PeekMessageW PostMessageW IsWindow WaitForInputIdle PostQuitMessage GetMessageW TranslateMessage MsgWaitForMultipleObjects PostThreadMessageW GetMonitorInfoW MonitorFromPoint IsDialogMessageW LoadCursorW LoadBitmapW SetWindowLongW GetWindowLongW GetCursorPos MessageBoxW CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW DispatchMessageW

oleaut32

VariantInit SysAllocString VariantClear SysFreeString

gdi32

DeleteDC DeleteObject SelectObject StretchBlt GetObjectW CreateCompatibleDC

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CoInitialize StringFromGUID2 CoCreateInstance CoTaskMemFree CoInitializeSecurity CLSIDFromProgID

kernel32

GetFileType GetStdHandle EncodePointer InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind CreateFileW CloseHandle ExitProcess CreateFileA SetFilePointer WriteFile GetLastError GetCurrentProcessId GetSystemDirectoryW LoadLibraryW lstrlenA HeapSetInformation GetModuleHandleW GetProcAddress LocalFree SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetTempFileNameW RemoveDirectoryW SetFileAttributesW GetTempPathW MoveFileExW FormatMessageW lstrlenW MultiByteToWideChar IsValidCodePage LCMapStringW ExpandEnvironmentStringsW GetFileSizeEx GetFullPathNameW ReadFile SetFilePointerEx SetFileTime Sleep GlobalAlloc GlobalFree CopyFileW GetLocalTime GetModuleFileNameW CompareStringW HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FreeLibrary InitializeCriticalSection DeleteCriticalSection ReleaseMutex GetCurrentProcess FindFirstFileExW TlsAlloc TlsGetValue TlsSetValue TlsFree CreateProcessW GetVersionExW VerSetConditionMask GetVolumePathNameW EnterCriticalSection LeaveCriticalSection GetSystemTime GetWindowsDirectoryW GetNativeSystemInfo GetSystemWow64DirectoryW GetModuleHandleExW GetComputerNameW VerifyVersionInfoW GetDateFormatW GetUserDefaultUILanguage GetUserDefaultLangID GetSystemDefaultLangID GetStringTypeW DuplicateHandle LoadLibraryExW CreateEventW ProcessIdToSessionId ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitForSingleObject GetProcessId OpenProcess CreateThread GetExitCodeThread SetEvent WaitForMultipleObjects LocalFileTimeToFileTime SetEndOfFile ResetEvent DosDateTimeToFileTime CompareStringA GetExitCodeProcess SetThreadExecutionState CopyFileExW CreateMutexW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetThreadLocale GetStartupInfoW IsDebuggerPresent GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode DecodePointer WriteConsoleW GetModuleHandleA VirtualAlloc VirtualFree SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetCurrentThreadId WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo RaiseException GetTimeZoneInformation

rpcrt4

UuidCreate

launcher/nlrp_launcher.exe

IMPHASH 5334b8e8fbe8edd86a3957b1204d6697
SHA256 1fd150973d6587888c9bf7ae3ceb228228180ec879c7e7d796a074bc37110546
MD5 ad4fe14417ffeca11251d1ae2fb9052f
SHA1 d5cf43989ce89158915e451cb2514e707c8ba5e7
SHA512 5550f670f1d4fc1954043e323a1d642bbff255abe9e37a5ec134aea85c30a10ae25d02236879ee6a5650ca0bf0bfba3876f645ff64ec45937f67dc29d1aa67bf
SSDEEP 12288:dtE8eRGiWtoQpXRjD6vMCIeO9jKJkDlNuNLZYPRaIHWfB2M/dgwwUbbTbfZb6bjl:dtlTwM+JkZNuNLZYpaIHWfB22dgzZ
TLSH
T122D48D10B662D032E565A5F05D2CEFA696B9BC305F6149CB73C04FBA4D206C26B35F2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

ss

PE Signature issue

Digest

6f:9b:48:a2:22:58:f1:69:78:b6:30:ef:93:e8:06:b9:4d:56:c6:58:77:f8:df:36:ca:5a:d5:2b:0d:0a:c2:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=New Life Roleplay,O=nlrp,C=TN

Chains

Sep 27, 2026

CN=New Life Roleplay,O=nlrp,C=TN

CN=Codegic CA G2,O=Codegic,C=PK

Subject

CN=New Life Roleplay,O=nlrp,C=TN

Serial Number

2f:d6:bd:9d:ee:b4:8c:1e:b2:55:07:22:e2:84:ca:7b:12:2f:1f:b3

Issuer

CN=Codegic CA G2,O=Codegic,C=PK

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 10, 2026 - Oct 9, 2026

Subject

CN=Codegic CA G2,O=Codegic,C=PK

Serial Number

3a:30:76:87:d3:f9:75:27:c0:be:e4:8b:e9:82:cc:f2:fd:0e:e7:3f

Issuer

CN=Codegic Root CA G2,O=Codegic,C=PK

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 7, 2021 - Dec 7, 2049

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

248048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

nlrp_launcher.pdb

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable

ole32

CoTaskMemFree CoInitializeEx CoUninitialize

advapi32

EventUnregister RegOpenKeyExW RegSetValueExW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken RegGetValueW RegQueryValueExW EventWriteTransfer EventSetInformation EventRegister RegCloseKey RegCreateKeyExW

shlwapi

PathRemoveFileSpecW PathFileExistsW

shell32

SetCurrentProcessExplicitAppUserModelID ShellExecuteW SHGetKnownFolderPath

user32

GetSystemMetrics GetMonitorInfoW SetTimer ShowWindow DispatchMessageW TranslateMessage FindWindowW LoadCursorW RegisterClassExW CreateWindowExW LoadImageW SetForegroundWindow ReleaseCapture UpdateWindow EnumDisplaySettingsW PostQuitMessage KillTimer SendMessageW wsprintfA GetWindowThreadProcessId GetWindow GetWindowRect IsWindowVisible EnumWindows FlashWindow GetMessageW DefWindowProcW PostMessageW SetProcessDpiAwarenessContext SetWindowPos MessageBoxW GetDpiForWindow MonitorFromWindow SetWindowRgn GetClientRect

gdi32

GetStockObject CreateRoundRectRgn

bcrypt

BCryptFinishHash BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptHashData BCryptDestroyHash

iphlpapi

GetAdaptersAddresses

kernel32

GetOEMCP HeapReAlloc FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect HeapAlloc UnhandledExceptionFilter IsDebuggerPresent WriteConsoleW GetFileType GetStdHandle GetModuleHandleExW GetACP ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCPInfo GetStringTypeW LCMapStringEx IsValidCodePage FlushFileBuffers DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeAllConditionVariable ReadConsoleW FreeLibraryAndExitThread SetStdHandle GetCommandLineW GetPrivateProfileIntW GetModuleFileNameW Sleep ExitProcess MultiByteToWideChar WideCharToMultiByte GetSystemPowerStatus GetLogicalProcessorInformationEx GlobalMemoryStatusEx CreateDirectoryW GetEnvironmentVariableW DeleteFileW LocalFree WriteProcessMemory TerminateProcess WaitForSingleObject SuspendThread ResumeThread GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle VirtualProtectEx GetThreadContext GetProcAddress SetEnvironmentVariableA FlushInstructionCache QueryFullProcessImageNameW CreateProcessA SetThreadContext GetTickCount GetExitCodeProcess GetSystemFirmwareTable GetVolumeInformationW DeviceIoControl CreateFileW GetWindowsDirectoryW ReadFile HeapSize FindNextFileW WriteFile RemoveDirectoryW SetFilePointer FindClose GetFileAttributesW SetFileAttributesW LoadLibraryW MoveFileExW SetEndOfFile SetFilePointerEx CreateProcessW PeekNamedPipe GetLastError GetCurrentProcessId WaitNamedPipeW OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree GetModuleHandleW LoadLibraryExW GetCurrentProcess LocalAlloc FreeLibrary SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime QueryPerformanceFrequency QueryPerformanceCounter GetExitCodeThread WaitForSingleObjectEx GetCurrentThreadId GetFileSizeEx WritePrivateProfileStringW FindFirstFileW

ws2_32

closesocket WSAStartup socket WSAIoctl recvfrom FreeAddrInfoW WSACleanup setsockopt ioctlsocket sendto htons bind GetAddrInfoW

dxgi

CreateDXGIFactory1

crypt32

CryptProtectData CryptUnprotectData

Name

.text

Size

389KB

Virtual Size

388KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

launcher/web/assets/bg-login-CdAYEclS.png

SHA256 3c65399b5d74c00ce0566052e931354d17945c7180863bd76235650dde934b2e
MD5 8922c1fc56a98a2d8c0487ee815cb4b5
SHA1 5c610025140404f747621531835876b0a5d7cea2
SHA512 026eebac6ae04a87986303e409238bbc9cef0d3202bd4bef2ea861f425991a8151d7ed84b9ab9de444e5f70bdb3c5e20605c30693a7ba4754ff09b9ac45848b9
SSDEEP 98304:Xno/T9CK6S0Lcfh1vcL4YIutAPyaRz1M91E6n82:a56SmSlcLoTa25M91EqB
TLSH
T14CF53347CADD1620E16E6ABB86C67C1E08F93E215F7A8A8D8548D590F3EC9D403BDB11
MD5 SHA1 SHA512 SSDEEP TLSH

Password

ss

launcher/web/assets/bg-login-lite-DfLHpMTP.webp

SHA256 4b5846f740c68725852211688bbfbb54f67919abd38a2882945b0d770dd8a719
MD5 aac655f33d1541130f91edd6deb266f4
SHA1 4c2565202e417d148c6bf6a13071bfe44312b509
SHA512 7ee1ffa6569e8ee194900f341c670c51f65721835dc21be63f201e651258e2b29a411ed8b32c44e09db028b288c45eddd79898b678dfb1ff0945a1b04d333214
SSDEEP 3072:RdbXR57ObgS2fcrQVHThahqbnsIpOrqC1+U3PNhNZQoqF9G5HqJO6s1:v9xfcrQLaOlBOpMTI6Q
TLSH
T18FF312364C6FC7758738F6193961048631C17E258035B2AB73A8234B973B5CE65B36BE
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/bg-main-BWvULcgg.mp4

SHA256 f65235eea448b498ac7172ec9c3d68034265a7032d427b73e70fb6567069546c
MD5 7dea64a58904fd064e7966db87bc09c6
SHA1 31a88a650d57d6eb05b127cc18a639b9c542d2de
SHA512 853244e42951e3bebe17c4ee9d059ac219dd82ff2a080c3c5191787ceb83225303b8f3fc2f7407fb01a445bf557a773014639e5ad18119d08eff85db405ff725
SSDEEP 393216:remDK0O3X9JASbSBzFjDE5FHDsly26VIK40ghVedubGR5VmqhxSJ43V/JolGG7BC:rnFO9JvSB5I5FI4XVW0ghV3bQpTQ9+5r
TLSH
T15D47330AE3429006F095C7F601C6975676A1B4A6BE4DB36743B8A6B0F5F0C6E3D8F8D4
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/bg-main-By3J1Zsp.png

SHA256 1e34cec243f5eb3ad3fbcf91600df8c9e5de9c8dfbf59ff71c1d2ad3caf79ff6
MD5 8a86df4b038a2e71b21957701ec45239
SHA1 98f8eb0faa882c7438ce323a6aa95438c9d05b43
SHA512 75e764895ce51fcab3929dac9a626de7711c6e70692b58783ace4555193e87878d1cbfb5b23b754714fd229ef95e7d4da6349fb0b80a2e9af52596ce830716f2
SSDEEP 98304:nTYKp/lyv6+2POD+sATzrCus2E2qxZ1xaylmm6/UJhJ8wgzR6Niz7NBKr:p/u1QmVDA7qP1xxm7/UJhJyR6Ns5BKr
TLSH
T15C3633E8B9F9B4F0D7BE5932444F8398A8F949A8F6A824E0B415174CC43B3CED65C8D5
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/bg-main-lite-ssttM7Bm.webp

SHA256 ba88bd9c80621a4383c33e5316108a46bc09a5d6f90043e16d28519920703434
MD5 664cf476e4af724d2143416ad933b389
SHA1 6473ae62cfc4404106044294fa7a698f0df75f9f
SHA512 dfdc64a595e3528ccfec3871004f96daa54ec0b1826f1211c7d2b69cf344e20df08c3adff6a4e6da0ea60991158e836f2f7b6b5bf68bb79ae28d2d310fad852e
SSDEEP 3072:FQMO6WfEUfhz+SUcDW0UGlfwNdPuCCK5LmW1ZKjw:FQM89xSAb27xC2n1ZEw
TLSH
T13F0412620DBA7BA3BCE1727A577764420242B167383743FB93655D8EE8633D15F22B08
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/bg-update-BPb-ZE-I.png

SHA256 19f169c359253b97a11eb55c35edf387a4f6bc6696e693248d0c14515f582e70
MD5 ba1bd4e40b6149b40c6207f288ed830c
SHA1 ce86530e02fdf230e4383a29cdcea183de6e78e1
SHA512 ca47977cd3b0e38f8abaf9b7deda14b53cf4b58cb5d823b041410e03c6ec3bf8c5aa3bf4c0f40358f0791ec35018efb42f2e3f783cfe75df7e8aa2c85c1ae3c6
SSDEEP 49152:9cXTv3NqDjgmpZjMs5PBWEYT2rJMgxOFcSqUwp0NTvfBD6x3D:iT/NqH1h5J5Pwc3cTfBKD
TLSH
T155B5336485561FF8C39B4211E82FA89BB6E8240C0F145F2ECE91B584FE7C8C2DB46B71
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/bg-update-lite-BDBRm7Jx.webp

SHA256 cf53fcef368752bc12ab7fd7f7c3578fabcd8e03cae967c812d157b7c1ca4a85
MD5 b6712671bd97f7b650110e60169bb7b2
SHA1 c24126b81b28132d4890727d512ac9d919e5b45d
SHA512 ab0cddea321a00c2c723478f1b233b3e16ddf35ca06e4574555c1da5c181bef29fea0e1589f11a2dd70b5397c54c8ecaaf4bf3696e11991650b4fbcb2f6223d1
SSDEEP 768:QpmEgFP4cNbIRbvelAw3BuL7P4XyfBLajSYk2Eh3032uJr6SZG:qwFPDNbJlP3BungXWBLajSu0Q2uJGSZG
TLSH
T14333025ABF9D0BBE042CD5A9FC7134C61E335414288D47F93A6ECE3D92B424BA5EC162
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/index-CebXhQB6.js

SHA256 eb740d9ac73199b94c7f01c83ef19061da1306d8a9bfbefb1c841bdf55a35e42
MD5 0343c670bb537938d3997ad7f36023ee
SHA1 f5da2c7d2db7384b77ff91021e302029a5da0b17
SHA512 226b9b49f4b9bd93b104d586fd3a66d75a98ccde23c7ab3b647f79b0d074bf7dae38dc0ebf42c7c30e5cbc8e4a141635c41ffd624c5f6f98471276e58b3c7b0e
SSDEEP 3072:KQMcLV1H+OeZUZU0Dd3w8uosZ2Wkwa8Ds:zq/ZUZU0Dd3PJdXn
TLSH
T194143BE8B09DB655FFA347A520AF0107733D1923681D4860B224EDAA67F504661BFFEC
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/index-Dds4stve.css

SHA256 4b15586b0a06fbc3a81e24de034e28a3f3f3c14c5f2a848864f883a0148687ca
MD5 6d9551d289cf8303881528da77d99fbf
SHA1 83f3294845e4fc18be302d6ad9e90d7b92415f48
SHA512 f99d2449417e6eb8c2a7b54422548ffc206dc602982c41546ea4ef98e10083ec0b8a62bc1fa9db63af17eace3bbf4d533d084d009c7c3de4139bb1fd2cad0295
SSDEEP 192:/7G1UcKFY6XDT83Ty/1tcTFYDXDK83IJU1GcIFY4XDh83hQt1/chFYRXDI83um2B:uVEYK+BMJzCoQ0/suyLeoq9uMkc
TLSH
T17162FB35103EA440E6E7CD6234C87F57241D901295EA0227EA3D0AAC8FFBC7B57B6B25
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/inter-cyrillic-DqGufNeO.woff2

SHA256 71d5ee93cc1e9f1d520a3a8b66456de18c7879d8df09d57fcd2eaff75fef0075
MD5 de93fdc85e3d9009340f44f401ce62cf
SHA1 9f73b2f43ea3bf37cc8e90a5aa8c7e668ec44504
SHA512 1c10e80e6fcd197c5acb2b811794a1d13f7b025868349d1b261e02424e2f1970c7f03c502c6190d386f2e78cdb126a374c64ee6c25eb848f82c5ff1462b3a367
SSDEEP 384:+llEwUsRDydOWF3kczROPIMjvFyNBNaK8QXNkhgP0DXzY0me:+lSwbdDWHeFjtyvdjX2w0DXzY0me
TLSH
T10182E043EB7D80E02039AB687545CD6B76C84AC529D993C4169FFDE6D6633C01E9F08B
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/inter-cyrillic-ext-BOeWTOD4.woff2

SHA256 ca157063339ac4ad418f214f3abfed119b0798ab4d377386ce5c9e5a7a435ebd
MD5 251d36f2b5a66c6e79ad71625244d016
SHA1 705d625066dba0c159f137e73f91e232097d208d
SHA512 e45c559e864b6b8493da9beb808fd66fd7241233eff645455fd68ea089731f7304e68337d1703573af163ed55ab0902ceaa8debd3bd7c2e705fe6384cd89defb
SSDEEP 768:jtYEE9j1B1Te7fHCeTw+krvF9Kpd2MGscWUNl0BV88oYZO:j2h3OXTb2vF9EkMncWS8oYs
TLSH
T18CC2E18C372AE971D5DBB79F0B1EE5CA356761021886BE8DB4505E07D47A4CC3373889
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/inter-greek-CkhJZR-_.woff2

SHA256 1be3448e292fbf05ffe176fe1e43f135013d50b1e7d324ad1a558f623d3bb6f6
MD5 8c7f6aea5e86ceaf66b92da8be90e5f1
SHA1 c68aff863e1836a239db315e7179d46f34385ece
SHA512 94885624c66700033d1479e8b1238bf5a9277e24266cdf31f97a21fa2af6c36bdb0f8a7ebab5c595ba1caab44d108c1bd84adeb9db7b973e36c7b940c95e9322
SSDEEP 384:g8e8A18hClzc31FFBVrGBaOdtEiiY5CM7oYQQMACqt:gJ8A1KFtVKxtHJ5CM7kQMAnt
TLSH
T16282D0E79B823FE3F0E7C5F396256AA4BAAD00D5332D418E5004ADA1D6DD0593908BD0
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/inter-greek-ext-DlzME5K_.woff2

SHA256 6e9e020a25f9b56d418f2c085b1d3c09725a4da23fe693a5b463064606732190
MD5 318d4ba568ac4340f4112bd0fb4d9376
SHA1 04fe624f325e07c9cba980202a958d8b9a35666f
SHA512 905d0024b1be53efe96cadd0b9f556e1ec583468c260bc7c9c343cd50c2b3b1f5b3788eb63ba1553fffe65202f8e4fd83950adc1ab750df1bc0bce8107445779
SSDEEP 192:P2nRyOkzBn9MwYSy6Js1qoygAqPI0bDiU1p/kbFcmKRmX0f3ldnrKp6iga2Tw:CR/E9y6J619AzCiU1myls0f3L+px
TLSH
T19632BF7493D2290CC6E5837E1A50E31D2EA84385DE1B6E7C4B9E09E5C5D28A13C3C3AA
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/inter-latin-Dx4kXJAl.woff2

SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/inter-latin-ext-DO1Apj_S.woff2

SHA256 34b9c504cab7a73e37b746343a449132e56cf7b5481af2cb81dc74dcff25c956
MD5 1ad231aac0a8a891b8374aa5526a5813
SHA1 cf3eb50fb21014c07d4311ef4c03a4fd587889b4
SHA512 fd38626bde9bd682bfa646efc8f66d38d42699f1fb27e243fc9fe71fc40c239bda58c78c63c196c0d61ab7f190550103d98ef0d41789f5ee65e0de4512967937
SSDEEP 1536:GBMnaLH450Gij0Agt/pL69wCE0nwvpYN7Vav7weXroCxscl0UP24ly9TqJueVG:GyGHyKj0AgBpLIElvpYTajwsPxRI4lyj
TLSH
T1A98312184C2867832F6C57FA3BC18464DD51A748D0562BECC20A8BDBF4E97902F69FD8
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/inter-vietnamese-CBcvBZtf.woff2

SHA256 5c66f9e07e90c6d4ac4922cc68d60de26c17b1858e677fb5e603fce3952b3ff2
MD5 9df17551da76cba6ee2d5d35fc762ed9
SHA1 9c1cad863a03434fb9c1501e9dd27ac14ed7cf63
SHA512 da96c3931f9fb3584bf27c66faec92ba4118b7e5d47815f92528a363abe3933df3a570165cbdaa44c94acae8a1d25865389f79191ba5eea129d263f7c821c5ae
SSDEEP 192:LO2p32aTpmBmaYdF5pYYUY+n5YGq7jdWkkD9N5odUb:LOY5aYdHp8Y+DcdhnU
TLSH
T13F22AF64BA5D32F48A77263FFA6E5B8513B1595BF13C81679913332BA00706DE0944E3
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/news-1-DySXWMXn.jpg

SHA256 2fa13d5ed18ee4ee5a6f7f47404b64e8fec489db34291bea1cf756afd5439f74
MD5 658a943d5155afb9efbae7f6b9424243
SHA1 c74c2bd91b823659df5e340aeff0d2a49c8755cf
SHA512 cb465f7f9c586b886de94b9d5be6c6e5eb6ac87c7fd9af5aecc1c66f7a310af1e5b5d9c6b82c89e714f96fbd1d089dbdae523a631802a0ac5225d1ecdb3062e3
SSDEEP 6144:6LzWbtMD3tgW3VxkEHGmOXnBMy9ENYHdzN71A3hqj/F2zQ/VnTw6fuhVlIQkUeKP:czWRMDdgWZHGVMEHdZyRqDgctnCzIqeO
TLSH
T1567423A253CEA8EA56435580EF2BBF309DF6F9C902E14635000E1FAA645E3568BD0F59
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/oswald-cyrillic-BSPNd759.woff2

SHA256 95c3d8d1db01b5ecd85b0d90aa81d39d24231f74de28c7418cfd8c08261fe929
MD5 e4645718d3b4aa628932452fafba025f
SHA1 d8672733e96a06383567981c1a74a89d80bc8c68
SHA512 52544b7428ab155ed540775682aecd0dcbe574369e21e0040fab858687753f90875463044ad46bb795da88dc54ab15b23e38c7aa80b28e8989da72b36d841dcb
SSDEEP 192:7Bs/tBdFZ+UCJT9L7F/ja62rASMmRIOczccChUDO6+s8ZTGSheiGbhm0lE8Wxn:1s/h+UCJ5Fa3APeIdc5sE+iGFC8Wh
TLSH
T1C732C0C6462C995684AF3678D29BD79F1801884D232493229F9431F26B2FF25B632E13
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/oswald-cyrillic-ext-Bh-246-H.woff2

SHA256 fd48ff70d399cc905ec878993b1a72b6c0a4863c46118ec413e01e1fdc3127c3
MD5 fd4dcca39bf1c2149b90124f53ee4178
SHA1 f1b04b87171b93a3d88b4b2e844faab339c612f7
SHA512 728c4c84bddc91d0ade157256fff1f316d88e90e2f9bf0b03df5994ccbf679ab0069cc75b23f1445bcc2c089a20741e57a83cd6512653de0b0a4ce800b0c9168
SSDEEP 384:bS3sR+BAifH+H5OEFgxruZdHhWutq5Wq9:e0FizEOxruZdBDg5n
TLSH
T16752B0DA60523070977D1FDCB1AB83389209579AF477A446790069942FC94FEAFFC292
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/oswald-latin-9AWb_KF-.woff2

SHA256 571f3457dab507b6f2ce5394d593ca015251b69fea81ab7a546bd2368e9fc3ed
MD5 5f49329007f1e2c86462fd68a5f3affe
SHA1 aabe123b52750eaf9e6fe604204c2687222b0c54
SHA512 59b693cf63d3bc706adc09d289f51f3be1ed2cec80a6e1ebfaf35a5b569ed006e5785cf1faa884e133ab83eb7a0fce9c4545c512c9e7fed63e94264fb13c4937
SSDEEP 384:89cq4KprqBvQGNLahU+kaK7dWYQmQp48QMg9syZ/0TxUAWKymEIetG0pLlZxeH:8iq4cmvfNLahDK7QVmQqhw1EjLLMH
TLSH
T14DA2F1A25A83D949FB68403E3B80287D963A03C733967A63575225EBBAE1C53305A4C9
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/oswald-latin-ext-0aIcqSua.woff2

SHA256 99016932b273efa7d55b3a0ae9fe4babc6dbdcd7539f58a742697054f89b1142
MD5 4276e5fb1957782e7d33184615498ef6
SHA1 cf8028a7a9f18f603c0c88dd68f2e7808f2cd0d5
SHA512 3af0ed664e1c987e1a38e94a495aa8973b3d6e6e5e1f9111574ac434b0ca4559ee1b04205cd7f581a329f3d2e78d4cf6f0b9f6e304ea10b64229ba75cf742e77
SSDEEP 384:EAfnkm7VI6sRhX5ZkzfqZT17M0mUTruWW0s8krjkEQMnxIaZE/V:EAcmx9sRnKzE1g0mUT6WWXZjkaxIaZo
TLSH
T1C282D0146D312851EFCB5FB90B7B0746B605BA69C3326478B3ED098C7594FEB4B06D02
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/assets/oswald-vietnamese-JxfGVIrJ.woff2

SHA256 0e6ae07493c5ebae5e815123be8fe99b34f7b13dac4a0907e072e244dd7edcdd
MD5 279ec41e5bf7701710546adabaad5ea7
SHA1 5a04eed6637efb94fd19929365de7b82dd56ef9e
SHA512 96ffd785427c7143ad8a32921e6ce2ea67d87b90537a56402d34d33d4fac7e8e6d3f8fcbe181e9efd9b2c710f8bb525240baae3cab6ba2e2c9add9dc89395171
SSDEEP 192:1drx0gcpbLTCGM9zM5cFrYaAdpNDfS4GNSAi:jSPT8QTbGNA
TLSH
T15FD1AEC276844F35C53966E20FED44ABDAAD419C05C8E24EE0A077264EF044DEFA2789
MD5 SHA1 SHA512 SSDEEP TLSH

launcher/web/index.html

SHA256 4ee160da508f0c3a6ed646eb7bc69210a987af549872cc8891d9de4cf682d951
MD5 228152c344f09f645d61bc9459887413
SHA1 9fd8aee2f579b55185457db324c19037509732ba
SHA512 623eba9abb00fd74a1ecd37624ef9f9cba4fc7549413ff546eb5085f99ac0ec224bfa7bd3ec4cf9bb91ee34a182aa495f5e111b3789cbf8ac1f24f40ce635473
TLSH
T151E02B45D8E18A15536007645FC1B5086A96DB47438AAD047DBF50B91FCCBC2CDCF5B8
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer

NewLifeRoleplay-Setup.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/MicrosoftEdgeWebview2Setup.exe

PE Signature issue

kernel32

advapi32

ole32

shell32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/codegic-intermediate.cer

$PLUGINSDIR/codegic-root.cer

$PLUGINSDIR/dxredist/directx_Jun2010_redist.exe

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

version

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

$PLUGINSDIR/set-lnk-aumid.ps1

$PLUGINSDIR/vc_redist.x86.exe

advapi32

user32

oleaut32

gdi32

shell32

ole32

kernel32

rpcrt4

generic

launcher/nlrp_launcher.exe

PE Signature issue

winhttp

ole32

advapi32

shlwapi

shell32

user32

gdi32

bcrypt

iphlpapi

kernel32

ws2_32

dxgi

crypt32