General

Malware Config

Signatures

Files

• 7679786127.zip

  .zip

  Password: infected

• 2193f3f8bc4456eac49879d02edf997c4e1f991dae589a01380325d37973333e

  .zip

  Password: infected

• DATA PROTECTION/Privacy Policy.txt
• DATA PROTECTION/advapi32.dll

  .dll windows x64

  Password: infected

  cf49de37d6832a2e30a495cfe792c5d3

  
  

  Code Sign

  33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c

  Certificate

  Issuer

  CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-09-2021 18:23

  Not After

  01-09-2022 18:23

  Subject

  CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:07:76:56:00:00:00:00:00:08

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  19-10-2011 18:41

  Not After

  19-10-2026 18:51

  Subject

  CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  35:71:3a:ed:36:6c:0f:91:c7:97:71:46:7d:89:eb:e2:d5:18:ad:17:62:cf:4f:58:50:46:12:28:d5:7c:7a:8d

  Signer

  Actual PE Digest

  35:71:3a:ed:36:6c:0f:91:c7:97:71:46:7d:89:eb:e2:d5:18:ad:17:62:cf:4f:58:50:46:12:28:d5:7c:7a:8d

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  30-06-2022 15:35

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  msvcrt

  memmove

  iswctype

  _vsnwprintf

  memset

  memcpy

  memcmp

  __C_specific_handler

  _vsnprintf

  mbstowcs

  iswalpha

  _stricmp

  _wcstoi64

  _i64tow_s

  _wcstoui64

  _ui64tow_s

  _ultow

  wcscat_s

  _wcsicmp

  _errno

  wcschr

  wcscpy_s

  wcstok_s

  swscanf_s

  wcsrchr

  wcsncpy_s

  wcsstr

  swprintf_s

  _wcsnicmp

  wcsncmp

  strstr

  strchr

  tolower

  wcstoul

  _ultow_s

  wcscmp

  ntdll

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  NtSetSystemInformation

  DbgPrint

  RtlFreeAnsiString

  RtlGetCurrentTransaction

  ord1

  RtlLeaveCriticalSection

  RtlEnterCriticalSection

  RtlIsTextUnicode

  RtlLengthSid

  NlsMbCodePageTag

  NtQueryInformationToken

  RtlxUnicodeStringToAnsiSize

  RtlSubAuthoritySid

  RtlGetThreadPreferredUILanguages

  RtlSubAuthorityCountSid

  RtlMakeSelfRelativeSD

  RtlConvertSidToUnicodeString

  RtlUnicodeStringToInteger

  RtlAllocateHandle

  RtlIsValidIndexHandle

  RtlFreeHandle

  NtOpenKey

  NtQueryValueKey

  NtClose

  NtOpenThreadToken

  NtOpenProcessToken

  RtlEqualSid

  RtlAddAccessAllowedAceEx

  NtSetInformationToken

  RtlCreateSecurityDescriptor

  RtlSetOwnerSecurityDescriptor

  NtDuplicateToken

  NtCompareTokens

  RtlAllocateAndInitializeSid

  RtlFreeSid

  RtlIsGenericTableEmpty

  RtlEnumerateGenericTableWithoutSplaying

  RtlDuplicateUnicodeString

  RtlExpandEnvironmentStrings_U

  NtOpenFile

  RtlCreateUnicodeString

  NtQueryInformationProcess

  RtlGetLastNtStatus

  NtQueryKey

  RtlValidSid

  LdrLoadDll

  RtlImageNtHeader

  LdrUnloadDll

  NtDeviceIoControlFile

  NtQuerySystemInformation

  EtwEventRegister

  EtwEventWrite

  NtCreateKey

  NtSetValueKey

  RtlDeleteElementGenericTable

  RtlAppendUnicodeToString

  NtDeleteKey

  RtlInsertElementGenericTable

  RtlCopySid

  RtlInitializeHandleTable

  RtlDestroyHandleTable

  EtwEventUnregister

  NtEnumerateKey

  RtlIntegerToUnicodeString

  RtlStringFromGUID

  RtlAppendUnicodeStringToString

  RtlFormatCurrentUserKeyPath

  RtlInitializeGenericTable

  RtlQueryRegistryValuesEx

  RtlLookupElementGenericTable

  RtlNumberGenericTableElements

  RtlGUIDFromString

  RtlUpcaseUnicodeChar

  NtQueryVolumeInformationFile

  NtOpenSymbolicLinkObject

  NtQuerySymbolicLinkObject

  RtlPrefixUnicodeString

  RtlDetermineDosPathNameType_U

  NtQueryInformationFile

  RtlGetFullPathName_U

  RtlUnicodeToMultiByteN

  RtlNtStatusToDosErrorNoTeb

  RtlAnsiCharToUnicodeChar

  RtlMultiByteToUnicodeN

  RtlSetLastWin32Error

  NtTraceControl

  NtTraceEvent

  EtwpGetCpuSpeed

  RtlIpv4AddressToStringW

  RtlIpv6AddressToStringW

  RtlInitAnsiStringEx

  RtlInitUnicodeStringEx

  RtlCreateUnicodeStringFromAsciiz

  NtRenameKey

  RtlAddAce

  RtlGetAce

  RtlAddAccessDeniedAceEx

  RtlSetDaclSecurityDescriptor

  RtlFirstFreeAce

  RtlValidAcl

  RtlAddAuditAccessObjectAce

  RtlGetSaclSecurityDescriptor

  RtlAddAccessDeniedObjectAce

  RtlSetGroupSecurityDescriptor

  RtlGetGroupSecurityDescriptor

  RtlSetSaclSecurityDescriptor

  RtlxAnsiStringToUnicodeSize

  RtlGetControlSecurityDescriptor

  RtlAbsoluteToSelfRelativeSD

  RtlAddAccessAllowedObjectAce

  RtlGetDaclSecurityDescriptor

  RtlInitializeSid

  RtlGetOwnerSecurityDescriptor

  RtlAddAuditAccessAceEx

  NtQuerySystemTime

  RtlTimeToSecondsSince1970

  EtwEventSetInformation

  RtlImpersonateSelf

  RtlAdjustPrivilege

  RtlCopyString

  EtwEventWriteTransfer

  EtwTraceMessage

  EtwGetTraceLoggerHandle

  EtwGetTraceEnableLevel

  EtwGetTraceEnableFlags

  EtwRegisterTraceGuidsW

  EtwUnregisterTraceGuids

  NtWaitForSingleObject

  RtlGetVersion

  NtQueryInformationThread

  NtSetInformationThread

  NtQuerySecurityObject

  RtlRunOnceExecuteOnce

  RtlRunOnceBeginInitialize

  RtlDllShutdownInProgress

  RtlRunOnceInitialize

  NtQueryPerformanceCounter

  NtWaitForMultipleObjects

  WinSqmAddToStream

  RtlCreateAcl

  RtlValidRelativeSecurityDescriptor

  NtCreateFile

  NtWriteFile

  NtReadFile

  RtlWaitOnAddress

  RtlWakeAddressAll

  RtlQueryPerformanceCounter

  RtlAddAccessAllowedAce

  RtlAcquireSRWLockExclusive

  RtlInsertElementGenericTableAvl

  RtlReleaseSRWLockExclusive

  RtlAcquireSRWLockShared

  RtlLookupElementGenericTableAvl

  RtlReleaseSRWLockShared

  RtlEnumerateGenericTableAvl

  RtlDeleteElementGenericTableAvl

  RtlInitializeGenericTableAvl

  RtlReAllocateHeap

  RtlDosPathNameToRelativeNtPathName_U

  RtlReleaseRelativeName

  RtlWakeAddressSingle

  RtlDestroyQueryDebugBuffer

  RtlEqualUnicodeString

  RtlQueryProcessDebugInformation

  NtQueryMutant

  NtQueryObject

  NtAlpcQueryInformation

  RtlInitializeSRWLock

  RtlCreateQueryDebugBuffer

  RtlOpenCurrentUser

  NtQueryMultipleValueKey

  NtReplaceKey

  NtSaveMergedKeys

  NtSaveKey

  RtlValidSecurityDescriptor

  RtlLengthSecurityDescriptor

  RtlGetNtProductType

  RtlCopyUnicodeString

  RtlOemStringToUnicodeString

  RtlUnicodeToMultiByteSize

  RtlUnicodeStringToAnsiString

  RtlDosPathNameToNtPathName_U

  RtlAllocateHeap

  RtlNtStatusToDosError

  RtlFreeUnicodeString

  RtlInitAnsiString

  RtlInitUnicodeString

  NtOpenKeyEx

  NtSetInformationKey

  RtlFreeHeap

  RtlAnsiStringToUnicodeString

  RtlInitializeCriticalSection

  RtlDeleteCriticalSection

  api-ms-win-eventing-controller-l1-1-0

  TraceSetInformation

  ControlTraceW

  QueryAllTracesW

  EventAccessQuery

  EnumerateTraceGuidsEx

  StartTraceW

  EventAccessControl

  StopTraceW

  EventAccessRemove

  EnableTraceEx2

  api-ms-win-eventing-consumer-l1-1-0

  CloseTrace

  OpenTraceW

  ProcessTrace

  kernelbase

  RegKrnGetHKEY_ClassesRootAddress

  RegKrnGetClassesEnumTableAddressInternal

  RegKrnGetTermsrvRegistryExtensionFlags

  RegDeleteKeyExInternalW

  RegOpenKeyExInternalW

  RegCreateKeyExInternalW

  CLOSE_LOCAL_HANDLE_INTERNAL

  MapPredefinedHandleInternal

  RegDeleteKeyExInternalA

  RegCreateKeyExInternalA

  RegOpenKeyExInternalA

  RemapPredefinedHandleInternal

  DisablePredefinedHandleTableInternal

  GetPackagePath

  PackageIdFromFullName

  Sleep

  lstrcmpiW

  lstrcmpW

  GetUserDefaultUILanguage

  GetSystemDefaultUILanguage

  CreateProcessAsUserW

  CreateProcessInternalA

  AreFileApisANSI

  lstrlenW

  LocalReAlloc

  LocalFree

  LocalAlloc

  sechost

  QueryAllTracesA

  StartTraceA

  ControlTraceA

  api-ms-win-service-core-l1-1-1

  EnumDependentServicesW

  QueryServiceDynamicInformation

  StartServiceCtrlDispatcherW

  SetServiceStatus

  RegisterServiceCtrlHandlerExW

  EnumServicesStatusExW

  api-ms-win-service-management-l1-1-0

  CreateServiceW

  CloseServiceHandle

  DeleteService

  OpenSCManagerW

  ControlServiceExW

  OpenServiceW

  StartServiceW

  api-ms-win-service-management-l2-1-0

  ChangeServiceConfigW

  QueryServiceStatusEx

  QueryServiceConfigW

  NotifyServiceStatusChangeW

  SetServiceObjectSecurity

  ChangeServiceConfig2W

  QueryServiceObjectSecurity

  QueryServiceConfig2W

  api-ms-win-service-private-l1-1-1

  I_ScRpcBindW

  I_ScRpcBindA

  I_ScSetServiceBitsA

  I_ScSetServiceBitsW

  I_ScRegisterPreshutdownRestart

  WaitServiceState

  api-ms-win-service-winsvc-l1-2-0

  OpenServiceA

  QueryServiceConfig2A

  ControlService

  RegisterServiceCtrlHandlerW

  QueryServiceConfigA

  OpenSCManagerA

  QueryServiceStatus

  RegisterServiceCtrlHandlerExA

  ChangeServiceConfigA

  StartServiceA

  CreateServiceA

  RegisterServiceCtrlHandlerA

  NotifyServiceStatusChangeA

  ControlServiceExA

  ChangeServiceConfig2A

  StartServiceCtrlDispatcherA

  api-ms-win-core-namedpipe-l1-2-0

  ImpersonateNamedPipeClient

  api-ms-win-core-processthreads-l1-1-2

  OpenProcess

  CreateThread

  IsProcessorFeaturePresent

  GetCurrentThread

  OpenThread

  GetProcessId

  GetCurrentProcess

  OpenProcessToken

  OpenThreadToken

  SetThreadToken

  GetPriorityClass

  GetCurrentThreadId

  GetCurrentProcessId

  TerminateProcess

  api-ms-win-security-base-l1-2-0

  RevertToSelf

  AddAccessAllowedAce

  GetSecurityDescriptorOwner

  SetSecurityDescriptorOwner

  AllocateAndInitializeSid

  AllocateLocallyUniqueId

  InitializeAcl

  SetKernelObjectSecurity

  MakeAbsoluteSD

  ImpersonateLoggedOnUser

  DuplicateTokenEx

  QuerySecurityAccessMask

  CreatePrivateObjectSecurityEx

  GetSecurityDescriptorLength

  ImpersonateSelf

  GetAce

  AccessCheckByTypeResultList

  CreatePrivateObjectSecurity

  SetSecurityDescriptorDacl

  IsTokenRestricted

  AddAuditAccessObjectAce

  AdjustTokenGroups

  AddAccessDeniedAce

  AreAllAccessesGranted

  SetTokenInformation

  PrivilegeCheck

  InitializeSecurityDescriptor

  GetPrivateObjectSecurity

  DuplicateToken

  CreatePrivateObjectSecurityWithMultipleInheritance

  SetAclInformation

  GetSidIdentifierAuthority

  FreeSid

  GetTokenInformation

  PrivilegedServiceAuditAlarmW

  AccessCheckByTypeResultListAndAuditAlarmW

  ObjectOpenAuditAlarmW

  ObjectPrivilegeAuditAlarmW

  ObjectCloseAuditAlarmW

  SetFileSecurityW

  GetFileSecurityW

  ObjectDeleteAuditAlarmW

  CopySid

  AccessCheckByTypeResultListAndAuditAlarmByHandleW

  AccessCheckAndAuditAlarmW

  AccessCheckByTypeAndAuditAlarmW

  IsValidSid

  EqualPrefixSid

  AddAccessDeniedObjectAce

  AddAccessAllowedObjectAce

  AccessCheckByType

  AddAuditAccessAce

  SetPrivateObjectSecurityEx

  EqualSid

  GetSecurityDescriptorControl

  CreateRestrictedToken

  GetAclInformation

  GetKernelObjectSecurity

  AccessCheck

  AddAccessAllowedAceEx

  GetSecurityDescriptorRMControl

  SetSecurityDescriptorRMControl

  GetSidSubAuthorityCount

  GetSidLengthRequired

  MapGenericMask

  InitializeSid

  AddAce

  IsValidAcl

  ImpersonateAnonymousToken

  MakeSelfRelativeSD

  IsValidSecurityDescriptor

  GetLengthSid

  AddAccessDeniedAceEx

  CheckTokenMembership

  SetSecurityDescriptorSacl

  AreAnyAccessesGranted

  AdjustTokenPrivileges

  SetSecurityDescriptorGroup

  DeleteAce

  SetSecurityDescriptorControl

  GetWindowsAccountDomainSid

  FindFirstFreeAce

  ConvertToAutoInheritPrivateObjectSecurity

  SetPrivateObjectSecurity

  EqualDomainSid

  GetSecurityDescriptorGroup

  GetSecurityDescriptorDacl

  CreateWellKnownSid

  DestroyPrivateObjectSecurity

  AddAuditAccessAceEx

  SetSecurityAccessMask

  IsWellKnownSid

  GetSidSubAuthority

  GetSecurityDescriptorSacl

  api-ms-win-security-base-private-l1-1-1

  MakeAbsoluteSD2

  api-ms-win-core-registry-l1-1-0

  RegRestoreKeyW

  RegLoadAppKeyW

  RegCopyTreeW

  RegCloseKey

  RegOpenKeyExW

  RegLoadMUIStringA

  RegLoadAppKeyA

  RegOpenUserClassesRoot

  RegDeleteKeyExW

  RegUnLoadKeyA

  RegRestoreKeyA

  RegDeleteTreeA

  RegSetValueExA

  RegCreateKeyExW

  RegQueryValueExA

  RegQueryInfoKeyW

  RegEnumKeyExA

  RegLoadMUIStringW

  RegSaveKeyExA

  RegUnLoadKeyW

  RegSetValueExW

  RegLoadKeyW

  RegDisablePredefinedCacheEx

  RegEnumKeyExW

  RegFlushKey

  RegNotifyChangeKeyValue

  RegDeleteKeyExA

  RegSetKeySecurity

  RegEnumValueW

  RegLoadKeyA

  RegEnumValueA

  RegOpenCurrentUser

  RegGetValueW

  RegSaveKeyExW

  RegDeleteTreeW

  RegDeleteValueA

  RegDeleteValueW

  RegQueryInfoKeyA

  RegGetValueA

  RegGetKeySecurity

  RegOpenKeyExA

  RegCreateKeyExA

  RegQueryValueExW

  api-ms-win-core-sysinfo-l1-2-1

  GetComputerNameExW

  GetTickCount

  GetSystemTimeAsFileTime

  GetLocalTime

  GetNativeSystemInfo

  GlobalMemoryStatusEx

  GetSystemFirmwareTable

  GetSystemWindowsDirectoryW

  GetSystemTime

  GetSystemDirectoryW

  kernel32

  GetFileAttributesExW

  WideCharToMultiByte

  MultiByteToWideChar

  GetProcAddress

  LoadLibraryExA

  CloseHandle

  FreeLibrary

  LoadLibraryExW

  LeaveCriticalSection

  GetLastError

  EnterCriticalSection

  GetFullPathNameW

  SearchPathW

  HeapAlloc

  ResolveDelayLoadedAPI

  DelayLoadFailureHook

  HeapFree

  SleepEx

  GetProcessHeap

  GetFileAttributesW

  CreateFileW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  QueryPerformanceCounter

  CreateEventW

  GetThreadUILanguage

  GetCommandLineW

  LoadLibraryW

  GetModuleHandleExW

  SetFilePointer

  OutputDebugStringW

  WriteFile

  TermsrvDeleteKey

  TermsrvOpenUserClasses

  DuplicateHandle

  DecodePointer

  FreeLibraryAndExitThread

  ReadProcessMemory

  EncodePointer

  CreateThreadpoolIo

  FreeLibraryWhenCallbackReturns

  CancelIoEx

  CloseThreadpoolIo

  FormatMessageW

  MoveFileW

  DeleteFileW

  ExpandEnvironmentStringsW

  GetModuleHandleW

  GetFileSizeEx

  CreateFileMappingW

  MapViewOfFile

  UnmapViewOfFile

  GetLongPathNameW

  CompareFileTime

  FindResourceExW

  LoadResource

  GetVolumePathNameW

  DeleteCriticalSection

  WaitForSingleObject

  GetActiveProcessorCount

  GetOverlappedResult

  DeviceIoControl

  GetVolumeInformationW

  GetComputerNameW

  ReleaseMutex

  ExpandEnvironmentStringsA

  GetModuleFileNameW

  LoadLibraryA

  GetComputerNameA

  LocalUnlock

  LocalLock

  CreateMutexW

  InitializeCriticalSection

  StartThreadpoolIo

  CancelThreadpoolIo

  EnumUILanguagesW

  GetFileMUIPath

  SetErrorMode

  SetFileInformationByHandle

  CopyFileExW

  FindClose

  FindNextFileW

  FindFirstFileExW

  lstrcmpiA

  GetFileSize

  DosDateTimeToFileTime

  FileTimeToDosDateTime

  GetFileTime

  ResetEvent

  SetEvent

  HeapReAlloc

  LockResource

  SizeofResource

  SetLastError

  rpcrt4

  RpcStringBindingComposeW

  RpcBindingFree

  RpcStringFreeW

  RpcBindingSetAuthInfoExA

  RpcBindingSetAuthInfoExW

  NdrClientCall3

  I_RpcExceptionFilter

  I_RpcMapWin32Status

  RpcEpResolveBinding

  RpcBindingSetAuthInfoW

  RpcBindingSetAuthInfoA

  RpcBindingFromStringBindingW

  RpcSsDestroyClientContext

  RpcBindingCreateW

  RpcBindingBind

  I_RpcSNCHOption

  NdrClientCall2

  UuidFromStringW

  UuidToStringW

  RpcExceptionFilter

  api-ms-win-core-timezone-l1-1-0

  GetDynamicTimeZoneInformationEffectiveYears

  EnumDynamicTimeZoneInformation

  api-ms-win-security-audit-l1-1-1

  AuditSetSecurity

  AuditEnumeratePerUserPolicy

  AuditQueryGlobalSaclW

  AuditFree

  AuditSetPerUserPolicy

  AuditEnumerateSubCategories

  AuditComputeEffectivePolicyBySid

  AuditLookupCategoryNameW

  AuditLookupSubCategoryNameW

  AuditEnumerateCategories

  AuditQueryPerUserPolicy

  AuditSetGlobalSaclW

  AuditQuerySecurity

  AuditQuerySystemPolicy

  AuditSetSystemPolicy

  api-ms-win-core-apiquery-l1-1-0

  ApiSetQueryApiSetPresence

  Exports

  Exports

  A_SHAFinal

  A_SHAInit

  A_SHAUpdate

  AbortSystemShutdownA

  AbortSystemShutdownW

  AccessCheck

  AccessCheckAndAuditAlarmA

  AccessCheckAndAuditAlarmW

  AccessCheckByType

  AccessCheckByTypeAndAuditAlarmA

  AccessCheckByTypeAndAuditAlarmW

  AccessCheckByTypeResultList

  AccessCheckByTypeResultListAndAuditAlarmA

  AccessCheckByTypeResultListAndAuditAlarmByHandleA

  AccessCheckByTypeResultListAndAuditAlarmByHandleW

  AccessCheckByTypeResultListAndAuditAlarmW

  AddAccessAllowedAce

  AddAccessAllowedAceEx

  AddAccessAllowedObjectAce

  AddAccessDeniedAce

  AddAccessDeniedAceEx

  AddAccessDeniedObjectAce

  AddAce

  AddAuditAccessAce

  AddAuditAccessAceEx

  AddAuditAccessObjectAce

  AddConditionalAce

  AddMandatoryAce

  AddUsersToEncryptedFile

  AddUsersToEncryptedFileEx

  AdjustTokenGroups

  AdjustTokenPrivileges

  AllocateAndInitializeSid

  AllocateLocallyUniqueId

  AreAllAccessesGranted

  AreAnyAccessesGranted

  AuditComputeEffectivePolicyBySid

  AuditComputeEffectivePolicyByToken

  AuditEnumerateCategories

  AuditEnumeratePerUserPolicy

  AuditEnumerateSubCategories

  AuditFree

  AuditLookupCategoryGuidFromCategoryId

  AuditLookupCategoryIdFromCategoryGuid

  AuditLookupCategoryNameA

  AuditLookupCategoryNameW

  AuditLookupSubCategoryNameA

  AuditLookupSubCategoryNameW

  AuditQueryGlobalSaclA

  AuditQueryGlobalSaclW

  AuditQueryPerUserPolicy

  AuditQuerySecurity

  AuditQuerySystemPolicy

  AuditSetGlobalSaclA

  AuditSetGlobalSaclW

  AuditSetPerUserPolicy

  AuditSetSecurity

  AuditSetSystemPolicy

  BackupEventLogA

  BackupEventLogW

  BaseRegCloseKey

  BaseRegCreateKey

  BaseRegDeleteKeyEx

  BaseRegDeleteValue

  BaseRegFlushKey

  BaseRegGetVersion

  BaseRegLoadKey

  BaseRegOpenKey

  BaseRegRestoreKey

  BaseRegSaveKeyEx

  BaseRegSetKeySecurity

  BaseRegSetValue

  BaseRegUnLoadKey

  BuildExplicitAccessWithNameA

  BuildExplicitAccessWithNameW

  BuildImpersonateExplicitAccessWithNameA

  BuildImpersonateExplicitAccessWithNameW

  BuildImpersonateTrusteeA

  BuildImpersonateTrusteeW

  BuildSecurityDescriptorA

  BuildSecurityDescriptorW

  BuildTrusteeWithNameA

  BuildTrusteeWithNameW

  BuildTrusteeWithObjectsAndNameA

  BuildTrusteeWithObjectsAndNameW

  BuildTrusteeWithObjectsAndSidA

  BuildTrusteeWithObjectsAndSidW

  BuildTrusteeWithSidA

  BuildTrusteeWithSidW

  CancelOverlappedAccess

  ChangeServiceConfig2A

  ChangeServiceConfig2W

  ChangeServiceConfigA

  ChangeServiceConfigW

  CheckForHiberboot

  CheckTokenMembership

  ClearEventLogA

  ClearEventLogW

  CloseCodeAuthzLevel

  CloseEncryptedFileRaw

  CloseEventLog

  CloseServiceHandle

  CloseThreadWaitChainSession

  CloseTrace

  CommandLineFromMsiDescriptor

  ComputeAccessTokenFromCodeAuthzLevel

  ControlService

  ControlServiceExA

  ControlServiceExW

  ControlTraceA

  ControlTraceW

  ConvertAccessToSecurityDescriptorA

  ConvertAccessToSecurityDescriptorW

  ConvertSDToStringSDDomainW

  ConvertSDToStringSDRootDomainA

  ConvertSDToStringSDRootDomainW

  ConvertSecurityDescriptorToAccessA

  ConvertSecurityDescriptorToAccessNamedA

  ConvertSecurityDescriptorToAccessNamedW

  ConvertSecurityDescriptorToAccessW

  ConvertSecurityDescriptorToStringSecurityDescriptorA

  ConvertSecurityDescriptorToStringSecurityDescriptorW

  ConvertSidToStringSidA

  ConvertSidToStringSidW

  ConvertStringSDToSDDomainA

  ConvertStringSDToSDDomainW

  ConvertStringSDToSDRootDomainA

  ConvertStringSDToSDRootDomainW

  ConvertStringSecurityDescriptorToSecurityDescriptorA

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ConvertStringSidToSidA

  ConvertStringSidToSidW

  ConvertToAutoInheritPrivateObjectSecurity

  CopySid

  CreateCodeAuthzLevel

  CreatePrivateObjectSecurity

  CreatePrivateObjectSecurityEx

  CreatePrivateObjectSecurityWithMultipleInheritance

  CreateProcessAsUserA

  CreateProcessAsUserW

  CreateProcessWithLogonW

  CreateProcessWithTokenW

  CreateRestrictedToken

  CreateServiceA

  CreateServiceW

  CreateTraceInstanceId

  CreateWellKnownSid

  CredBackupCredentials

  CredDeleteA

  CredDeleteW

  CredEncryptAndMarshalBinaryBlob

  CredEnumerateA

  CredEnumerateW

  CredFindBestCredentialA

  CredFindBestCredentialW

  CredFree

  CredGetSessionTypes

  CredGetTargetInfoA

  CredGetTargetInfoW

  CredIsMarshaledCredentialA

  CredIsMarshaledCredentialW

  CredIsProtectedA

  CredIsProtectedW

  CredMarshalCredentialA

  CredMarshalCredentialW

  CredProfileLoaded

  CredProfileLoadedEx

  CredProfileUnloaded

  CredProtectA

  CredProtectW

  CredReadA

  CredReadByTokenHandle

  CredReadDomainCredentialsA

  CredReadDomainCredentialsW

  CredReadW

  CredRenameA

  CredRenameW

  CredRestoreCredentials

  CredUnmarshalCredentialA

  CredUnmarshalCredentialW

  CredUnprotectA

  CredUnprotectW

  CredWriteA

  CredWriteDomainCredentialsA

  CredWriteDomainCredentialsW

  CredWriteW

  CredpConvertCredential

  CredpConvertOneCredentialSize

  CredpConvertTargetInfo

  CredpDecodeCredential

  CredpEncodeCredential

  CredpEncodeSecret

  CryptAcquireContextA

  CryptAcquireContextW

  CryptContextAddRef

  CryptCreateHash

  CryptDecrypt

  CryptDeriveKey

  CryptDestroyHash

  CryptDestroyKey

  CryptDuplicateHash

  CryptDuplicateKey

  CryptEncrypt

  CryptEnumProviderTypesA

  CryptEnumProviderTypesW

  CryptEnumProvidersA

  CryptEnumProvidersW

  CryptExportKey

  CryptGenKey

  CryptGenRandom

  CryptGetDefaultProviderA

  CryptGetDefaultProviderW

  CryptGetHashParam

  CryptGetKeyParam

  CryptGetProvParam

  CryptGetUserKey

  CryptHashData

  CryptHashSessionKey

  CryptImportKey

  CryptReleaseContext

  CryptSetHashParam

  CryptSetKeyParam

  CryptSetProvParam

  CryptSetProviderA

  CryptSetProviderExA

  CryptSetProviderExW

  CryptSetProviderW

  CryptSignHashA

  CryptSignHashW

  CryptVerifySignatureA

  CryptVerifySignatureW

  DecryptFileA

  DecryptFileW

  DeleteAce

  DeleteService

  DeregisterEventSource

  DestroyPrivateObjectSecurity

  DuplicateEncryptionInfoFile

  DuplicateToken

  DuplicateTokenEx

  ElfBackupEventLogFileA

  ElfBackupEventLogFileW

  ElfChangeNotify

  ElfClearEventLogFileA

  ElfClearEventLogFileW

  ElfCloseEventLog

  ElfDeregisterEventSource

  ElfFlushEventLog

  ElfNumberOfRecords

  ElfOldestRecord

  ElfOpenBackupEventLogA

  ElfOpenBackupEventLogW

  ElfOpenEventLogA

  ElfOpenEventLogW

  ElfReadEventLogA

  ElfReadEventLogW

  ElfRegisterEventSourceA

  ElfRegisterEventSourceW

  ElfReportEventA

  ElfReportEventAndSourceW

  ElfReportEventW

  EnableTrace

  EnableTraceEx

  EnableTraceEx2

  EncryptFileA

  EncryptFileW

  EncryptedFileKeyInfo

  EncryptionDisable

  EnumDependentServicesA

  EnumDependentServicesW

  EnumDynamicTimeZoneInformation

  EnumServiceGroupW

  EnumServicesStatusA

  EnumServicesStatusExA

  EnumServicesStatusExW

  EnumServicesStatusW

  EnumerateTraceGuids

  EnumerateTraceGuidsEx

  EqualDomainSid

  EqualPrefixSid

  EqualSid

  EtwLogSysConfigExtension

  EventAccessControl

  EventAccessQuery

  EventAccessRemove

  EventActivityIdControl

  EventEnabled

  EventProviderEnabled

  EventRegister

  EventSetInformation

  EventUnregister

  EventWrite

  EventWriteEndScenario

  EventWriteEx

  EventWriteStartScenario

  EventWriteString

  EventWriteTransfer

  FileEncryptionStatusA

  FileEncryptionStatusW

  FindFirstFreeAce

  FlushEfsCache

  FlushTraceA

  FlushTraceW

  FreeEncryptedFileKeyInfo

  FreeEncryptedFileMetadata

  FreeEncryptionCertificateHashList

  FreeInheritedFromArray

  FreeSid

  GetAccessPermissionsForObjectA

  GetAccessPermissionsForObjectW

  GetAce

  GetAclInformation

  GetAuditedPermissionsFromAclA

  GetAuditedPermissionsFromAclW

  GetCurrentHwProfileA

  GetCurrentHwProfileW

  GetDynamicTimeZoneInformationEffectiveYears

  GetEffectiveRightsFromAclA

  GetEffectiveRightsFromAclW

  GetEncryptedFileMetadata

  GetEventLogInformation

  GetExplicitEntriesFromAclA

  GetExplicitEntriesFromAclW

  GetFileSecurityA

  GetFileSecurityW

  GetInformationCodeAuthzLevelW

  GetInformationCodeAuthzPolicyW

  GetInheritanceSourceA

  GetInheritanceSourceW

  GetKernelObjectSecurity

  GetLengthSid

  GetLocalManagedApplicationData

  GetLocalManagedApplications

  GetManagedApplicationCategories

  GetManagedApplications

  GetMultipleTrusteeA

  GetMultipleTrusteeOperationA

  GetMultipleTrusteeOperationW

  GetMultipleTrusteeW

  GetNamedSecurityInfoA

  GetNamedSecurityInfoExA

  GetNamedSecurityInfoExW

  GetNamedSecurityInfoW

  GetNumberOfEventLogRecords

  GetOldestEventLogRecord

  GetOverlappedAccessResults

  GetPrivateObjectSecurity

  GetSecurityDescriptorControl

  GetSecurityDescriptorDacl

  GetSecurityDescriptorGroup

  GetSecurityDescriptorLength

  GetSecurityDescriptorOwner

  GetSecurityDescriptorRMControl

  GetSecurityDescriptorSacl

  GetSecurityInfo

  GetSecurityInfoExA

  GetSecurityInfoExW

  GetServiceDisplayNameA

  GetServiceDisplayNameW

  GetServiceKeyNameA

  GetServiceKeyNameW

  GetSidIdentifierAuthority

  GetSidLengthRequired

  GetSidSubAuthority

  GetSidSubAuthorityCount

  GetStringConditionFromBinary

  GetThreadWaitChain

  GetTokenInformation

  GetTraceEnableFlags

  GetTraceEnableLevel

  GetTraceLoggerHandle

  GetTrusteeFormA

  GetTrusteeFormW

  GetTrusteeNameA

  GetTrusteeNameW

  GetTrusteeTypeA

  GetTrusteeTypeW

  GetUserNameA

  GetUserNameW

  GetWindowsAccountDomainSid

  I_QueryTagInformation

  I_ScGetCurrentGroupStateW

  I_ScIsSecurityProcess

  I_ScPnPGetServiceName

  I_ScQueryServiceConfig

  I_ScRegisterPreshutdownRestart

  I_ScSendPnPMessage

  I_ScSendTSMessage

  I_ScSetServiceBitsA

  I_ScSetServiceBitsW

  I_ScValidatePnPService

  IdentifyCodeAuthzLevelW

  ImpersonateAnonymousToken

  ImpersonateLoggedOnUser

  ImpersonateNamedPipeClient

  ImpersonateSelf

  InitializeAcl

  InitializeSecurityDescriptor

  InitializeSid

  InitiateShutdownA

  InitiateShutdownW

  InitiateSystemShutdownA

  InitiateSystemShutdownExA

  InitiateSystemShutdownExW

  InitiateSystemShutdownW

  InstallApplication

  IsTextUnicode

  IsTokenRestricted

  IsTokenUntrusted

  IsValidAcl

  IsValidRelativeSecurityDescriptor

  IsValidSecurityDescriptor

  IsValidSid

  IsWellKnownSid

  LockServiceDatabase

  LogonUserA

  LogonUserExA

  LogonUserExExW

  LogonUserExW

  LogonUserW

  LookupAccountNameA

  LookupAccountNameW

  LookupAccountSidA

  LookupAccountSidW

  LookupPrivilegeDisplayNameA

  LookupPrivilegeDisplayNameW

  LookupPrivilegeNameA

  LookupPrivilegeNameW

  LookupPrivilegeValueA

  LookupPrivilegeValueW

  LookupSecurityDescriptorPartsA

  LookupSecurityDescriptorPartsW

  LsaAddAccountRights

  LsaAddPrivilegesToAccount

  LsaClearAuditLog

  LsaClose

  LsaCreateAccount

  LsaCreateSecret

  LsaCreateTrustedDomain

  LsaCreateTrustedDomainEx

  LsaDelete

  LsaDeleteTrustedDomain

  LsaEnumerateAccountRights

  LsaEnumerateAccounts

  LsaEnumerateAccountsWithUserRight

  LsaEnumeratePrivileges

  LsaEnumeratePrivilegesOfAccount

  LsaEnumerateTrustedDomains

  LsaEnumerateTrustedDomainsEx

  LsaFreeMemory

  LsaGetAppliedCAPIDs

  LsaGetQuotasForAccount

  LsaGetRemoteUserName

  LsaGetSystemAccessAccount

  LsaGetUserName

  LsaICLookupNames

  LsaICLookupNamesWithCreds

  LsaICLookupSids

  LsaICLookupSidsWithCreds

  LsaInvokeTrustScanner

  LsaLookupNames

  LsaLookupNames2

  LsaLookupPrivilegeDisplayName

  LsaLookupPrivilegeName

  LsaLookupPrivilegeValue

  LsaLookupSids

  LsaLookupSids2

  LsaManageSidNameMapping

  LsaNtStatusToWinError

  LsaOpenAccount

  LsaOpenPolicy

  LsaOpenPolicySce

  LsaOpenSecret

  LsaOpenTrustedDomain

  LsaOpenTrustedDomainByName

  LsaQueryCAPs

  LsaQueryDomainInformationPolicy

  LsaQueryForestTrustInformation

  LsaQueryForestTrustInformation2

  LsaQueryInfoTrustedDomain

  LsaQueryInformationPolicy

  LsaQuerySecret

  LsaQuerySecurityObject

  LsaQueryTrustedDomainInfo

  LsaQueryTrustedDomainInfoByName

  LsaRemoveAccountRights

  LsaRemovePrivilegesFromAccount

  LsaRetrievePrivateData

  LsaSetCAPs

  LsaSetDomainInformationPolicy

  LsaSetForestTrustInformation

  LsaSetForestTrustInformation2

  LsaSetInformationPolicy

  LsaSetInformationTrustedDomain

  LsaSetQuotasForAccount

  LsaSetSecret

  LsaSetSecurityObject

  LsaSetSystemAccessAccount

  LsaSetTrustedDomainInfoByName

  LsaSetTrustedDomainInformation

  Sections

  .text

  Size: 595KB - Virtual size: 594KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 14KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 24KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 24KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• DATA PROTECTION/combase.dll

  .dll windows x64

  Password: infected

  ba8646d28f2e7b54e7bcd331d13af3a6

  
  

  Code Sign

  33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed

  Certificate

  Issuer

  CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-12-2020 21:29

  Not After

  02-12-2021 21:29

  Subject

  CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:07:76:56:00:00:00:00:00:08

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  19-10-2011 18:41

  Not After

  19-10-2026 18:51

  Subject

  CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c

  Signer

  Actual PE Digest

  cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  30-06-2022 15:35

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  msvcrt

  __dllonexit

  _unlock

  _lock

  __C_specific_handler

  _onexit

  _initterm

  _amsg_exit

  _XcptFilter

  _itoa_s

  memcpy_s

  ??_V@YAXPEAX@Z

  memset

  memcpy

  memcmp

  _local_unwind

  wcsnlen

  wcsncpy_s

  ??_U@YAPEAX_K@Z

  _wcsnicmp

  wcsrchr

  _vsnprintf

  wcsstr

  _wcslwr

  _wtol

  wcstok

  wcschr

  qsort

  realloc

  memmove_s

  free

  malloc

  rand_s

  wcsncmp

  memmove

  _wtoi

  _resetstkoflw

  _purecall

  _wcsicmp

  _vsnwprintf

  __CxxFrameHandler3

  swprintf_s

  wcscmp

  api-ms-win-core-heap-l1-2-0

  HeapSize

  HeapValidate

  HeapAlloc

  HeapFree

  GetProcessHeap

  HeapCreate

  HeapDestroy

  HeapReAlloc

  HeapCompact

  api-ms-win-core-errorhandling-l1-1-1

  GetLastError

  SetLastError

  SetUnhandledExceptionFilter

  RaiseException

  UnhandledExceptionFilter

  api-ms-win-core-processthreads-l1-1-2

  GetProcessMitigationPolicy

  GetCurrentThreadId

  TerminateProcess

  GetCurrentThread

  SetThreadStackGuarantee

  SwitchToThread

  OpenProcess

  ProcessIdToSessionId

  GetCurrentProcess

  SetThreadToken

  OpenThreadToken

  OpenProcessToken

  CreateThread

  GetProcessId

  GetCurrentProcessId

  api-ms-win-core-registry-l1-1-0

  RegGetValueA

  RegDeleteKeyExA

  RegCloseKey

  RegOpenCurrentUser

  RegOpenKeyExW

  RegOpenUserClassesRoot

  RegQueryInfoKeyW

  RegQueryValueExW

  RegSetValueExA

  RegOpenKeyExA

  RegQueryValueExA

  RegDeleteKeyExW

  RegEnumKeyExW

  RegCreateKeyExA

  RegSetValueExW

  RegGetValueW

  RegEnumValueW

  RegCreateKeyExW

  api-ms-win-core-synch-l1-2-0

  SleepEx

  InitializeCriticalSectionAndSpinCount

  EnterCriticalSection

  SetWaitableTimerEx

  LeaveCriticalSection

  Sleep

  WaitForSingleObject

  ReleaseSRWLockExclusive

  InitializeSRWLock

  CreateWaitableTimerExW

  ResetEvent

  CreateEventW

  DeleteCriticalSection

  OpenEventW

  SetEvent

  WaitForMultipleObjectsEx

  CreateEventA

  InitOnceExecuteOnce

  ReleaseSRWLockShared

  AcquireSRWLockShared

  WaitForSingleObjectEx

  AcquireSRWLockExclusive

  OpenEventA

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  DuplicateHandle

  rpcrt4

  RpcServerUseProtseqEpW

  RpcBindingVectorFree

  NdrConvert2

  RpcServerUseProtseqExW

  RpcServerUseProtseqEpExW

  RpcBindingFromStringBindingW

  RpcServerUseProtseqW

  RpcBindingCreateW

  RpcBindingBind

  SimpleTypeBufferSize

  NdrMesTypeDecode2

  NdrMesTypeAlignSize2

  NdrMesTypeEncode2

  RpcAsyncCompleteCall

  NdrClientCall2

  RpcErrorAddRecord

  RpcMgmtSetComTimeout

  RpcMgmtInqComTimeout

  I_RpcServerSubscribeForDisconnectNotification

  I_RpcServerGetAssociationID

  I_RpcMgmtEnableDedicatedThreadPool

  NdrCorrelationInitialize

  NdrFullPointerXlatInit

  SimpleTypeMemorySize

  NdrFullPointerXlatFree

  NdrClearOutParameters

  I_RpcBCacheFree

  NdrCorrelationFree

  I_RpcExceptionFilter

  NdrGetTypeFlags

  MesEncodeFixedBufferHandleCreate

  MesHandleFree

  SimpleTypeAlignment

  I_RpcBCacheAllocate

  MesBufferHandleReset

  MesDecodeBufferHandleCreate

  I_RpcFixTransferSyntax

  I_RpcSendReceive

  RpcRaiseException

  RpcErrorEndEnumeration

  RpcErrorGetNextRecord

  RpcErrorStartEnumeration

  NdrClientInitializeNew

  I_RpcReceive

  I_RpcAsyncSetHandle

  NdrServerInitialize

  I_RpcGetBuffer

  I_RpcAllocate

  I_RpcFree

  I_RpcGetBufferWithObject

  UuidCreate

  I_RpcRequestMutex

  NdrStubCall2

  I_RpcNegotiateTransferSyntax

  I_RpcClearMutex

  I_RpcMgmtQueryDedicatedThreadPool

  RpcBindingFree

  RpcBindingSetOption

  NdrAsyncServerCall

  NdrServerCall2

  RpcBindingUnbind

  RpcBindingCopy

  NdrMesTypeDecode3

  I_RpcSend

  I_RpcAsyncAbortCall

  RpcServerUnregisterIf

  RpcServerRegisterIf3

  RpcImpersonateClient2

  RpcServerRegisterAuthInfoW

  RpcCertGeneratePrincipalNameW

  I_RpcOpenClientProcess

  RpcBindingInqAuthClientW

  NdrMesTypeEncode3

  I_RpcSetDCOMAppId

  I_RpcBindingInqCurrentModifiedId

  RpcBindingInqObject

  I_RpcBindingInqLocalClientPID

  RpcBindingServerFromClient

  RpcRevertToSelfEx

  RpcImpersonateClient

  RpcStringBindingParseW

  RpcBindingToStringBindingW

  I_RpcBindingInqTransportType

  RpcServerInqCallAttributesW

  I_RpcBindingSetPrivateOption

  RpcBindingSetAuthInfoExW

  RpcSmDestroyClientContext

  NdrClientCall3

  NdrStubCall3

  RpcStringFreeW

  RpcBindingInqAuthInfoExW

  RpcCancelThreadEx

  RpcMgmtSetCancelTimeout

  NdrOleAllocate

  NdrOleFree

  NdrDllGetClassObject

  RpcAsyncCancelCall

  RpcServerInqBindings

  RpcServerTestCancel

  NdrGetUserMarshalInfo

  I_RpcFreeBuffer

  RpcAsyncInitializeHandle

  RpcAsyncGetCallStatus

  api-ms-win-core-sysinfo-l1-2-1

  GetTickCount

  GetSystemTimeAsFileTime

  GetTickCount64

  GetComputerNameExW

  GetSystemInfo

  GetSystemWindowsDirectoryW

  api-ms-win-core-debug-l1-1-1

  OutputDebugStringW

  OutputDebugStringA

  DebugBreak

  IsDebuggerPresent

  api-ms-win-core-threadpool-l1-2-0

  CloseThreadpoolWork

  SubmitThreadpoolWork

  WaitForThreadpoolWorkCallbacks

  CreateThreadpoolWork

  CloseThreadpoolWait

  CreateThreadpoolWait

  SetThreadpoolWait

  SetEventWhenCallbackReturns

  WaitForThreadpoolWaitCallbacks

  CloseThreadpoolTimer

  CreateThreadpoolTimer

  SetThreadpoolTimer

  WaitForThreadpoolTimerCallbacks

  api-ms-win-core-fibers-l1-1-1

  FlsAlloc

  FlsSetValue

  FlsFree

  IsThreadAFiber

  api-ms-win-core-libraryloader-l1-2-0

  FreeLibraryAndExitThread

  GetModuleHandleA

  LoadLibraryExW

  GetModuleHandleW

  LoadLibraryExA

  GetProcAddress

  LoadStringW

  FreeLibrary

  GetModuleFileNameA

  GetModuleFileNameW

  GetModuleHandleExW

  api-ms-win-core-string-l1-1-0

  GetStringTypeW

  WideCharToMultiByte

  CompareStringOrdinal

  CompareStringW

  MultiByteToWideChar

  api-ms-win-core-processenvironment-l1-2-0

  ExpandEnvironmentStringsW

  SearchPathW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  api-ms-win-security-base-l1-2-0

  CreateWellKnownSid

  AccessCheck

  CheckTokenMembership

  SetSecurityDescriptorDacl

  AddAccessAllowedAce

  InitializeSid

  GetSidLengthRequired

  GetAppContainerAce

  InitializeAcl

  InitializeSecurityDescriptor

  ImpersonateLoggedOnUser

  GetAce

  MapGenericMask

  GetSidSubAuthorityCount

  GetKernelObjectSecurity

  GetSidSubAuthority

  DuplicateToken

  GetSecurityDescriptorGroup

  GetSecurityDescriptorOwner

  GetSecurityDescriptorControl

  MakeSelfRelativeSD

  IsValidSecurityDescriptor

  GetTokenInformation

  RevertToSelf

  ImpersonateAnonymousToken

  AccessCheckByType

  GetSecurityDescriptorDacl

  GetLengthSid

  IsValidSid

  GetSecurityDescriptorLength

  PrivilegeCheck

  CopySid

  EqualSid

  api-ms-win-core-rtlsupport-l1-2-0

  RtlCompareMemory

  RtlCaptureStackBackTrace

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  RtlCaptureContext

  api-ms-win-core-memory-l1-1-2

  UnmapViewOfFile

  CreateFileMappingW

  OpenFileMappingW

  VirtualProtect

  VirtualAlloc

  VirtualQuery

  MapViewOfFile

  api-ms-win-core-localization-l1-2-1

  FormatMessageW

  LCMapStringW

  api-ms-win-core-file-l1-2-1

  CreateFileW

  api-ms-win-eventing-provider-l1-1-0

  EventWrite

  EventRegister

  EventWriteEx

  EventUnregister

  api-ms-win-core-quirks-l1-1-0

  QuirkIsEnabled

  QuirkIsEnabledForProcess

  api-ms-win-core-util-l1-1-0

  DecodePointer

  EncodePointer

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-kernel32-legacy-l1-1-1

  RaiseFailFastException

  api-ms-win-core-string-obsolete-l1-1-0

  lstrlenW

  lstrcmpiA

  lstrcmpiW

  lstrlenA

  api-ms-win-core-heap-obsolete-l1-1-0

  GlobalSize

  LocalAlloc

  GlobalFree

  LocalFree

  GlobalUnlock

  GlobalReAlloc

  GlobalAlloc

  GlobalLock

  api-ms-win-core-privateprofile-l1-1-1

  GetProfileStringW

  api-ms-win-core-sidebyside-l1-1-0

  ReleaseActCtx

  FindActCtxSectionGuid

  FindActCtxSectionStringW

  ActivateActCtx

  AddRefActCtx

  DeactivateActCtx

  GetCurrentActCtx

  CreateActCtxW

  api-ms-win-core-windowserrorreporting-l1-1-0

  WerRegisterMemoryBlock

  ntdll

  RtlCopySid

  NtQueryInformationToken

  RtlLengthSid

  NtQueryObject

  LdrStandardizeSystemPath

  RtlFreeSid

  RtlDelete

  RtlApplicationVerifierStop

  RtlCheckForOrphanedCriticalSections

  NtQueryInformationThread

  RtlFreeHeap

  RtlGetAppContainerNamedObjectPath

  NtTerminateProcess

  RtlReportException

  RtlInitializeCriticalSectionAndSpinCount

  NtQueryTimerResolution

  RtlLoadString

  RtlInitializeConditionVariable

  ord1

  EvtIntReportEventAndSourceAsync

  RtlSplay

  RtlDeleteNoSplay

  RtlInitUnicodeString

  NtOpenKey

  RtlEqualUnicodeString

  WinSqmSetDWORD

  RtlInitializeCriticalSection

  RtlImageNtHeader

  RtlIsCriticalSectionLockedByThread

  RtlDllShutdownInProgress

  DbgPrint

  EtwEventUnregister

  RtlAllocateHeap

  NtQueryValueKey

  RtlQueryPackageIdentity

  ZwQuerySecurityAttributesToken

  RtlSidDominates

  RtlGetAppContainerSidType

  EtwGetTraceEnableLevel

  EtwGetTraceEnableFlags

  EtwRegisterTraceGuidsW

  EtwUnregisterTraceGuids

  EtwGetTraceLoggerHandle

  NtQuerySystemInformation

  RtlSleepConditionVariableCS

  RtlDeleteCriticalSection

  RtlWakeAllConditionVariable

  NtQueryInformationProcess

  NtApphelpCacheControl

  RtlInitUnicodeStringEx

  RtlValidRelativeSecurityDescriptor

  NtClose

  NtDuplicateObject

  NtCreateKey

  RtlRealPredecessor

  EtwEventRegister

  EtwTraceMessage

  EtwEventWrite

  RtlNtStatusToDosError

  NtQueryKey

  api-ms-win-core-interlocked-l1-2-0

  InitializeSListHead

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  api-ms-win-core-apiquery-l1-1-0

  ApiSetQueryApiSetPresence

  api-ms-win-core-delayload-l1-1-1

  DelayLoadFailureHook

  ResolveDelayLoadedAPI

  Exports

  Exports

  CLSIDFromOle1Class

  CLSIDFromProgID

  CLSIDFromString

  CleanupOleStateInAllTls

  CleanupTlsOleState

  ClearCleanupFlag

  CoAddRefServerProcess

  CoAllowUnmarshalerCLSID

  CoCancelCall

  CoCopyProxy

  CoCreateErrorInfo

  CoCreateFreeThreadedMarshaler

  CoCreateGuid

  CoCreateInstance

  CoCreateInstanceEx

  CoCreateInstanceFromApp

  CoCreateObjectInContext

  CoDeactivateObject

  CoDecodeProxy

  CoDecrementMTAUsage

  CoDisableCallCancellation

  CoDisconnectContext

  CoDisconnectObject

  CoEnableCallCancellation

  CoFreeUnusedLibraries

  CoFreeUnusedLibrariesEx

  CoGetActivationState

  CoGetApartmentID

  CoGetApartmentType

  CoGetCallContext

  CoGetCallState

  CoGetCallerTID

  CoGetCancelObject

  CoGetClassObject

  CoGetClassVersion

  CoGetContextToken

  CoGetCurrentLogicalThreadId

  CoGetCurrentProcess

  CoGetDefaultContext

  CoGetErrorInfo

  CoGetInstanceFromFile

  CoGetInstanceFromIStorage

  CoGetInterfaceAndReleaseStream

  CoGetMalloc

  CoGetMarshalSizeMax

  CoGetModuleType

  CoGetObjectContext

  CoGetPSClsid

  CoGetProcessIdentifier

  CoGetStandardMarshal

  CoGetStdMarshalEx

  CoGetSystemSecurityPermissions

  CoGetTreatAsClass

  CoImpersonateClient

  CoIncrementMTAUsage

  CoInitializeEx

  CoInitializeSecurity

  CoInitializeWOW

  CoInvalidateRemoteMachineBindings

  CoIsHandlerConnected

  CoLockObjectExternal

  CoMarshalHresult

  CoMarshalInterThreadInterfaceInStream

  CoMarshalInterface

  CoPopServiceDomain

  CoPushServiceDomain

  CoQueryAuthenticationServices

  CoQueryClientBlanket

  CoQueryProxyBlanket

  CoReactivateObject

  CoRegisterActivationFilter

  CoRegisterClassObject

  CoRegisterInitializeSpy

  CoRegisterMallocSpy

  CoRegisterMessageFilter

  CoRegisterPSClsid

  CoRegisterSurrogate

  CoRegisterSurrogateEx

  CoReleaseMarshalData

  CoReleaseServerProcess

  CoResumeClassObjects

  CoRetireServer

  CoRevertToSelf

  CoRevokeClassObject

  CoRevokeInitializeSpy

  CoRevokeMallocSpy

  CoSetCancelObject

  CoSetErrorInfo

  CoSetProxyBlanket

  CoSuspendClassObjects

  CoSwitchCallContext

  CoTaskMemAlloc

  CoTaskMemFree

  CoTaskMemRealloc

  CoTestCancel

  CoUninitialize

  CoUnloadingWOW

  CoUnmarshalHresult

  CoUnmarshalInterface

  CoVrfCheckThreadState

  CoVrfGetThreadState

  CoVrfReleaseThreadState

  CoWaitForMultipleHandles

  CoWaitForMultipleObjects

  CreateErrorInfo

  CreateStreamOnHGlobal

  DcomChannelSetHResult

  DllDebugObjectRPCHook

  DllGetActivationFactory

  DllGetClassObject

  EnableHookObject

  FreePropVariantArray

  FreePropVariantArrayWorker

  GetCatalogHelper

  GetErrorInfo

  GetFuncDescs

  GetHGlobalFromStream

  GetHookInterface

  GetRestrictedErrorInfo

  HSTRING_UserFree

  HSTRING_UserFree64

  HSTRING_UserMarshal

  HSTRING_UserMarshal64

  HSTRING_UserSize

  HSTRING_UserSize64

  HSTRING_UserUnmarshal

  HSTRING_UserUnmarshal64

  HkOleRegisterObject

  IIDFromString

  InternalAppInvokeExceptionFilter

  InternalCCFreeUnused

  InternalCCGetClassInformationForDde

  InternalCCGetClassInformationFromKey

  InternalCCSetDdeServerWindow

  InternalCMLSendReceive

  InternalCallAsProxyExceptionFilter

  InternalCallFrameExceptionFilter

  InternalCallerIsAppContainer

  InternalCanMakeOutCall

  InternalCoIsSurrogateProcess

  InternalCoRegisterDisconnectCallback

  InternalCoRegisterSurrogatedObject

  InternalCoStdMarshalObject

  InternalCoUnregisterDisconnectCallback

  InternalCompleteObjRef

  InternalCreateCAggId

  InternalCreateIdentityHandler

  InternalDoATClassCreate

  InternalFillLocalOXIDInfo

  InternalFreeObjRef

  InternalGetWindowPropInterface

  InternalIrotEnumRunning

  InternalIrotEnumRunning2

  InternalIrotGetObject

  InternalIrotGetObject2

  InternalIrotGetObject3

  InternalIrotGetTimeOfLastChange

  InternalIrotGetTimeOfLastChange2

  InternalIrotIsRunning

  InternalIrotIsRunning2

  InternalIrotNoteChangeTime

  InternalIrotRegister

  InternalIrotRevoke

  InternalIsApartmentInitialized

  InternalIsProcessInitialized

  InternalMarshalObjRef

  InternalNotifyDDStartOrStop

  InternalOleModalLoopBlockFn

  InternalRegisterWindowPropInterface

  InternalReleaseMarshalObjRef

  InternalSTAInvoke

  InternalServerExceptionFilter

  InternalSetAptCallCtrlOnTlsIfRequired

  InternalSetOleThunkWowPtr

  InternalStubInvoke

  InternalTlsAllocData

  InternalUnmarshalObjRef

  IsErrorPropagationEnabled

  NdrExtStubInitialize

  NdrOleDllGetClassObject

  NdrOleInitializeExtension

  NdrProxyForwardingFunction10

  NdrProxyForwardingFunction11

  NdrProxyForwardingFunction12

  NdrProxyForwardingFunction13

  NdrProxyForwardingFunction14

  NdrProxyForwardingFunction15

  NdrProxyForwardingFunction16

  NdrProxyForwardingFunction17

  NdrProxyForwardingFunction18

  NdrProxyForwardingFunction19

  NdrProxyForwardingFunction20

  NdrProxyForwardingFunction21

  NdrProxyForwardingFunction22

  NdrProxyForwardingFunction23

  NdrProxyForwardingFunction24

  NdrProxyForwardingFunction25

  NdrProxyForwardingFunction26

  NdrProxyForwardingFunction27

  NdrProxyForwardingFunction28

  NdrProxyForwardingFunction29

  NdrProxyForwardingFunction3

  NdrProxyForwardingFunction30

  NdrProxyForwardingFunction31

  NdrProxyForwardingFunction32

  NdrProxyForwardingFunction4

  NdrProxyForwardingFunction5

  NdrProxyForwardingFunction6

  NdrProxyForwardingFunction7

  NdrProxyForwardingFunction8

  NdrProxyForwardingFunction9

  NdrpFindInterface

  ObjectStublessClient10

  ObjectStublessClient11

  ObjectStublessClient12

  ObjectStublessClient13

  ObjectStublessClient14

  ObjectStublessClient15

  ObjectStublessClient16

  ObjectStublessClient17

  ObjectStublessClient18

  ObjectStublessClient19

  ObjectStublessClient20

  ObjectStublessClient21

  ObjectStublessClient22

  ObjectStublessClient23

  ObjectStublessClient24

  ObjectStublessClient25

  ObjectStublessClient26

  ObjectStublessClient27

  ObjectStublessClient28

  ObjectStublessClient29

  ObjectStublessClient3

  ObjectStublessClient30

  ObjectStublessClient31

  ObjectStublessClient32

  ObjectStublessClient4

  ObjectStublessClient5

  ObjectStublessClient6

  ObjectStublessClient7

  ObjectStublessClient8

  ObjectStublessClient9

  ProgIDFromCLSID

  PropVariantClear

  PropVariantCopy

  ReleaseFuncDescs

  RoActivateInstance

  RoCaptureErrorContext

  RoClearError

  RoFailFastWithErrorContext

  RoFailFastWithErrorContextInternal

  RoFailFastWithErrorContextInternal2

  RoFreeParameterizedTypeExtra

  RoGetActivatableClassRegistration

  RoGetActivationFactory

  RoGetAgileReference

  RoGetApartmentIdentifier

  RoGetErrorReportingFlags

  RoGetMatchingRestrictedErrorInfo

  RoGetParameterizedTypeInstanceIID

  RoGetServerActivatableClasses

  RoInitialize

  RoInspectCapturedStackBackTrace

  RoInspectThreadErrorInfo

  RoOriginateError

  RoOriginateErrorW

  RoOriginateLanguageException

  RoParameterizedTypeExtraGetTypeSignature

  RoRegisterActivationFactories

  RoRegisterForApartmentShutdown

  RoReportCapabilityCheckFailure

  RoReportFailedDelegate

  RoReportUnhandledError

  RoResolveRestrictedErrorInfoReference

  RoRevokeActivationFactories

  RoSetErrorReportingFlags

  RoTransformError

  RoTransformErrorW

  RoUninitialize

  RoUnregisterForApartmentShutdown

  SetCleanupFlag

  SetErrorInfo

  SetRestrictedErrorInfo

  StringFromCLSID

  StringFromGUID2

  StringFromIID

  UpdateDCOMSettings

  UpdateProcessTracing

  WdtpInterfacePointer_UserMarshal

  WdtpInterfacePointer_UserMarshal64

  WdtpInterfacePointer_UserSize

  WdtpInterfacePointer_UserSize64

  WdtpInterfacePointer_UserUnmarshal

  WdtpInterfacePointer_UserUnmarshal64

  WindowsCompareStringOrdinal

  WindowsConcatString

  WindowsCreateString

  WindowsCreateStringReference

  WindowsDeleteString

  WindowsDeleteStringBuffer

  WindowsDuplicateString

  WindowsGetStringLen

  WindowsGetStringRawBuffer

  WindowsInspectString

  WindowsIsStringEmpty

  WindowsPreallocateStringBuffer

  WindowsPromoteStringBuffer

  WindowsReplaceString

  WindowsStringHasEmbeddedNull

  WindowsSubstring

  WindowsSubstringWithSpecifiedLength

  WindowsTrimStringEnd

  WindowsTrimStringStart

  Sections

  .text

  Size: 1.7MB - Virtual size: 1.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .orpc

  Size: 88KB - Virtual size: 87KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .ndr64

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 26KB - Virtual size: 27KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 158KB - Virtual size: 158KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 64KB - Virtual size: 64KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 35KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• DATA PROTECTION/freebl3.dll

  .dll windows x64

  Password: infected

  8a564fee0e9aa5547525f921a1b23c12

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  nss3

  NSS_SecureMemcmp

  NSS_SecureMemcmpZero

  PORT_Alloc_Util

  PORT_ArenaAlloc_Util

  PORT_ArenaZAlloc_Util

  PORT_FreeArena_Util

  PORT_Free_Util

  PORT_GetError_Util

  PORT_NewArena_Util

  PORT_SetError_Util

  PORT_ZAllocAlignedOffset_Util

  PORT_ZAlloc_Util

  PORT_ZFree_Util

  PR_CallOnce

  PR_DestroyCondVar

  PR_DestroyLock

  PR_GetEnvSecure

  PR_Lock

  PR_NewCondVar

  PR_NewLock

  PR_NotifyAllCondVar

  PR_NotifyCondVar

  PR_Unlock

  PR_WaitCondVar

  SECITEM_AllocItem_Util

  SECITEM_CompareItem_Util

  SECITEM_CopyItem_Util

  SECITEM_FreeItem_Util

  SECITEM_ZfreeItem_Util

  SECOID_FindOIDTag_Util

  advapi32

  CryptAcquireContextA

  CryptGenRandom

  CryptReleaseContext

  SystemFunction036

  api-ms-win-crt-heap-l1-1-0

  _set_new_mode

  calloc

  free

  malloc

  api-ms-win-crt-private-l1-1-0

  memcmp

  memcpy

  api-ms-win-crt-runtime-l1-1-0

  __p___argc

  __p___argv

  __p___wargv

  _configure_narrow_argv

  _configure_wide_argv

  _crt_at_quick_exit

  _crt_atexit

  _execute_onexit_table

  _exit

  _initialize_narrow_environment

  _initialize_onexit_table

  _initialize_wide_environment

  _initterm

  _register_onexit_function

  abort

  api-ms-win-crt-string-l1-1-0

  _strdup

  islower

  isupper

  memset

  strlen

  strncmp

  tolower

  toupper

  api-ms-win-crt-time-l1-1-0

  __daylight

  __timezone

  __tzname

  _time64

  _tzset

  api-ms-win-crt-utility-l1-1-0

  rand

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  GetComputerNameA

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetDiskFreeSpaceA

  GetLastError

  GetLogicalDrives

  GetTickCount

  GetVolumeInformationA

  GlobalMemoryStatus

  InitializeCriticalSection

  LeaveCriticalSection

  QueryPerformanceCounter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  api-ms-win-crt-stdio-l1-1-0

  __acrt_iob_func

  __stdio_common_vfprintf

  __stdio_common_vfwprintf

  _close

  _open

  _write

  fwrite

  api-ms-win-crt-environment-l1-1-0

  __p__environ

  __p__wenviron

  Exports

  Exports

  FREEBL_GetVector

  Sections

  .text

  Size: 559KB - Virtual size: 558KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 170KB - Virtual size: 169KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .buildid

  Size: 512B - Virtual size: 149B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 896B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 964B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Video.mp4.scr

  .exe windows x86

  Password: infected

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  03:b4:bc:5e:e7:9d:84:2c:03:93:0b:86:19:ed:ea:e4

  Certificate

  Issuer

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  26-02-2021 00:00

  Not After

  02-03-2022 23:59

  Subject

  SERIALNUMBER=4969967,CN=Zoom Video Communications\, Inc.,O=Zoom Video Communications\, Inc.,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  18-04-2012 12:00

  Not After

  18-04-2027 12:00

  Subject

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  03:b4:bc:5e:e7:9d:84:2c:03:93:0b:86:19:ed:ea:e4

  Certificate

  Issuer

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  26-02-2021 00:00

  Not After

  02-03-2022 23:59

  Subject

  SERIALNUMBER=4969967,CN=Zoom Video Communications\, Inc.,O=Zoom Video Communications\, Inc.,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  18-04-2012 12:00

  Not After

  18-04-2027 12:00

  Subject

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  01:cc:05:57:ce:fa:54:8b:6f:1a:3f:e1:76:d7:28:70:53:01:98:c8:41:0a:66:30:91:0c:89:a7:c0:58:84:8b

  Signer

  Actual PE Digest

  01:cc:05:57:ce:fa:54:8b:6f:1a:3f:e1:76:d7:28:70:53:01:98:c8:41:0a:66:30:91:0c:89:a7:c0:58:84:8b

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=4969967,CN=Zoom Video Communications\, Inc.,O=Zoom Video Communications\, Inc.,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  26-12-2021 12:33

  Valid: true

  Chain 1

  SERIALNUMBER=4969967,CN=Zoom Video Communications\, Inc.,O=Zoom Video Communications\, Inc.,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  c9:ef:97:94:61:ff:3b:4c:1f:7d:7e:32:78:23:b8:01:3f:79:df:30

  Signer

  Actual PE Digest

  c9:ef:97:94:61:ff:3b:4c:1f:7d:7e:32:78:23:b8:01:3f:79:df:30

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=4969967,CN=Zoom Video Communications\, Inc.,O=Zoom Video Communications\, Inc.,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  26-12-2021 12:33

  Valid: true

  Chain 1

  SERIALNUMBER=4969967,CN=Zoom Video Communications\, Inc.,O=Zoom Video Communications\, Inc.,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 1.4MB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 127KB - Virtual size: 126KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ