General

Malware Config

Signatures

Files

• MHFNV-AnyDesk.zip

  .zip
• AnyDesk.exe

  .exe windows x86

  dddcfeae41621c177d63ed8ec427469c

  
  

  Code Sign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-12-2021 00:00

  Not After

  08-01-2025 23:59

  Subject

  CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-12-2021 00:00

  Not After

  08-01-2025 23:59

  Subject

  CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  91:08:ee:6f:57:11:2c:d6:7e:e8:78:53:9e:fa:77:29:bd:65:5d:8c:3f:17:49:03:d1:d6:64:ca:67:6d:85:ab

  Signer

  Actual PE Digest

  91:08:ee:6f:57:11:2c:d6:7e:e8:78:53:9e:fa:77:29:bd:65:5d:8c:3f:17:49:03:d1:d6:64:ca:67:6d:85:ab

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE

  18-10-2022 11:28

  Valid: true

  Chain 1

  CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Chain 2

  CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  98:e2:53:a1:4c:b1:66:57:8b:e8:e6:a2:85:b4:51:2c:48:a8:48:2f

  Signer

  Actual PE Digest

  98:e2:53:a1:4c:b1:66:57:8b:e8:e6:a2:85:b4:51:2c:48:a8:48:2f

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE

  18-10-2022 11:28

  Valid: true

  Chain 1

  CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Chain 2

  CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetCommandLineA

  GetStartupInfoA

  HeapAlloc

  HeapFree

  RaiseException

  VirtualAlloc

  HeapReAlloc

  Sleep

  ExitProcess

  HeapSize

  TerminateProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  GetConsoleCP

  GetConsoleMode

  GetStdHandle

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  GetFileType

  RtlUnwind

  VirtualFree

  QueryPerformanceCounter

  GetTickCount

  GetSystemTimeAsFileTime

  GetACP

  IsValidCodePage

  InitializeCriticalSectionAndSpinCount

  SetStdHandle

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  LCMapStringA

  LCMapStringW

  GetStringTypeA

  GetStringTypeW

  GetProcessHeap

  SetErrorMode

  CreateFileA

  GetCurrentProcess

  SetEndOfFile

  FlushFileBuffers

  SetFilePointer

  WriteFile

  ReadFile

  WritePrivateProfileStringA

  GetModuleHandleW

  GetOEMCP

  GetCPInfo

  InterlockedIncrement

  TlsFree

  DeleteCriticalSection

  LocalReAlloc

  TlsSetValue

  TlsAlloc

  InitializeCriticalSection

  GlobalHandle

  GlobalReAlloc

  EnterCriticalSection

  TlsGetValue

  LeaveCriticalSection

  LocalAlloc

  GlobalFlags

  InterlockedDecrement

  GetModuleFileNameW

  CloseHandle

  GetCurrentThread

  ConvertDefaultLocale

  EnumResourceLanguagesA

  GetLocaleInfoA

  InterlockedExchange

  lstrcmpA

  GetCurrentProcessId

  GetModuleFileNameA

  GlobalAlloc

  FormatMessageA

  LocalFree

  MulDiv

  lstrlenA

  GetCurrentThreadId

  GlobalGetAtomNameA

  GlobalAddAtomA

  GlobalFindAtomA

  GlobalDeleteAtom

  FreeLibrary

  CompareStringA

  LoadLibraryA

  GetLastError

  SetLastError

  MultiByteToWideChar

  lstrcmpW

  GetModuleHandleA

  GetProcAddress

  GetVersionExA

  GlobalLock

  GlobalUnlock

  GlobalFree

  GetTempPathA

  FreeResource

  WideCharToMultiByte

  FindResourceA

  LoadResource

  LockResource

  HeapCreate

  SizeofResource

  user32

  GetSysColorBrush

  DestroyMenu

  SetCursor

  GetMessageA

  TranslateMessage

  GetCursorPos

  ValidateRect

  PostQuitMessage

  GetWindowThreadProcessId

  EndPaint

  BeginPaint

  ReleaseDC

  GetDC

  ClientToScreen

  GrayStringA

  DrawTextExA

  DrawTextA

  TabbedTextOutA

  ShowWindow

  SetWindowTextA

  IsDialogMessageA

  SetMenuItemBitmaps

  GetMenuCheckMarkDimensions

  ModifyMenuA

  EnableMenuItem

  CheckMenuItem

  RegisterWindowMessageA

  SendDlgItemMessageA

  WinHelpA

  GetCapture

  SetWindowsHookExA

  CallNextHookEx

  GetClassLongA

  GetClassNameA

  SetPropA

  GetPropA

  RemovePropA

  GetFocus

  SetFocus

  GetWindowTextLengthA

  GetWindowTextA

  GetForegroundWindow

  GetLastActivePopup

  DispatchMessageA

  GetTopWindow

  UnhookWindowsHookEx

  GetMessageTime

  GetMessagePos

  PeekMessageA

  MapWindowPoints

  GetKeyState

  SetMenu

  SetForegroundWindow

  IsWindowVisible

  GetClientRect

  EnableWindow

  DrawIcon

  SendMessageA

  UpdateWindow

  PostMessageA

  GetSubMenu

  GetMenuItemID

  GetMenuItemCount

  MessageBoxA

  CreateWindowExA

  GetClassInfoExA

  GetClassInfoA

  RegisterClassA

  GetSysColor

  AdjustWindowRectEx

  UnregisterClassA

  GetMenuState

  IsIconic

  LoadIconA

  GetSystemMetrics

  SetClassLongA

  LoadCursorA

  EndDialog

  GetNextDlgTabItem

  GetParent

  IsWindowEnabled

  GetDlgItem

  GetWindowLongA

  IsWindow

  DestroyWindow

  CreateDialogIndirectParamA

  SetActiveWindow

  GetActiveWindow

  GetDesktopWindow

  GetWindow

  GetWindowRect

  GetWindowPlacement

  CopyRect

  PtInRect

  GetDlgCtrlID

  DefWindowProcA

  CallWindowProcA

  GetMenu

  SetWindowLongA

  SetWindowPos

  SystemParametersInfoA

  LoadBitmapA

  gdi32

  DeleteDC

  GetStockObject

  GetDeviceCaps

  ScaleWindowExtEx

  SetWindowExtEx

  ExtTextOutA

  ScaleViewportExtEx

  SetViewportExtEx

  OffsetViewportOrgEx

  SetViewportOrgEx

  SelectObject

  CreateSolidBrush

  TextOutA

  RectVisible

  PtVisible

  DeleteObject

  SetMapMode

  SetBkMode

  RestoreDC

  SaveDC

  CreateBitmap

  GetObjectA

  SetBkColor

  SetTextColor

  GetClipBox

  Escape

  winspool.drv

  DocumentPropertiesA

  OpenPrinterA

  ClosePrinter

  advapi32

  RegSetValueExA

  RegCreateKeyExA

  RegQueryValueA

  RegOpenKeyA

  RegEnumKeyA

  RegDeleteKeyA

  RegOpenKeyExA

  RegQueryValueExA

  RegCloseKey

  shell32

  SHGetPathFromIDListA

  SHBrowseForFolderA

  SHGetMalloc

  ShellExecuteA

  shlwapi

  PathFindFileNameA

  PathFindExtensionA

  oleaut32

  VariantClear

  VariantChangeType

  VariantInit

  Sections

  .text

  Size: 140KB - Virtual size: 139KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 35KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 22KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 5.3MB - Virtual size: 5.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• tmp/ChromeSetup.exe

  .exe windows x86

  d6d33cfa83489bf5ba9c5b52261af2b7

  
  

  Code Sign

  06:ae:a7:6b:ac:46:a9:e8:cf:e6:d2:9e:45:aa:f0:33

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  08-11-2019 00:00

  Not After

  16-11-2022 12:00

  Subject

  CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  29-03-2022 00:00

  Not After

  14-03-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  01

  Certificate

  Issuer

  CN=Unknown issuer

  Not Before

  01-01-2013 10:00

  Not After

  01-04-2013 10:00

  Subject

  CN=Dummy certificate

  Extended Key Usages

  Key Usages

  KeyUsageCertSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  02-07-2021 00:00

  Not After

  10-07-2024 23:59

  Subject

  CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  29-03-2022 00:00

  Not After

  14-03-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0d:4b:5c:2e:58:65:b1:82:a3:50:b9:cc:6e:b2:41:56:5e:77:31:4a:0c:e3:a3:f7:3c:12:49:3f:58:8f:03:eb

  Signer

  Actual PE Digest

  0d:4b:5c:2e:58:65:b1:82:a3:50:b9:cc:6e:b2:41:56:5e:77:31:4a:0c:e3:a3:f7:3c:12:49:3f:58:8f:03:eb

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

  18-08-2022 21:51

  Valid: true

  Chain 1

  CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Chain 2

  CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  bb:49:97:b9:a2:ce:22:5e:c2:97:78:65:a2:40:f7:29:98:33:b0:c9

  Signer

  Actual PE Digest

  bb:49:97:b9:a2:ce:22:5e:c2:97:78:65:a2:40:f7:29:98:33:b0:c9

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

  18-08-2022 21:51

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  GetModuleHandleW

  GetCurrentProcess

  TerminateProcess

  RtlUnwind

  GetLastError

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  EncodePointer

  RaiseException

  GetStdHandle

  WriteFile

  GetModuleFileNameW

  ExitProcess

  GetModuleHandleExW

  OutputDebugStringW

  HeapAlloc

  HeapFree

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  MultiByteToWideChar

  WideCharToMultiByte

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetStdHandle

  GetFileType

  GetStringTypeW

  LCMapStringW

  GetProcessHeap

  HeapSize

  HeapReAlloc

  FlushFileBuffers

  GetConsoleOutputCP

  GetConsoleMode

  SetFilePointerEx

  ReadFile

  CreateFileW

  CloseHandle

  WriteConsoleW

  DecodePointer

  GetExitCodeProcess

  CreateProcessW

  WaitForSingleObject

  SetFilePointer

  CreateDirectoryW

  SizeofResource

  RemoveDirectoryW

  GetTempPathW

  FormatMessageW

  LockResource

  DeleteFileW

  FindResourceExW

  LoadResource

  FindResourceW

  HeapDestroy

  LocalFree

  VerSetConditionMask

  CopyFileW

  VerifyVersionInfoW

  GetTempFileNameW

  lstrcmpiW

  UnmapViewOfFile

  CreateFileMappingW

  MapViewOfFile

  VirtualQuery

  shlwapi

  PathQuoteSpacesW

  PathAppendW

  ole32

  CoUninitialize

  CoInitializeEx

  shell32

  SHGetFolderPathW

  ord680

  user32

  MessageBoxW

  CharLowerBuffW

  Sections

  .text

  Size: 93KB - Virtual size: 92KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.2MB - Virtual size: 1.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• tmp/SpotifySetup (6).exe

  .exe windows x86

  811e2d4aaafcb07690b699c70c0b1f42

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:c5:30:70:3a:21:0e:c1:d6:f8:3c:b4:fe:11:18:c5

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  22-09-2022 00:00

  Not After

  19-10-2023 23:59

  Subject

  SERIALNUMBER=5567037485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  63:b7:2e:16:32:d9:95:4e:4a:ce:f0:30:c1:2b:94:30:0c:81:85:b2:3a:65:a4:39:30:43:b2:8e:a8:8d:e8:9a

  Signer

  Actual PE Digest

  63:b7:2e:16:32:d9:95:4e:4a:ce:f0:30:c1:2b:94:30:0c:81:85:b2:3a:65:a4:39:30:43:b2:8e:a8:8d:e8:9a

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=5567037485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

  24-10-2022 17:40

  Valid: true

  Chain 1

  SERIALNUMBER=5567037485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Chain 2

  SERIALNUMBER=5567037485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  comctl32

  InitCommonControlsEx

  shell32

  SHChangeNotify

  SHGetFolderPathW

  ShellExecuteW

  kernel32

  OpenMutexW

  Sleep

  GetCurrentProcess

  GetExitCodeProcess

  CreateProcessW

  GetLocalTime

  LoadLibraryExA

  VerifyVersionInfoW

  CompareStringW

  MultiByteToWideChar

  WideCharToMultiByte

  SetEvent

  CreateEventW

  CreateThread

  GetTickCount

  GetModuleHandleW

  GetLocaleInfoA

  GetUserDefaultUILanguage

  MapViewOfFile

  UnmapViewOfFile

  OpenMutexA

  CreateFileMappingA

  OpenFileMappingA

  LocalFree

  GetProcAddress

  LoadLibraryW

  TerminateProcess

  OpenProcess

  GetModuleFileNameW

  CreateDirectoryW

  DeleteFileW

  GetFileAttributesW

  MoveFileExW

  GetCurrentProcessId

  DeleteCriticalSection

  ResetEvent

  FormatMessageA

  FormatMessageW

  FindClose

  FindFirstFileW

  FindNextFileW

  AreFileApisANSI

  FlushFileBuffers

  GetFileAttributesExW

  GetFileInformationByHandle

  SetEndOfFile

  SetFilePointerEx

  DeviceIoControl

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  GetStdHandle

  GetConsoleMode

  WriteConsoleA

  GetConsoleScreenBufferInfo

  SetConsoleTextAttribute

  SetLastError

  CreateFileA

  GetFileSize

  SetFilePointer

  GetSystemInfo

  MapViewOfFileEx

  GetModuleHandleA

  VirtualQuery

  VirtualProtect

  WriteConsoleW

  HeapSize

  SetStdHandle

  GetProcessHeap

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetOEMCP

  GetACP

  IsValidCodePage

  GetTimeZoneInformation

  HeapReAlloc

  ReadConsoleW

  GetFileSizeEx

  ReadFile

  GetConsoleOutputCP

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetLocaleInfoW

  LCMapStringW

  GetTimeFormatW

  GetDateFormatW

  GetFileType

  HeapAlloc

  WaitForSingleObject

  LeaveCriticalSection

  CreateMutexW

  HeapFree

  ExitProcess

  EnterCriticalSection

  InitializeCriticalSection

  GetLastError

  CloseHandle

  WriteFile

  CreateFileW

  GetCommandLineW

  VerSetConditionMask

  GetModuleHandleExW

  LoadLibraryExW

  FindFirstFileExW

  SetFileInformationByHandle

  CopyFileW

  GetFileInformationByHandleEx

  InitializeSRWLock

  ReleaseSRWLockExclusive

  AcquireSRWLockExclusive

  InitializeCriticalSectionEx

  TryEnterCriticalSection

  InitOnceBeginInitialize

  InitOnceComplete

  EncodePointer

  DecodePointer

  LCMapStringEx

  QueryPerformanceCounter

  GetLocaleInfoEx

  GetStringTypeW

  CompareStringEx

  GetCPInfo

  InitializeCriticalSectionAndSpinCount

  WaitForSingleObjectEx

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetStartupInfoW

  InitializeSListHead

  RaiseException

  RtlUnwind

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  user32

  GetActiveWindow

  ReleaseDC

  GetDC

  GetSystemMetrics

  GetWindowThreadProcessId

  SendMessageTimeoutA

  FindWindowA

  LoadIconW

  LoadCursorW

  SetWindowLongW

  GetWindowLongW

  wsprintfA

  AdjustWindowRect

  SetTimer

  MessageBoxW

  SetDlgItemTextW

  GetDlgItem

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  DefWindowProcW

  PostMessageW

  SendMessageW

  DispatchMessageW

  TranslateMessage

  GetMessageW

  gdi32

  GetDeviceCaps

  GetStockObject

  ole32

  CoInitializeEx

  CoCreateInstance

  advapi32

  GetTokenInformation

  RegSetValueExW

  RegOpenKeyExW

  RegDeleteValueW

  RegCreateKeyExW

  OpenProcessToken

  Sections

  .text

  Size: 422KB - Virtual size: 421KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 392KB - Virtual size: 392KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 51KB - Virtual size: 50KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• tmp/filmora_setup_full1083.exe

  .exe windows x86

  6c7494a9332ba950b8859afe7d6dab39

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:31:98:06:c6:e4:9f:c3:d3:90:99:b8:19:5f:db:f0

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  15-06-2022 00:00

  Not After

  05-04-2025 23:59

  Subject

  SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  29-03-2022 00:00

  Not After

  14-03-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:31:98:06:c6:e4:9f:c3:d3:90:99:b8:19:5f:db:f0

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  15-06-2022 00:00

  Not After

  05-04-2025 23:59

  Subject

  SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  29-03-2022 00:00

  Not After

  14-03-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  49:1c:91:60:11:6c:c8:35:8e:d5:76:98:fb:d7:8a:50:31:ff:1e:72:0d:04:8a:be:04:f4:b1:5a:d1:21:c9:b6

  Signer

  Actual PE Digest

  49:1c:91:60:11:6c:c8:35:8e:d5:76:98:fb:d7:8a:50:31:ff:1e:72:0d:04:8a:be:04:f4:b1:5a:d1:21:c9:b6

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  08-09-2022 09:15

  Valid: true

  Chain 1

  SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Chain 2

  SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  66:bc:73:2b:06:a6:e1:f1:9a:b4:cc:c2:25:02:3d:d3:6f:b0:d3:0a

  Signer

  Actual PE Digest

  66:bc:73:2b:06:a6:e1:f1:9a:b4:cc:c2:25:02:3d:d3:6f:b0:d3:0a

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  08-09-2022 09:15

  Valid: true

  Chain 1

  SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Chain 2

  SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  comctl32

  ord17

  InitCommonControlsEx

  _TrackMouseEvent

  wldap32

  ord46

  ord22

  ord211

  ord217

  ord143

  ord50

  ord26

  ord30

  ord200

  ord32

  ord35

  ord79

  ord301

  ord27

  ord33

  ord60

  ord41

  ord45

  crypt32

  CryptStringToBinaryA

  CertOpenStore

  CertEnumCertificatesInStore

  CertAddCertificateContextToStore

  CryptQueryObject

  CertFindCertificateInStore

  CertFindExtension

  CertFreeCertificateChain

  CertFreeCertificateChainEngine

  CertGetCertificateChain

  CertCreateCertificateChainEngine

  PFXImportCertStore

  CertCloseStore

  CryptDecodeObjectEx

  CertFreeCertificateContext

  kernel32

  GetFileAttributesW

  SetFileTime

  lstrcpyW

  lstrcmpiW

  lstrcpynW

  GetLocalTime

  SetLastError

  FreeLibrary

  GetSystemDirectoryA

  LoadLibraryA

  GetModuleHandleA

  QueryPerformanceFrequency

  SleepEx

  QueryPerformanceCounter

  VerifyVersionInfoA

  GetEnvironmentVariableA

  PeekNamedPipe

  WaitForMultipleObjects

  GetFileType

  GetStdHandle

  MoveFileExA

  GetFileSizeEx

  CreateFileA

  GetDriveTypeW

  GetCurrentProcess

  GetLogicalDriveStringsW

  GetDiskFreeSpaceExW

  GetEnvironmentVariableW

  SetErrorMode

  CreateProcessW

  GetExitCodeProcess

  TerminateProcess

  lstrcmpW

  SetEndOfFile

  TerminateThread

  GetFileAttributesExW

  CreateThread

  SetFilePointerEx

  SetEvent

  CreateEventW

  SetFileAttributesW

  SetEnvironmentVariableA

  CompareStringW

  WriteConsoleW

  GetFullPathNameW

  IsValidLocale

  EnumSystemLocalesA

  GetLocaleInfoA

  SetStdHandle

  GetFullPathNameA

  GetEnvironmentStringsW

  CreateDirectoryW

  GetModuleFileNameA

  GetStringTypeW

  GetLocaleInfoW

  FlushFileBuffers

  GetConsoleMode

  GetConsoleCP

  SetHandleCount

  IsProcessorFeaturePresent

  HeapCreate

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  IsValidCodePage

  GetOEMCP

  IsDebuggerPresent

  UnhandledExceptionFilter

  GetCPInfo

  LCMapStringW

  MoveFileW

  FindNextFileW

  FindFirstFileExW

  GetDateFormatW

  GetTimeFormatW

  GetDateFormatA

  GetTimeFormatA

  GetFileInformationByHandle

  GetFileAttributesA

  FindFirstFileExA

  GetDriveTypeA

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  FindClose

  MoveFileA

  RtlUnwind

  GetStartupInfoW

  HeapSetInformation

  GetCommandLineA

  ExitThread

  InitializeCriticalSectionAndSpinCount

  RaiseException

  GetProcessHeap

  HeapSize

  HeapReAlloc

  HeapFree

  HeapAlloc

  HeapDestroy

  InterlockedExchange

  DecodePointer

  EncodePointer

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  SetFilePointer

  FormatMessageW

  FreeEnvironmentStringsW

  LocalFree

  DeleteFileA

  SizeofResource

  LockResource

  LoadResource

  FindResourceW

  FindResourceExW

  GetCurrentThreadId

  GetSystemDefaultLCID

  GetUserDefaultLCID

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  DeleteCriticalSection

  GetSystemTimeAsFileTime

  GetTimeZoneInformation

  GetProcAddress

  LoadLibraryW

  GetVersionExW

  GetNativeSystemInfo

  GetTempPathW

  lstrcatW

  CreateFileW

  WriteFile

  CloseHandle

  VirtualQuery

  GetModuleFileNameW

  GetCurrentProcessId

  OpenProcess

  FreeResource

  SetUnhandledExceptionFilter

  CreateSemaphoreW

  GetLastError

  DeleteFileW

  Sleep

  GlobalAlloc

  VerSetConditionMask

  ReleaseMutex

  CreateMutexW

  MulDiv

  ExitProcess

  InterlockedIncrement

  GetFileSize

  ReadFile

  GetTickCount

  WideCharToMultiByte

  GlobalLock

  GlobalUnlock

  lstrlenW

  GetModuleHandleW

  GetCurrentDirectoryW

  GetACP

  InterlockedDecrement

  WaitForSingleObject

  MultiByteToWideChar

  user32

  InvalidateRgn

  FillRect

  EqualRect

  SetWindowTextW

  GetWindowTextLengthW

  AdjustWindowRectEx

  SetPropW

  GetPropW

  CallWindowProcW

  EnableWindow

  DefWindowProcW

  GetMessageW

  RegisterClassW

  RegisterClassExW

  GetClassInfoExW

  SetWindowRgn

  TranslateMessage

  GetCaretBlinkTime

  GetParent

  GetWindowTextW

  GetActiveWindow

  GetWindow

  BeginPaint

  EndPaint

  ClientToScreen

  GetGUIThreadInfo

  MoveWindow

  CreateAcceleratorTableW

  CharPrevW

  SetRect

  DrawTextW

  GetWindowRgn

  UpdateLayeredWindow

  CreateCaret

  HideCaret

  ShowCaret

  SetCaretPos

  GetCaretPos

  DestroyMenu

  EnableMenuItem

  GetSystemMetrics

  wsprintfW

  MessageBoxW

  CreatePopupMenu

  AppendMenuW

  TrackPopupMenu

  ScreenToClient

  PtInRect

  GetWindowRect

  LoadIconW

  IsWindowEnabled

  UpdateWindow

  GetKeyNameTextW

  MapVirtualKeyExW

  GetKeyboardLayout

  DrawTextA

  wsprintfA

  FindWindowW

  GetLastActivePopup

  DispatchMessageW

  IsWindow

  GetClassNameW

  PostQuitMessage

  GetCursorPos

  IsIconic

  ShowWindow

  BringWindowToTop

  SetForegroundWindow

  SetActiveWindow

  OffsetRect

  InflateRect

  UnionRect

  SetCursor

  LoadCursorW

  GetKeyState

  GetClientRect

  SetWindowPos

  SetWindowLongW

  GetWindowLongW

  InvalidateRect

  SetTimer

  KillTimer

  SetCapture

  ReleaseCapture

  PostMessageW

  LoadImageW

  ReleaseDC

  GetDC

  SendMessageW

  CharNextW

  DestroyWindow

  IsZoomed

  SetFocus

  GetFocus

  CreateWindowExW

  MapWindowPoints

  GetSysColor

  GetMonitorInfoW

  MonitorFromWindow

  IntersectRect

  IsWindowVisible

  IsRectEmpty

  GetUpdateRect

  GetMenu

  gdi32

  GetTextExtentPointA

  SetBitmapBits

  GetBitmapBits

  CreateRectRgn

  PtInRegion

  GdiFlush

  GetObjectA

  SetBkColor

  GetCharABCWidthsW

  GetTextExtentPoint32W

  TextOutW

  CreatePenIndirect

  MoveToEx

  LineTo

  SetStretchBltMode

  CreateDIBSection

  StretchBlt

  CombineRgn

  GetClipBox

  CreateRectRgnIndirect

  ExtSelectClipRgn

  SelectClipRgn

  SetBkMode

  SetTextColor

  CreatePatternBrush

  CreateSolidBrush

  CreateRoundRectRgn

  SaveDC

  BitBlt

  RestoreDC

  Rectangle

  CreateEnhMetaFileW

  CloseEnhMetaFile

  SetWindowOrgEx

  RemoveFontMemResourceEx

  AddFontMemResourceEx

  CreatePen

  CreateDIBitmap

  GetEnhMetaFileHeader

  GetDeviceCaps

  CreateCompatibleDC

  CreateCompatibleBitmap

  PlayEnhMetaFile

  DeleteDC

  DeleteObject

  GetStockObject

  GetObjectW

  CreateFontIndirectW

  SelectObject

  GetTextMetricsW

  advapi32

  CryptAcquireContextA

  RegQueryValueExW

  RegCloseKey

  CryptReleaseContext

  CryptAcquireContextW

  RegEnumKeyExW

  CheckTokenMembership

  FreeSid

  AllocateAndInitializeSid

  RegDeleteValueW

  RegQueryInfoKeyW

  RegSetValueExW

  RegOpenKeyExW

  CryptImportKey

  CryptEncrypt

  CryptDestroyKey

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  CryptDestroyHash

  RegCreateKeyExW

  CryptGenRandom

  shell32

  Shell_NotifyIconW

  DragQueryFileW

  SHGetFolderPathW

  ShellExecuteExW

  SHBrowseForFolderW

  SHGetSpecialFolderPathW

  SHGetPathFromIDListW

  SHGetMalloc

  SHGetSpecialFolderLocation

  SHFileOperationW

  CommandLineToArgvW

  ord165

  ShellExecuteW

  ole32

  ReleaseStgMedium

  CreateStreamOnHGlobal

  OleLockRunning

  CLSIDFromString

  CLSIDFromProgID

  OleDuplicateData

  DoDragDrop

  CoCreateInstance

  CoUninitialize

  CoInitialize

  oleaut32

  VariantCopy

  SysAllocString

  VariantInit

  VariantChangeType

  SysFreeString

  VariantClear

  shlwapi

  wnsprintfW

  PathFileExistsW

  gdiplus

  GdipGetPropertyItem

  GdipGetPropertyItemSize

  GdipImageSelectActiveFrame

  GdipImageGetFrameCount

  GdipImageGetFrameDimensionsCount

  GdipGetImageHeight

  GdipGetImageWidth

  GdipDrawImageRectI

  GdipRotateWorldTransform

  GdipTranslateWorldTransform

  GdipCloneImage

  GdipCloneBrush

  GdipCreateFontFromLogfontA

  GdipCreateFontFromDC

  GdipMeasureString

  GdipDrawString

  GdipFillPath

  GdipFillRectangleI

  GdipDrawPath

  GdipDrawRectangleI

  GdipSetSmoothingMode

  GdipSetInterpolationMode

  GdipSetTextRenderingHint

  GdipCreateFromHDC

  ord1

  GdipAddPathLine

  GdipSetStringFormatTrimming

  GdipSetStringFormatLineAlign

  GdipSetStringFormatAlign

  GdipSetStringFormatFlags

  GdipSetPenMode

  GdipCreateSolidFill

  GdipDisposeImage

  GdipLoadImageFromStreamICM

  GdipLoadImageFromStream

  GdipDeleteFont

  GdipDeleteGraphics

  GdipDeletePath

  GdipCreatePath

  GdipStringFormatGetGenericTypographic

  GdipDeleteStringFormat

  GdipCloneStringFormat

  GdipDeletePen

  GdipCreatePen1

  GdipDeleteBrush

  GdipAlloc

  GdipFree

  GdiplusShutdown

  GdiplusStartup

  GdipImageGetFrameDimensionsList

  imm32

  ImmReleaseContext

  ImmGetContext

  ImmSetCompositionWindow

  dbghelp

  MiniDumpWriteDump

  ws2_32

  accept

  listen

  htonl

  sendto

  recvfrom

  WSAEnumNetworkEvents

  WSACloseEvent

  WSAEventSelect

  WSACreateEvent

  select

  __WSAFDIsSet

  ioctlsocket

  ntohl

  inet_ntoa

  getaddrinfo

  freeaddrinfo

  WSASetLastError

  connect

  socket

  getpeername

  getsockopt

  htons

  bind

  ntohs

  getsockname

  setsockopt

  WSAIoctl

  recv

  WSACleanup

  WSAGetLastError

  send

  closesocket

  WSAStartup

  gethostname

  gethostbyname

  winhttp

  WinHttpQueryHeaders

  WinHttpOpen

  WinHttpCloseHandle

  WinHttpCrackUrl

  WinHttpAddRequestHeaders

  WinHttpConnect

  WinHttpSendRequest

  WinHttpSetTimeouts

  WinHttpOpenRequest

  WinHttpReceiveResponse

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  GetFileVersionInfoW

  Sections

  .text

  Size: 1.0MB - Virtual size: 1.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 254KB - Virtual size: 254KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 32KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 17B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 300KB - Virtual size: 299KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 70KB - Virtual size: 70KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ