MaintopRIP6[.]1(20220520)[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

MaintopRIP6.1(20220520).7z
Size

452.9MB
MD5

6c689f225dab5c072415e4a452411866
SHA1

32cdc0752573aa7ca5b49ba867dadc356ddcd265
SHA256

ad257796e7cc52df258b28c6edd9ffc9abb262ab749dc94e0367c212913f8ee6
SHA512

8f9703e2dd8b59cb1cf077afff4bc69239ab65eba8eac13947735a83ebe16e883df803b61c461304313fd3f2244074a367e8f5fbc308b7526390186471314f10
SSDEEP

12582912:HClmtaxB7E2jdIkQChxGUBUx0audBOZbW4vGxlihivGoC:HinS1U9FPBOZ7+lihiOF

Score

1^/10

Malware Config

Signatures

Files

MaintopRIP6.1(20220520).7z
.7z
AUTORUN.INF
INSTALL.ICO
INSTALL/98rock.wpk
INSTALL/AUTOBKG.cht
INSTALL/CID.wpk
INSTALL/CIDFont.wpk
INSTALL/CJKTBL.WPK
INSTALL/CTL3D32.D__
.dll windows x86

26a6a8bb42f08001eb263fcd2b19f438

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
lstrcmpA
GetProcAddress
SizeofResource
FindResourceA
GetModuleHandleA
InitializeCriticalSection
GetVersion
GlobalDeleteAtom
GetEnvironmentVariableA
GetWindowsDirectoryA
GetModuleFileNameA
GetSystemDirectoryA
EnterCriticalSection
GlobalAddAtomA
GetProfileStringA
GetCurrentThreadId
LeaveCriticalSection
lstrlenA
GlobalAlloc
LoadResource
lstrcmpiA

user32

GetWindowTextA
OffsetRect
InflateRect
GetWindowRect
GetParent
IsIconic
DefWindowProcA
DefDlgProcA
GetClassInfoA
GetSystemMetrics
GetDC
CharPrevA
MessageBoxA
GetSysColor
InvalidateRect
ScreenToClient
ValidateRect
DrawFocusRect
IntersectRect
GetFocus
DrawTextA
IsWindowEnabled
ClientToScreen
ReleaseDC
ExcludeUpdateRgn
EndPaint
BeginPaint
ShowCaret
MapWindowPoints
HideCaret
GetWindowTextLengthA
GetWindow
CharNextA
GetClientRect
CallWindowProcA
RemovePropA
SetWindowsHookExA
CallNextHookEx
UnhookWindowsHookEx
GetWindowLongA
SendMessageA
IsWindowUnicode
GetClassNameA
SetWindowLongA
SetPropA
GetPropA
GetWindowDC

gdi32

DeleteObject
PatBlt
ExtTextOutA
IntersectClipRect
SetBkColor
SetTextColor
SelectObject
GetTextExtentPointA
CreateSolidBrush
DeleteDC
GetDeviceCaps
CreateCompatibleDC
SetBkMode
BitBlt
CreateDIBitmap

Exports

Exports

BtnWndProc3d
ComboWndProc3d
Ctl3dAutoSubclass
Ctl3dAutoSubclassEx
Ctl3dColorChange
Ctl3dCtlColor
Ctl3dCtlColorEx
Ctl3dDlgFramePaint
Ctl3dDlgProc
Ctl3dEnabled
Ctl3dGetVer
Ctl3dIsAutoSubclass
Ctl3dRegister
Ctl3dSetStyle
Ctl3dSubclassCtl
Ctl3dSubclassCtlEx
Ctl3dSubclassDlg
Ctl3dSubclassDlgEx
Ctl3dUnAutoSubclass
Ctl3dUnregister
Ctl3dUnsubclassCtl
Ctl3dWinIniChange
EditWndProc3d
ListWndProc3d
StaticWndProc3d

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 497B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 717B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
INSTALL/CTL3D32.NT
.dll windows x86

5cd639660424992a53b746aa2b3dcc2f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
GetModuleHandleA
GetProcAddress
GlobalDeleteAtom
SizeofResource
FindResourceW
InitializeCriticalSection
lstrcmpW
GetModuleFileNameW
GetEnvironmentVariableW
GetVersion
GlobalAddAtomW
GetSystemDirectoryW
GetWindowsDirectoryW
LeaveCriticalSection
GetProfileStringW
EnterCriticalSection
GlobalAlloc
LoadResource
lstrcmpiW
GetCurrentThreadId
lstrlenW

user32

ReleaseDC
OffsetRect
InflateRect
GetParent
GetWindow
IsWindowEnabled
IsIconic
DefWindowProcW
DefDlgProcW
GetClassInfoW
GetSystemMetrics
GetDC
CharPrevW
MessageBoxA
GetSysColor
InvalidateRect
ScreenToClient
ValidateRect
DrawFocusRect
IntersectRect
GetFocus
DrawTextW
CharNextW
ClientToScreen
GetWindowTextW
ExcludeUpdateRgn
EndPaint
BeginPaint
ShowCaret
MapWindowPoints
HideCaret
GetWindowTextLengthW
GetClientRect
CallWindowProcW
RemovePropW
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
GetWindowLongW
SendMessageW
IsWindowUnicode
GetClassNameW
SetWindowLongA
SetWindowLongW
SetPropW
GetPropW
GetWindowRect
GetWindowDC

gdi32

CreateDIBitmap
PatBlt
SetBkColor
DeleteObject
IntersectClipRect
GetTextExtentPointW
ExtTextOutW
SelectObject
GetDeviceCaps
SetTextColor
DeleteDC
BitBlt
CreateSolidBrush
SetBkMode
CreateCompatibleDC

Exports

Exports

BtnWndProc3d
ComboWndProc3d
Ctl3dAutoSubclass
Ctl3dAutoSubclassEx
Ctl3dColorChange
Ctl3dCtlColor
Ctl3dCtlColorEx
Ctl3dDlgFramePaint
Ctl3dDlgProc
Ctl3dEnabled
Ctl3dGetVer
Ctl3dIsAutoSubclass
Ctl3dRegister
Ctl3dSetStyle
Ctl3dSubclassCtl
Ctl3dSubclassCtlEx
Ctl3dSubclassDlg
Ctl3dSubclassDlgEx
Ctl3dUnAutoSubclass
Ctl3dUnregister
Ctl3dUnsubclassCtl
Ctl3dWinIniChange
EditWndProc3d
ListWndProc3d
StaticWndProc3d

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 557B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 717B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
INSTALL/ColorRendering.wpk
INSTALL/DTPRMV.EXE
.exe windows x86

e49bee4e147111bad0e6525be21b3e13

Code Sign

64:08:23:86:80:e0:17:40:34:d5:72:4d:6c:bd:7b:0a
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

16/06/2020, 00:00

Not After

15/08/2021, 23:59

Subject

CN=Maintop Technology Development Co.\, Ltd.,OU=Development,O=Maintop Technology Development Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

64:08:23:86:80:e0:17:40:34:d5:72:4d:6c:bd:7b:0a
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

16/06/2020, 00:00

Not After

15/08/2021, 23:59

Subject

CN=Maintop Technology Development Co.\, Ltd.,OU=Development,O=Maintop Technology Development Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

65:f5:d4:fb:6e:ef:57:4e:e9:b6:72:9f:d1:c6:f2:93:15:31:41:ed:9d:cb:6b:71:28:00:76:a9:e6:9f:d8:0f
Signer

Actual PE Digest

65:f5:d4:fb:6e:ef:57:4e:e9:b6:72:9f:d1:c6:f2:93:15:31:41:ed:9d:cb:6b:71:28:00:76:a9:e6:9f:d8:0f

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Maintop Technology Development Co.\, Ltd.,OU=Development,O=Maintop Technology Development Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN

24/05/2021, 07:44
Valid: false

16:6f:38:6c:c2:5c:7f:33:5d:96:eb:99:db:d3:46:6e:2a:c1:bb:19
Signer

Actual PE Digest

16:6f:38:6c:c2:5c:7f:33:5d:96:eb:99:db:d3:46:6e:2a:c1:bb:19

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Maintop Technology Development Co.\, Ltd.,OU=Development,O=Maintop Technology Development Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN

24/05/2021, 07:44
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DispatchMessageA
TranslateMessage
DestroyWindow
PeekMessageA
ShowWindow
DdeFreeStringHandle
DdeCreateStringHandleA
DdeCreateDataHandle
DdeClientTransaction
DdeDisconnect
DdeConnect
DdeUninitialize
DdeInitializeA
FreeDDElParam
UnpackDDElParam
FillRect
MessageBoxA
GetWindowRect
GetClientRect
SetWindowTextA
InvalidateRect
UpdateWindow
GetSystemMetrics
GetDlgItem
CreateDialogParamA
MoveWindow
wsprintfA

gdi32

SetTextColor
SetBkMode
SelectObject
GetTextExtentPointA
GetStockObject
ExtTextOutA

advapi32

RegDeleteKeyA
RegCloseKey
RegOpenKeyExA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetMalloc

ole32

CoInitialize
CoCreateInstance
CoUninitialize

kernel32

GetProcessHeap
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
DeleteFileW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetFilePointerEx
RemoveDirectoryW
FlushFileBuffers
GetConsoleCP
CreateFileW
HeapSize
GetFileSizeEx
HeapReAlloc
WriteConsoleW
GetCommandLineW
MultiByteToWideChar
LCMapStringW
CreateFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileSize
SetEndOfFile
SetFileAttributesA
SetFilePointer
CloseHandle
SetLastError
SetErrorMode
GetVersion
GetTickCount
GetSystemDirectoryA
GetWindowsDirectoryA
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryA
lstrcatA
CreateFileMappingA
WritePrivateProfileStringA
MoveFileExA
CreateToolhelp32Snapshot
Process32First
Process32Next
Module32First
Module32Next
DeleteFileA
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetFileType
RtlUnwind
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
ReadFile
GetConsoleMode
ReadConsoleW

Sections

.text
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
INSTALL/ENU.WPK
INSTALL/FONT.WPK
INSTALL/FS.wpk
INSTALL/FixCIDInitProc.wpk
INSTALL/FixCMapCategory.wpk
INSTALL/INSTALL.EXE
.exe windows x86

2dd35368dacb90d8e80cd6e8f9377c42

Code Sign

64:08:23:86:80:e0:17:40:34:d5:72:4d:6c:bd:7b:0a
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

16/06/2020, 00:00

Not After

15/08/2021, 23:59

Subject

CN=Maintop Technology Development Co.\, Ltd.,OU=Development,O=Maintop Technology Development Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

64:08:23:86:80:e0:17:40:34:d5:72:4d:6c:bd:7b:0a
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

16/06/2020, 00:00

Not After

15/08/2021, 23:59

Subject

CN=Maintop Technology Development Co.\, Ltd.,OU=Development,O=Maintop Technology Development Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

df:01:bc:8d:07:93:ca:f7:41:13:d0:83:d8:7a:10:a0:32:30:9a:f0:48:4f:7a:56:0b:26:f4:39:15:2e:27:33
Signer

Actual PE Digest

df:01:bc:8d:07:93:ca:f7:41:13:d0:83:d8:7a:10:a0:32:30:9a:f0:48:4f:7a:56:0b:26:f4:39:15:2e:27:33

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Maintop Technology Development Co.\, Ltd.,OU=Development,O=Maintop Technology Development Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN

24/05/2021, 07:44
Valid: false

b8:9e:20:f1:cb:68:d4:21:66:cf:97:6d:85:45:e1:d4:a5:6d:5e:2e
Signer

Actual PE Digest

b8:9e:20:f1:cb:68:d4:21:66:cf:97:6d:85:45:e1:d4:a5:6d:5e:2e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Maintop Technology Development Co.\, Ltd.,OU=Development,O=Maintop Technology Development Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN

24/05/2021, 07:44
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

OffsetRect
RegisterWindowMessageA
VkKeyScanA
GetClassNameA
GetCursorPos
SetCursorPos
GetClientRect
DestroyIcon
LoadIconA
DestroyCursor
IsDialogMessageA
GetWindow
EndDialog
DialogBoxParamA
CreateDialogParamA
WaitMessage
PeekMessageA
DispatchMessageA
TranslateMessage
DrawFocusRect
MessageBeep
GetWindowThreadProcessId
SetWindowLongA
GetWindowLongA
GetSysColorBrush
GetWindowTextLengthA
GetWindowTextA
EndPaint
BeginPaint
TranslateAcceleratorA
IsWindowEnabled
ReleaseCapture
SetCapture
SendDlgItemMessageA
IsWindowVisible
DestroyWindow
CreateWindowExA
RegisterClassExA
RegisterClassA
CallWindowProcA
PostQuitMessage
DefWindowProcA
GetSysColor
ReleaseDC
GetDC
InvertRect
FillRect
SetScrollRange
SetScrollPos
GetWindowDC
SetActiveWindow
TrackPopupMenu
AppendMenuA
CheckMenuItem
DestroyMenu
ShowCursor
CreatePopupMenu
GetActiveWindow
SetWindowPos
GetFocus
MapVirtualKeyA
DdeFreeStringHandle
DdeCreateStringHandleA
DdeCreateDataHandle
DdeClientTransaction
DdeDisconnect
DdeConnect
DdeUninitialize
DdeInitializeA
LoadCursorA
ScreenToClient
SetCursor
GetWindowRect
IsDlgButtonChecked
CheckRadioButton
GetDlgItem
MoveWindow
LoadStringA
MessageBoxA
SetWindowTextA
GetSystemMetrics
SetFocus
BringWindowToTop
ExitWindowsEx
SendMessageA
GetParent
InvalidateRect
UpdateWindow
DrawTextA
EnableWindow
GetDlgCtrlID
ShowWindow
GetClassInfoA
PostMessageA

gdi32

CreateRectRgn
Ellipse
GetClipRgn
SelectClipRgn
SetPolyFillMode
SetROP2
AbortPath
BeginPath
CloseFigure
EndPath
FillPath
SelectClipPath
SetMiterLimit
StrokePath
ExtCreatePen
Polyline
PolyBezierTo
SetBkColor
DeleteObject
GetStockObject
LineTo
Rectangle
SelectObject
SetTextColor
MoveToEx
SetDIBitsToDevice
GetTextExtentPointA
SetBkMode
ExtTextOutA
PolylineTo
SelectPalette
RealizePalette
PatBlt
GetTextExtentPoint32A
GetDeviceCaps
DeleteDC
CreateSolidBrush
CreatePalette
CreateFontA
SetTextAlign
TextOutW
CreateFontIndirectA
GetGlyphOutlineW
GetTextMetricsA
TextOutA
GetFontUnicodeRanges
CreateDIBPatternBrushPt
CreateDIBPatternBrush
CreateDIBitmap
CreateCompatibleDC
CreatePen
BitBlt
CreateBitmap

advapi32

RegCloseKey
RegDeleteKeyA
RegSetValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
RegOpenKeyExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA

shell32

CommandLineToArgvW
SHBrowseForFolderA
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

ole32

CoUninitialize
CoCreateInstance
CoInitialize

hid

HidD_GetAttributes
HidP_GetCaps
HidD_GetPreparsedData
HidD_FreePreparsedData
HidD_GetHidGuid
HidD_FlushQueue

setupapi

SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces

winscard

SCardListReadersA
SCardConnectA
SCardEstablishContext
SCardReleaseContext
SCardReconnect
g_rgSCardT1Pci
SCardTransmit
SCardDisconnect

ws2_32

gethostbyname
inet_ntoa
WSACleanup
gethostname
WSAStartup

netapi32

Netbios

kernel32

GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetProcessHeap
GetTimeZoneInformation
CreateDirectoryW
HeapReAlloc
GetFileAttributesExW
TlsGetValue
TlsAlloc
GetVersionExA
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersion
GetSystemDirectoryA
GetCurrentDirectoryA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
TlsSetValue
WinExec
CreateProcessA
WaitForSingleObject
GetCurrentProcess
GetLastError
CloseHandle
GetDriveTypeA
GetLogicalDrives
GetCommandLineW
CopyFileA
TlsFree
MultiByteToWideChar
GetCurrentProcessId
SetErrorMode
WideCharToMultiByte
GetTickCount
GetCurrentThreadId
SetEvent
CreateEventA
Sleep
IsBadWritePtr
IsBadReadPtr
lstrlenA
CreateMutexA
lstrcatA
lstrcpyA
ReleaseMutex
ReadFile
GetOverlappedResult
WriteFile
CreateFileA
OpenEventA
OpenMutexA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwind
RaiseException
LoadLibraryExW
MoveFileExW
FindClose
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
SetFilePointerEx
WriteConsoleW
GetDiskFreeSpaceW
CreateFileW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
GetModuleFileNameW
SetEndOfFile
HeapFree
GetFileSizeEx
CompareStringW
LCMapStringW
SetStdHandle
HeapAlloc
DeleteFileW
GetLocaleInfoA
DecodePointer

comdlg32

CommDlgExtendedError
GetOpenFileNameA

Sections

.text
Size: 405KB - Virtual size: 405KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
INSTALL/INSTBKG.CHS
INSTALL/INSTBKG.CHT
INSTALL/INSTBKG.ENU
INSTALL/INSTBKG.JPN
INSTALL/INSTDLL.CHS
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INSTALL/INSTDLL.CHT
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INSTALL/INSTDLL.ENU
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INSTALL/INSTMSG.CHS
INSTALL/INSTMSG.CHT
INSTALL/INSTMSG.JPN
INSTALL/INSTTBL.CHS
INSTALL/INSTTBL.CHT
INSTALL/INSTTBL.ENU
INSTALL/IccCmyk.wpk
INSTALL/IccRgb.wpk
INSTALL/IdiomSet.wpk
INSTALL/JPN.WPK
INSTALL/Lib.wpk
INSTALL/Mapping.wpk
INSTALL/PDFToPSExtra.wpk
INSTALL/PGF.wpk
INSTALL/PRINTERW.INF
INSTALL/PSPRNW.INF
INSTALL/ProcSet.wpk
INSTALL/README.TXT
INSTALL/READMEE.TXT
INSTALL/READMEF.TXT
INSTALL/READMEJP.TXT
INSTALL/SAMPLE.WPK
INSTALL/SAMPLE_E.WPK
INSTALL/SAMPLE_T.WPK
INSTALL/STYLE.WPK
INSTALL/STYLECHS.WPK
INSTALL/Sys.wpk
INSTALL/UNI16.WPK
INSTALL/WESTFONT.DOT
INSTALL/WESTFONT.VCT
INSTALL/WGL.WPK
INSTALL/WTPCHT.WPK
INSTALL/WTPENU.WPK
INSTALL/adobedll.wpk
INSTALL/adobet.wpk
INSTALL/charstrings.wpk
INSTALL/chs.wpk
INSTALL/cht.wpk
INSTALL/cmap.wpk
INSTALL/cmapa.wpk
INSTALL/crop.wpk
INSTALL/data.wpk
INSTALL/driver.wpk
INSTALL/dtpa.wpk
INSTALL/dtpw.wpk
INSTALL/encodings.wpk
INSTALL/fonts.wpk
INSTALL/hplib.wpk
INSTALL/mac.wpk
INSTALL/monchs.wpk
INSTALL/moncht.wpk
INSTALL/monenu.wpk
INSTALL/monx64.wpk
INSTALL/mtmon.wpk
INSTALL/pgfonts.wpk
INSTALL/pgfsupp.wpk
INSTALL/prs.wpk
INSTALL/prs0.wpk
INSTALL/prs1.wpk
INSTALL/prs2.wpk
INSTALL/prs3.wpk
INSTALL/prs4.wpk
INSTALL/prs5.wpk
INSTALL/prs6.wpk
INSTALL/prs7.wpk
INSTALL/ps.wpk
INSTALL/psfont.wpk
INSTALL/psfontp.wpk
INSTALL/usb.wpk
INSTALL/usbdx64.wpk
INSTALL/usbdx86.wpk
INSTALL/usbx64.wpk
INSTALL/win.wpk
INSTALL/wtp.wpk
SETUP.EXE
.exe windows x86

043c266187c9bce24b9afed3cdd47803

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

74:68:75:b7:26:8a:a3:7f:98:69:90:3f:b1:80:15:80
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

31/05/2018, 00:00

Not After

31/05/2019, 23:59

Subject

CN=MainTop Technology Development Co.\, Ltd.,OU=Development,O=MainTop Technology Development Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:68:75:b7:26:8a:a3:7f:98:69:90:3f:b1:80:15:80
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

31/05/2018, 00:00

Not After

31/05/2019, 23:59

Subject

CN=MainTop Technology Development Co.\, Ltd.,OU=Development,O=MainTop Technology Development Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ac:e1:40:ea:80:7d:a1:89:34:da:16:f6:67:60:cf:61:ac:a1:d0:97:e9:e7:e6:7e:66:2d:61:5d:c5:8f:7e:2b
Signer

Actual PE Digest

ac:e1:40:ea:80:7d:a1:89:34:da:16:f6:67:60:cf:61:ac:a1:d0:97:e9:e7:e6:7e:66:2d:61:5d:c5:8f:7e:2b

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=MainTop Technology Development Co.\, Ltd.,OU=Development,O=MainTop Technology Development Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN

01/06/2018, 06:09
Valid: false

bd:c8:f8:23:8b:70:5b:fb:f1:55:e3:36:c3:95:31:35:89:51:d5:51
Signer

Actual PE Digest

bd:c8:f8:23:8b:70:5b:fb:f1:55:e3:36:c3:95:31:35:89:51:d5:51

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=MainTop Technology Development Co.\, Ltd.,OU=Development,O=MainTop Technology Development Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN

01/06/2018, 06:09
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetStdHandle
DeleteFileA
CreateFileA
CloseHandle
GetCommandLineA
GetCurrentDirectoryA
GetCurrentThreadId
EnterCriticalSection
ExitProcess
GetEnvironmentVariableA
GetFileAttributesA
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetDriveTypeA
GetEnvironmentStrings
GetVersion
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
RaiseException
ReadFile
RtlUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryA
SetEnvironmentVariableA
SetErrorMode
SetFilePointer
SetHandleCount
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WinExec
WriteFile
GetStartupInfoA

user32

MessageBoxA
EnumThreadWindows

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
__DebuggerHookData
__GetExceptDLLinfo

Sections

CODE
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SETUP.INF

Sharing

General

Malware Config

Signatures

Files

26a6a8bb42f08001eb263fcd2b19f438

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 14KB

.bss Size: - Virtual size: 20KB

.rdata Size: 512B - Virtual size: 264B

.data Size: 512B - Virtual size: 497B

.idata Size: 2KB - Virtual size: 2KB

.edata Size: 1024B - Virtual size: 717B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 1KB

5cd639660424992a53b746aa2b3dcc2f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 14KB

.bss Size: - Virtual size: 20KB

.rdata Size: 512B - Virtual size: 384B

.data Size: 1024B - Virtual size: 557B

.idata Size: 2KB - Virtual size: 2KB

.edata Size: 1024B - Virtual size: 717B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 1KB

e49bee4e147111bad0e6525be21b3e13

Code Sign

64:08:23:86:80:e0:17:40:34:d5:72:4d:6c:bd:7b:0aCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

64:08:23:86:80:e0:17:40:34:d5:72:4d:6c:bd:7b:0aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

65:f5:d4:fb:6e:ef:57:4e:e9:b6:72:9f:d1:c6:f2:93:15:31:41:ed:9d:cb:6b:71:28:00:76:a9:e6:9f:d8:0fSigner

Signature Validations

Verification

24/05/2021, 07:44 Valid: false

16:6f:38:6c:c2:5c:7f:33:5d:96:eb:99:db:d3:46:6e:2a:c1:bb:19Signer

Signature Validations

Verification

24/05/2021, 07:44 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

user32

gdi32

advapi32

shell32

ole32

kernel32

Sections

.text
Size: 15KB - Virtual size: 14KB

.bss
Size: - Virtual size: 20KB

.rdata
Size: 512B - Virtual size: 264B

.data
Size: 512B - Virtual size: 497B

.idata
Size: 2KB - Virtual size: 2KB

.edata
Size: 1024B - Virtual size: 717B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 15KB - Virtual size: 14KB

.bss
Size: - Virtual size: 20KB

.rdata
Size: 512B - Virtual size: 384B

.data
Size: 1024B - Virtual size: 557B

.idata
Size: 2KB - Virtual size: 2KB

.edata
Size: 1024B - Virtual size: 717B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB

64:08:23:86:80:e0:17:40:34:d5:72:4d:6c:bd:7b:0a
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

64:08:23:86:80:e0:17:40:34:d5:72:4d:6c:bd:7b:0a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

65:f5:d4:fb:6e:ef:57:4e:e9:b6:72:9f:d1:c6:f2:93:15:31:41:ed:9d:cb:6b:71:28:00:76:a9:e6:9f:d8:0f
Signer

24/05/2021, 07:44
Valid: false

16:6f:38:6c:c2:5c:7f:33:5d:96:eb:99:db:d3:46:6e:2a:c1:bb:19
Signer

24/05/2021, 07:44
Valid: false

.text
Size: 86KB - Virtual size: 85KB

.rdata
Size: 28KB - Virtual size: 28KB

.data
Size: 2KB - Virtual size: 21KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 4KB

64:08:23:86:80:e0:17:40:34:d5:72:4d:6c:bd:7b:0a
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

64:08:23:86:80:e0:17:40:34:d5:72:4d:6c:bd:7b:0a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

df:01:bc:8d:07:93:ca:f7:41:13:d0:83:d8:7a:10:a0:32:30:9a:f0:48:4f:7a:56:0b:26:f4:39:15:2e:27:33
Signer

24/05/2021, 07:44
Valid: false

b8:9e:20:f1:cb:68:d4:21:66:cf:97:6d:85:45:e1:d4:a5:6d:5e:2e
Signer

24/05/2021, 07:44
Valid: false

.text
Size: 405KB - Virtual size: 405KB

.rdata
Size: 109KB - Virtual size: 108KB

.data
Size: 40KB - Virtual size: 548KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 21KB - Virtual size: 21KB

.rdata
Size: 512B - Virtual size: 112B

.rsrc
Size: 4KB - Virtual size: 3KB

.rdata
Size: 512B - Virtual size: 112B

.rsrc
Size: 4KB - Virtual size: 3KB