Extracted

Extracted

• 10406548368.zip

  .zip

  Password: infected

• 05aa0587937c153ffbd573c6ba35a446e7c9eae62a39308d6e800e127156c468

  .exe windows x64

  d896fbd44874f6dc349fa19cf7d92573

  
  

  Code Sign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01/08/2022, 00:00

  Not After

  09/11/2031, 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  51:43:cf:38:d5:fd:26:85:88:30:82:66:32:be:9f:da

  Certificate

  Issuer

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  Not Before

  31/10/2022, 16:01

  Not After

  31/10/2023, 15:58

  Subject

  SERIALNUMBER=NV20222585426,CN=DIGI CORP MEDIA LLC,O=DIGI CORP MEDIA LLC,L=Henderson,ST=Nevada,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13064e6576616461,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  56:b6:29:cd:34:bc:78:f6

  Certificate

  Issuer

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  31/05/2017, 18:14

  Not After

  30/05/2042, 18:14

  Subject

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23/03/2022, 00:00

  Not After

  22/03/2037, 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21/09/2022, 00:00

  Not After

  21/11/2033, 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

  Certificate

  Issuer

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  26/03/2019, 17:44

  Not After

  22/03/2034, 17:44

  Subject

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  8a:ab:f8:5b:7f:f8:04:4e:cf:9d:7a:d9:f1:85:03:20:91:f1:65:e1

  Signer

  Actual PE Digest

  8a:ab:f8:5b:7f:f8:04:4e:cf:9d:7a:d9:f1:85:03:20:91:f1:65:e1

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  SERIALNUMBER=NV20222585426,CN=DIGI CORP MEDIA LLC,O=DIGI CORP MEDIA LLC,L=Henderson,ST=Nevada,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13064e6576616461,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  01/01/0001, 00:00

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  CreateFileA

  CloseHandle

  GetComputerNameA

  GetLastError

  GetCurrentDirectoryA

  ConvertThreadToFiber

  CreateFiber

  SwitchToFiber

  GetFileType

  CreateFileMappingA

  SetFileTime

  MapViewOfFile

  CreateNamedPipeA

  WaitNamedPipeA

  ConnectNamedPipe

  ExitProcess

  VirtualAlloc

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  GetModuleHandleW

  RtlUnwindEx

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  GetStdHandle

  WriteFile

  GetModuleFileNameW

  MultiByteToWideChar

  WideCharToMultiByte

  GetCurrentProcess

  TerminateProcess

  GetModuleHandleExW

  GetACP

  HeapFree

  HeapAlloc

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  CompareStringW

  LCMapStringW

  SetStdHandle

  GetStringTypeW

  GetProcessHeap

  HeapReAlloc

  HeapSize

  RaiseException

  FlushFileBuffers

  GetConsoleCP

  GetConsoleMode

  SetFilePointerEx

  WriteConsoleW

  CreateFileW

  Sections

  .text

  Size: 85KB - Virtual size: 85KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1.0MB - Virtual size: 1.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 326KB - Virtual size: 333KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gfids

  Size: 512B - Virtual size: 164B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 187754f20558b7d67abb233e84ee14a85ea1791983d87d5a4dfe062799ae3d3c

  .dll windows x64

  7e67bc8966663720e52fe10778f5a917

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  GetCommandLineA

  GetComputerNameA

  GetLastError

  GetCurrentDirectoryA

  TryEnterCriticalSection

  DeleteCriticalSection

  ConvertThreadToFiber

  CreateFiber

  SwitchToFiber

  CreateThread

  ResumeThread

  GetCurrentProcessId

  DeleteFileA

  WaitForMultipleObjects

  CreateNamedPipeA

  ConnectNamedPipe

  VirtualAlloc

  RaiseException

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  SetLastError

  HeapAlloc

  HeapFree

  GetModuleHandleW

  GetProcAddress

  TlsGetValue

  TlsSetValue

  FreeLibrary

  LoadLibraryExW

  CompareStringW

  LCMapStringW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  ExitProcess

  GetModuleHandleExW

  GetStringTypeW

  MultiByteToWideChar

  WideCharToMultiByte

  HeapSize

  HeapReAlloc

  RtlUnwindEx

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  Exports

  Exports

  DJdVnx91R

  IvJaY000CQ6R

  NXSVPFt

  UWOLaD37j

  YJQLe220R3

  bYXjdERymsFY

  Sections

  .text

  Size: 108KB - Virtual size: 107KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 433KB - Virtual size: 433KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 864KB - Virtual size: 869KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gfids

  Size: 512B - Virtual size: 20B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 2d5c9b33ed298f5fb67ce869c74b2f2ec9179a924780da65fcbc1a0e0463c5d0

  .dll windows x64

  83f847006bcd9e79aedb74fc499583c6

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  shlwapi

  StrToIntA

  StrChrA

  PathFindFileNameW

  kernel32

  VirtualFree

  lstrcpyA

  lstrcmpA

  lstrcatA

  GetProcAddress

  FreeLibrary

  VirtualAlloc

  GetCurrentThread

  GetCurrentThreadId

  CloseHandle

  GetModuleHandleW

  VirtualProtectEx

  LoadLibraryA

  GetModuleHandleA

  VirtualQuery

  lstrlenA

  VirtualQueryEx

  GetCurrentProcess

  UnmapViewOfFile

  Exports

  Exports

  qTvXmKQsNWzW

  setPath

  Sections

  .text

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1.4MB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 468B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 192B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 35f2ec59313bbe5b78e4b043f06f8961f6f3e77b870544d15ee7cc1fca987d8c

  .exe windows x64

  5a83b775f11fca962faec5d7d036c1c6

  
  

  Code Sign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25/05/2021, 00:00

  Not After

  31/12/2028, 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22/03/2021, 00:00

  Not After

  21/03/2036, 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  65:cf:d8:41:9d:70:ce:40:11:d9:7b:c7:9d:18:31:5e

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  08/07/2022, 00:00

  Not After

  08/07/2023, 23:59

  Subject

  CN=FACE AESTHETICS LTD,O=FACE AESTHETICS LTD,ST=Shropshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  5c:c5:af:f6:f9:0f:0f:13:b4:9d:7d:da:0f:87:2d:34:3f:11:40:c2:56:4e:22:64:5c:7f:e0:a9:35:65:ba:0c

  Signer

  Actual PE Digest

  5c:c5:af:f6:f9:0f:0f:13:b4:9d:7d:da:0f:87:2d:34:3f:11:40:c2:56:4e:22:64:5c:7f:e0:a9:35:65:ba:0c

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=FACE AESTHETICS LTD,O=FACE AESTHETICS LTD,ST=Shropshire,C=GB

  11/05/2023, 10:07

  Valid: true

  Chain 1

  CN=FACE AESTHETICS LTD,O=FACE AESTHETICS LTD,ST=Shropshire,C=GB

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  GetProcessHeap

  CreateFileA

  CloseHandle

  GetLastError

  ConvertThreadToFiber

  CreateFiber

  DeleteFiber

  SwitchToFiber

  CreateThread

  ReadFile

  CreateFileMappingA

  MapViewOfFile

  ExitProcess

  VirtualAlloc

  GetCurrentProcess

  ExitThread

  HeapLock

  HeapUnlock

  CreateFileW

  GetFileType

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  WriteConsoleW

  HeapFree

  GetModuleHandleW

  GetProcAddress

  HeapAlloc

  MultiByteToWideChar

  WideCharToMultiByte

  SetLastError

  GetACP

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  WriteFile

  GetConsoleCP

  GetConsoleMode

  SetStdHandle

  SetEndOfFile

  ReadConsoleW

  SetFilePointerEx

  GetStringTypeW

  GetCPInfo

  InitializeCriticalSectionAndSpinCount

  TlsGetValue

  TlsSetValue

  FreeLibrary

  LoadLibraryExW

  LCMapStringW

  IsValidCodePage

  GetOEMCP

  HeapSize

  HeapReAlloc

  GetModuleHandleExW

  FlushFileBuffers

  RaiseException

  CreateEventW

  RtlUnwindEx

  Sections

  .text

  Size: 51KB - Virtual size: 51KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 602KB - Virtual size: 601KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 929KB - Virtual size: 933KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gfids

  Size: 512B - Virtual size: 40B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 9570591e6b867c4f84aa74812957f13bc648ba7d2f1cbff9545005ededcb45f9

  .exe windows x64

  5a83b775f11fca962faec5d7d036c1c6

  
  

  Code Sign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25/05/2021, 00:00

  Not After

  31/12/2028, 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22/03/2021, 00:00

  Not After

  21/03/2036, 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  65:cf:d8:41:9d:70:ce:40:11:d9:7b:c7:9d:18:31:5e

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  08/07/2022, 00:00

  Not After

  08/07/2023, 23:59

  Subject

  CN=FACE AESTHETICS LTD,O=FACE AESTHETICS LTD,ST=Shropshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0d:3f:57:8d:4f:f5:47:8c:c5:92:9b:33:0e:9f:fa:e9:fc:00:6e:ba:6e:92:c6:20:60:ac:57:aa:e7:b7:99:e6

  Signer

  Actual PE Digest

  0d:3f:57:8d:4f:f5:47:8c:c5:92:9b:33:0e:9f:fa:e9:fc:00:6e:ba:6e:92:c6:20:60:ac:57:aa:e7:b7:99:e6

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=FACE AESTHETICS LTD,O=FACE AESTHETICS LTD,ST=Shropshire,C=GB

  11/05/2023, 10:07

  Valid: true

  Chain 1

  CN=FACE AESTHETICS LTD,O=FACE AESTHETICS LTD,ST=Shropshire,C=GB

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  GetProcessHeap

  CreateFileA

  CloseHandle

  GetLastError

  ConvertThreadToFiber

  CreateFiber

  DeleteFiber

  SwitchToFiber

  CreateThread

  ReadFile

  CreateFileMappingA

  MapViewOfFile

  ExitProcess

  VirtualAlloc

  GetCurrentProcess

  ExitThread

  HeapLock

  HeapUnlock

  CreateFileW

  GetFileType

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  WriteConsoleW

  HeapFree

  GetModuleHandleW

  GetProcAddress

  HeapAlloc

  MultiByteToWideChar

  WideCharToMultiByte

  SetLastError

  GetACP

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  WriteFile

  GetConsoleCP

  GetConsoleMode

  SetStdHandle

  SetEndOfFile

  ReadConsoleW

  SetFilePointerEx

  GetStringTypeW

  GetCPInfo

  InitializeCriticalSectionAndSpinCount

  TlsGetValue

  TlsSetValue

  FreeLibrary

  LoadLibraryExW

  LCMapStringW

  IsValidCodePage

  GetOEMCP

  HeapSize

  HeapReAlloc

  GetModuleHandleExW

  FlushFileBuffers

  RaiseException

  CreateEventW

  RtlUnwindEx

  Sections

  .text

  Size: 51KB - Virtual size: 51KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 599KB - Virtual size: 598KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 928KB - Virtual size: 932KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gfids

  Size: 512B - Virtual size: 40B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• d6fd979020f6dd1d550b08fe33fec962359efe1479fca5a7d4240e9e05540cf0

  .dll windows x64

  2fe2e7082a95cdfb4a2c89d515c31d6e

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  crypt32

  CertVerifyCertificateChainPolicy

  CertCreateCertificateChainEngine

  CertGetCertificateChain

  CertFreeCertificateChain

  CertFreeCertificateChainEngine

  CertFreeCertificateContext

  secur32

  InitSecurityInterfaceA

  shlwapi

  PathCombineW

  StrStrIW

  PathRemoveExtensionW

  PathFindFileNameW

  PathFileExistsW

  StrCmpIW

  kernel32

  Process32NextW

  Process32FirstW

  CloseHandle

  OpenProcess

  GetFileAttributesA

  GetCurrentProcess

  ResumeThread

  CreateEventW

  SetEvent

  GetThreadContext

  GetProcAddress

  GetModuleHandleW

  SetThreadContext

  SetWaitableTimer

  TlsSetValue

  SetLastError

  EnterCriticalSection

  CreateWaitableTimerW

  WaitForMultipleObjects

  InitializeCriticalSectionAndSpinCount

  LeaveCriticalSection

  GetQueuedCompletionStatus

  PostQueuedCompletionStatus

  FormatMessageW

  GetLastError

  TerminateThread

  TlsAlloc

  QueueUserAPC

  LocalFree

  DeleteCriticalSection

  VerSetConditionMask

  WideCharToMultiByte

  SleepEx

  VerifyVersionInfoW

  TlsGetValue

  TlsFree

  FormatMessageA

  CreateIoCompletionPort

  AreFileApisANSI

  ReadFile

  SetHandleInformation

  CreateNamedPipeA

  WriteFile

  TerminateProcess

  GetCurrentThreadId

  GetSystemDirectoryW

  MultiByteToWideChar

  CreateFileA

  GetEnvironmentStrings

  CreateProcessA

  FreeEnvironmentStringsA

  GetExitCodeProcess

  LoadLibraryW

  Sleep

  Thread32Next

  Thread32First

  GetModuleHandleA

  LoadLibraryA

  VirtualProtectEx

  OpenThread

  HeapFree

  VirtualAlloc

  lstrlenA

  CreateFileW

  CreateToolhelp32Snapshot

  HeapAlloc

  GetFileSize

  GetProcessHeap

  GetModuleFileNameA

  GetModuleFileNameW

  SetFilePointer

  lstrcmpA

  VirtualProtect

  VirtualFree

  Wow64DisableWow64FsRedirection

  ExpandEnvironmentStringsW

  Wow64RevertWow64FsRedirection

  GetWindowsDirectoryW

  GetCurrentDirectoryW

  GlobalMemoryStatusEx

  GetTickCount

  GetFileAttributesW

  GetStdHandle

  WriteConsoleW

  SetStdHandle

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  WaitForSingleObject

  GetCurrentProcessId

  CopyFileA

  lstrcatA

  GetTempFileNameW

  CopyFileW

  DeleteFileW

  FindClose

  GetTempPathW

  FindNextFileW

  FindFirstFileW

  ReadConsoleW

  HeapSize

  SetEndOfFile

  GetCommandLineA

  FindNextFileA

  FindFirstFileExA

  GetTimeZoneInformation

  GetOEMCP

  IsValidCodePage

  SetFilePointerEx

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetTimeFormatW

  GetDateFormatW

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  GetFileType

  ExitProcess

  GetACP

  GetModuleHandleExW

  ExitThread

  RtlUnwindEx

  HeapReAlloc

  CreateTimerQueue

  UnregisterWaitEx

  QueryDepthSList

  InterlockedFlushSList

  InterlockedPushEntrySList

  InterlockedPopEntrySList

  ReleaseSemaphore

  DuplicateHandle

  GetVersionExW

  LoadLibraryExW

  FreeLibraryAndExitThread

  FreeLibrary

  GetThreadTimes

  GetCurrentThread

  UnregisterWait

  RegisterWaitForSingleObject

  SetThreadAffinityMask

  GetProcessAffinityMask

  GetNumaHighestNodeNumber

  DeleteTimerQueueTimer

  ChangeTimerQueueTimer

  CreateTimerQueueTimer

  GetLogicalProcessorInformation

  GetThreadPriority

  SetThreadPriority

  CreateThread

  SwitchToThread

  SignalObjectAndWait

  InitializeSListHead

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  WaitForSingleObjectEx

  ResetEvent

  GetCPInfo

  GetStringTypeW

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  RtlPcToFileHeader

  EncodePointer

  DecodePointer

  RaiseException

  QueryPerformanceCounter

  QueryPerformanceFrequency

  TryEnterCriticalSection

  GetSystemTimeAsFileTime

  user32

  FindWindowW

  GetCursorPos

  advapi32

  RegQueryValueExW

  GetUserNameW

  RegOpenKeyExW

  RegEnumKeyExW

  RegQueryInfoKeyW

  RegCloseKey

  EnumServicesStatusExW

  OpenSCManagerW

  LookupPrivilegeValueW

  CloseServiceHandle

  shell32

  SHGetKnownFolderPath

  SHGetSpecialFolderPathA

  SHGetSpecialFolderPathW

  ole32

  CoCreateInstance

  CoInitializeEx

  CoInitializeSecurity

  CoUninitialize

  CoTaskMemFree

  CoSetProxyBlanket

  oleaut32

  SafeArrayGetUBound

  VariantClear

  SysAllocString

  SysFreeString

  VariantInit

  SafeArrayAccessData

  SafeArrayUnaccessData

  SafeArrayGetElement

  SafeArrayGetLBound

  mpr

  WNetGetProviderNameW

  iphlpapi

  GetAdaptersInfo

  wtsapi32

  WTSEnumerateProcessesA

  WTSFreeMemory

  ws2_32

  WSAStartup

  connect

  getsockopt

  getaddrinfo

  WSASocketW

  WSARecv

  WSAGetLastError

  WSASetLastError

  shutdown

  setsockopt

  ioctlsocket

  freeaddrinfo

  WSACleanup

  closesocket

  WSASend

  select

  rpcrt4

  RpcServerListen

  RpcMgmtStopServerListening

  RpcServerUnregisterIf

  RpcBindingFree

  NdrServerCall2

  RpcServerUseProtseqEpA

  RpcServerRegisterIfEx

  Exports

  Exports

  dataCheck

  setPath

  Sections

  .text

  Size: 880KB - Virtual size: 878KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 344KB - Virtual size: 343KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 112KB - Virtual size: 111KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 48KB - Virtual size: 46KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gfids

  Size: 8KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 8KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ