Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
8302b366de6704279033f60b1dbcf4f4b10e887db209eb7e703dc7c2eacbc37b.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8302b366de6704279033f60b1dbcf4f4b10e887db209eb7e703dc7c2eacbc37b.dll
Resource
win10v2004-20230703-en
Target
8302b366de6704279033f60b1dbcf4f4b10e887db209eb7e703dc7c2eacbc37b
Size
685KB
MD5
aeaf78434ca48bed1872801b95269824
SHA1
504a8635ab0282dcbad0af702fc9d610fd693b7c
SHA256
8302b366de6704279033f60b1dbcf4f4b10e887db209eb7e703dc7c2eacbc37b
SHA512
53b2495bce02d7d6e41ada9ede9ddfa16eca212ee7d6892ed77d4f6ec41bf091de16d1154ffc0847ff4951786a5431e9aad3264ff0ed292668b10bbf4f9bb3d0
SSDEEP
12288:gKI4Phs4zxIcz9nvqiMXu/zshq/DLCsBBdbRhR8yJhaG:gKpPhs4zxHVvqje/zshqrLCsBBdVhR8i
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
??4CTXStringW@@QAEAAV0@PB_W@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
??YCTXStringW@@QAEAAV0@_W@Z
??8@YA_NABVCTXStringW@@0@Z
??9@YA_NABVCTXStringW@@_W@Z
??9@YA_NABVCTXStringW@@PB_W@Z
?GetAt@CTXStringW@@QBE_WH@Z
?GetLength@CTXStringW@@QBEHXZ
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?ReleaseBuffer@CTXStringW@@QAEXH@Z
??ACTXStringW@@QBE_WH@Z
?Replace@CTXStringW@@QAEH_W0@Z
?Find@CTXStringW@@QBEH_WH@Z
?Find@CTXStringW@@QBEHPB_WH@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
?MakeLower@CTXStringW@@QAEAAV1@XZ
?TrimLeft@CTXStringW@@QAEAAV1@PB_W@Z
?Mid@CTXStringW@@QBE?AV1@HH@Z
?Right@CTXStringW@@QBE?AV1@H@Z
?Left@CTXStringW@@QBE?AV1@H@Z
??4CTXBSTR@@QAEAAV0@ABV0@@Z
??4CTXBSTR@@QAEAAV0@ABVCTXStringW@@@Z
?Length@CTXBSTR@@QBEIXZ
?Empty@CTXBSTR@@QAEXXZ
ord27
ord36
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?GetSpecialFolderPath@Sys@Util@@YAHHAAVCTXBSTR@@@Z
?PropertyDWord@CFmtString@@QAEHPB_WK0@Z
?CreateDirectoryW@FS@@YAHPB_W@Z
?GetFileSystemDirectory@FS@@YAHPB_WAAVCTXStringW@@@Z
?IsDirectoryExist@FS@@YAHPB_W@Z
?GetTickCount64@Time@Util@@YA_KXZ
?ConvertToPureFile@FS@@YA?AVCTXStringW@@PB_W@Z
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?IsPathNameValid@FS@Util@@YAHPB_W@Z
??0CTXBSTR@@QAE@ABU_GUID@@@Z
??4CTXStringW@@QAEAAV0@ABVCTXBSTR@@@Z
?Empty@CTXStringW@@QAEXXZ
?CreateTXArray@Data@Util@@YAHPAPAUITXArray@@@Z
??9CTXBSTR@@QBE_NABV0@@Z
?StringToIPPort@Convert@Util@@YA_NABVCTXStringW@@AAV3@AAG@Z
?CreateConnectTCPForProxyValidate@Network@Util@@YAHW4TX_PROXY_TYPE@@PAPAUITXConnectTCP@@@Z
?CreateUDPForProxyValidate@Network@Util@@YAHW4TX_PROXY_TYPE@@PAPAUITXUDP@@@Z
?GetIEProxySetting@Network@Util@@YAHPAUITXData@@AAE@Z
?GetLength@CTXStringA@@QBEHXZ
??BCTXStringA@@QBEPBDXZ
??8CTXBSTR@@QBE_NABV0@@Z
?UnicodeToGBK@Convert@Util@@YA_NAAVCTXStringA@@PB_WH@Z
?Md5HashBuffer@@YAXPAEPBXK@Z
??0CTXStringA@@QAE@UtagUTF8@@PB_WH@Z
?GetString@CTXStringA@@QBEPBDXZ
??9@YA_NABVCTXStringW@@0@Z
?Trim@CTXStringW@@QAEAAV1@XZ
??0CTXBSTR@@QAE@ABV0@@Z
??9CTXBSTR@@QBE_NPB_W@Z
ord34
?CRC32@@YAKKPBEH@Z
?HasField@Data@Util@@YAHPAUITXDataRead@@PBD@Z
??YCTXStringW@@QAEAAV0@ABV0@@Z
?GetBufferSetLength@CTXStringW@@QAEPA_WH@Z
?Detach@CTXBSTR@@QAEPA_WXZ
?CreateTypedExtensionAgentMatch@Extension@Util@@YAXHPAPAUITXExtensionAgentMatch@@@Z
?Encode16@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@@Z
?GetLCID@NLS@@YAKXZ
?DoFormat@CFmtString@@QAEPB_WPB_W@Z
??1CFmtString@@QAE@XZ
??0CFmtString@@QAE@XZ
?PropertyStr@CFmtString@@QAEHPB_W0@Z
??4CTXBSTR@@QAEAAV0@PB_W@Z
?EraseAsyncCallback@TXTimer@@YAHPAUITXAsyncCallback@@I@Z
?SetAsyncCallback@TXTimer@@YAHPAUITXAsyncCallback@@I@Z
?GetTXDataStr@Data@Util@@YAHPAUITXDataRead@@PBDAAVCTXStringW@@@Z
?GetTXDataBuf@Data@Util@@YAHPAUITXDataRead@@PBDAAVCTXBuffer@@@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?Compare@CTXStringW@@QBEHPB_W@Z
?Format@CTXStringW@@QAAXPB_WZZ
?GuidFromString@Com@Util@@YAJPA_WAAU_GUID@@@Z
?TXLoadString@@YAPB_WPB_W0@Z
ord33
?ConvertXMLStrToTXData@Convert@Util@@YAHPA_WPAPA_WPAUITXData@@0@Z
??8CTXBSTR@@QBE_NPB_W@Z
?Copy@CTXBSTR@@QBEPA_WXZ
?GetBSTR@CTXStringW@@QBEPA_WXZ
??8@YA_NABVCTXStringW@@PB_W@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??0CTXStringW@@QAE@UtagUTF8@@PBDH@Z
??0CTXStringW@@QAE@PA_W@Z
??0CTXStringW@@QAE@ABV0@@Z
??0CTXStringW@@QAE@PB_W@Z
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
?Format@CTXStringA@@QAAXPBDZZ
??M@YA_NABVCTXStringA@@0@Z
??0CTXStringW@@QAE@PB_WH@Z
??0CTXStringA@@QAE@XZ
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
?Utf8ToWS@Convert@Util@@YA?AVCTXStringW@@PBDH@Z
?Utf8FromWS@Convert@Util@@YA?AVCTXStringA@@PB_WH@Z
?IsEmpty@CTXBSTR@@QAEHXZ
??ICTXBSTR@@QAEPAPA_WXZ
??BCTXBSTR@@QBEPA_WXZ
??1CTXBSTR@@QAE@XZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??0CTXBSTR@@QAE@PB_W@Z
??0CTXBSTR@@QAE@XZ
?GetBSTRPtr@CTXStringW@@QAEPAPA_WXZ
??BCTXStringW@@QBEPB_WXZ
?Remove@CTXStringW@@QAEH_W@Z
?IsEmpty@CTXStringW@@QBE_NXZ
??4CTXStringW@@QAEAAV0@ABV0@@Z
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
??0CTXStringW@@QAE@XZ
??1CTXStringW@@QAE@XZ
?GetBuffer@CTXStringA@@QAEPADXZ
??1CTXStringA@@QAE@XZ
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z
?ScaleRECT@DPI@GF@Util@@YAXPAUtagRECT@@@Z
?ScreenPoint2ClientPoint@GF@Util@@YAXPAUIGFFrame@@AAUtagPOINT@@@Z
?GetAnchorResult@CGFAnchor@@QAE?AVCRect@@PAVVCalcSizeSupporter@@PAUtagSIZE@@@Z
?AddAnchor@CGFAnchor@@QAEXEEVCRect@@VCPoint@@@Z
??0CGFAnchor@@QAE@XZ
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@PAUITXCore@@H@Z
?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z
??1CDPIScaleIgnoreResetHelper@@QAE@XZ
??0CDPIScaleIgnoreResetHelper@@QAE@XZ
?TransMd2GFElement@Metadata@Util@@YAJPAUITXData@@PAPAUIGFElement@@PA_W@Z
?ScaleSIZE@DPI@GF@Util@@YAXPAUtagSIZE@@@Z
?UnscaleSIZE@DPI@GF@Util@@YAXPAUtagSIZE@@@Z
?UnscaleLONG@DPI@GF@Util@@YAXPAJ@Z
?IsScaleIgnore@DPI@GF@Util@@YA_NXZ
?HandleMessageScale@DPI@GF@Util@@YAXPAUtagBaseArg@@@Z
?CreateMsgPack@Msg@Util@@YAHPAPAUITXMsgPack@@@Z
?TranslateSessionMsgEmojiFace@Msg@Util@@YAXPAUITXMsgPack@@K@Z
?IsServerControlBitOn@Misc@Util@@YAHK@Z
?GetSelfUin@Contact@Util@@YAKXZ
?SetRegistryData@NewRegistry@@YAHPAUITXCore@@PB_WW4NEW_REGISTRY_TYPE@1@PAUITXData@@@Z
?GetRegistryData@NewRegistry@@YAHPAUITXCore@@PB_WW4NEW_REGISTRY_TYPE@1@PAPAUITXData@@@Z
?GetCombineName@Contact@Util@@YA?AVCTXStringW@@K@Z
?GetPublicHeadFile@Contact@Util@@YA?AVCTXStringW@@K@Z
?GetAccountName@Account@Util@@YA?AVCTXStringW@@K@Z
?IncHelper@DataReport@Util@@YAJKPBDK@Z
?DataReport@DataReport2@Util@@YAXKPA_W@Z
?IsMaskFlagValid@Contact@Util@@YAJKEKAAH@Z
?SetBit@LoginDataReport@Misc@Util@@YAXEH@Z
?IsNewFlagValid@Contact@Util@@YAHKK@Z
?SetDataReportBit@DataReport@Util@@YAJKPBDE@Z
?DataReport@DataReport2@Util@@YAXKK@Z
?GetStatus@Contact@Util@@YAGKPAUITXIMContactStatusMgr@@@Z
?CheckUinValid@Misc@Util@@YAHPA_W@Z
?GetProgramRootDir@Sys@Util@@YA?AVCTXStringW@@XZ
?GetUserDataSaveSetting@Sys@Util@@YA?AVCTXStringW@@AAKAAV3@@Z
?SetDataDWord@DataReport@Util@@YAJKPBDK@Z
?IsRichServerControlBitOn@Misc@Util@@YAHKH@Z
?DataReport@DataReport2@Util@@YAXKKKPA_W0H@Z
?IsVASFlagValid@Contact@Util@@YAHKE@Z
?AdjustUrl@URL@Util@@YA?AVCTXStringW@@ABV3@W4URLMODIFYLEVEL@12@0PB_W@Z
?GetSignFmt@URL@Util@@YAXAAVCFmtString@@@Z
?OpenUrlInIM@URL@Util@@YAXABVCTXStringW@@W4URLMODIFYLEVEL@12@0@Z
?IsFlagValid@Contact@Util@@YAHKKPAUITXIMContactInfoMgr@@@Z
?IsSuperVip@Contact@Util@@YAHKPAKPAUITXIMContactInfoMgr@@@Z
?DataReport@DataReport2@Util@@YAXK@Z
?GetRegMainKeyDataBoolField@API@Registry@@YAHPB_WPBD1PAHW4__MIDL___MIDL_itf_IRegistry_0000_0000_0003@@W4__MIDL___MIDL_itf_IRegistry_0000_0000_0004@@@Z
?DecodeServerData_DWordValue@API@AdvConfig@@YAHGPAUITXData@@PAK@Z
?CodeServerData_DWordValue@API@AdvConfig@@YAHGKPAPAUITXData@@@Z
?DecodeServerData_ByteValue@API@AdvConfig@@YAHGPAUITXData@@PAE@Z
?SetRegMainKeyDataBoolField@API@Registry@@YAHPB_WPBD1HW4__MIDL___MIDL_itf_IRegistry_0000_0000_0003@@W4__MIDL___MIDL_itf_IRegistry_0000_0000_0004@@@Z
?CodeServerData_WordValue@API@AdvConfig@@YAHGGPAPAUITXData@@@Z
?CodeServerData_ByteValue@API@AdvConfig@@YAHGEPAPAUITXData@@@Z
?SetRegMainKeyDWordField@API@Registry@@YAHPB_WPBDKW4__MIDL___MIDL_itf_IRegistry_0000_0000_0003@@W4__MIDL___MIDL_itf_IRegistry_0000_0000_0004@@@Z
?GetRegMainKeyDWordField@API@Registry@@YAHPB_WPBDPAKW4__MIDL___MIDL_itf_IRegistry_0000_0000_0003@@W4__MIDL___MIDL_itf_IRegistry_0000_0000_0004@@@Z
?DecodeServerData_BufferValue@API@AdvConfig@@YAHGPAUITXData@@PAPAUITXBuffer@@@Z
?CodeServerData_BufferValue@API@AdvConfig@@YAHGPAUITXBuffer@@PAPAUITXData@@@Z
?SetRegMainKeyBufferField@API@Registry@@YAHPB_WPBDPAUITXBuffer@@W4__MIDL___MIDL_itf_IRegistry_0000_0000_0003@@W4__MIDL___MIDL_itf_IRegistry_0000_0000_0004@@@Z
?GetRegMainKeyBufferField@API@Registry@@YAHPB_WPBDPAPAUITXBuffer@@W4__MIDL___MIDL_itf_IRegistry_0000_0000_0003@@W4__MIDL___MIDL_itf_IRegistry_0000_0000_0004@@@Z
?SetRegMainKeyBoolField@API@Registry@@YAHPB_WPBDHW4__MIDL___MIDL_itf_IRegistry_0000_0000_0003@@W4__MIDL___MIDL_itf_IRegistry_0000_0000_0004@@@Z
?GetRegMainKeyBoolField@API@Registry@@YAHPB_WPBDPAHW4__MIDL___MIDL_itf_IRegistry_0000_0000_0003@@W4__MIDL___MIDL_itf_IRegistry_0000_0000_0004@@@Z
?DecodeServerData_MinintValue@API@AdvConfig@@YAHGPAUITXData@@PAE@Z
?CodeServerData_MinintValue@API@AdvConfig@@YAHGEPAPAUITXData@@@Z
?GetMsgRecordConfig@MsgRecordSafety@@YAHPB_WPAPAUITXData@@W4__MIDL___MIDL_itf_IRegistry_0000_0000_0003@@@Z
?CodeServerData_BoolValue@API@AdvConfig@@YAHGHPAPAUITXData@@@Z
?DecodeServerData_BoolValue@API@AdvConfig@@YAHGPAUITXData@@PAH@Z
?IMStatusTypeToEntryValue@API@AdvConfig@@YAEG@Z
?EntryValueToIMStatusType@API@AdvConfig@@YAGE@Z
?ShowResultTipsWin@Misc@Util@@YAXVCPoint@@VCTXStringW@@1HPAPAUIGFFrame@@@Z
?IsServerControlBitOn@TXUpdateUtil@@YAHXZ
?DecodeServerData_WordValue@API@AdvConfig@@YAHGPAUITXData@@PAG@Z
?AddSubStatus@Status@Util@@YAHGVCTXStringW@@@Z
?GetCircleHead@Misc@Util@@YAJPA_WABVCSize@@PAPAUIGFTexture@@HH@Z
?GetName@CBasicInfo@Group@Util@@SA?AVCTXStringW@@KW4NAME_TYPE@123@@Z
?MessageBoxExByHwnd@Misc@Util@@YAHPAUHWND__@@PA_W1IPAUITXData@@PAPAU4@@Z
?IsQQWifiAutoDetectForbidden@QQWifiAutoDetect@Util@@YAHXZ
?TXPlaySound@Misc@Util@@YAHPB_WI@Z
?CombinePath@Misc@Util@@YA?AVCTXStringW@@ABV3@0@Z
?IsBubbleMode@Misc@Util@@YAHXZ
?MessageBoxExW@Misc@Util@@YAHPAUIGFFrame@@PA_W1IPAUITXData@@PAPAU4@@Z
?MessageBoxW@Misc@Util@@YAHPAUIGFFrame@@VCTXStringW@@1H@Z
?CloseBubbleTip@BubbleTipMgr2@@YAJPAUIGFFrame@@@Z
?PopupBubbleTip@BubbleTipMgr2@@YAJPAUIGFFrame@@PA_W1UtagPOINT@@1IHPAVCSize@@PAUIGFControl@@@Z
OutputDebugStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
FindResourceExW
LockResource
CreateFileMappingW
OpenEventW
CreateMutexW
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleFileNameW
EncodePointer
DecodePointer
FreeLibrary
GetProcAddress
LoadResource
SizeofResource
lstrcmpiW
LoadLibraryExW
GetModuleHandleW
FindResourceW
MultiByteToWideChar
GetThreadLocale
SetThreadLocale
CompareStringW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FindClose
CloseHandle
OpenMutexW
GetDiskFreeSpaceExW
CreateFileW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
GetVersionExW
GetFileSize
WriteFile
ReadFile
SetEvent
ReleaseMutex
WaitForSingleObject
MapViewOfFile
UnmapViewOfFile
SetWindowPos
SendMessageW
UpdateWindow
GetKeyState
PostMessageW
CharNextW
MonitorFromPoint
GetMonitorInfoW
GetKeyboardState
GetKeyNameTextW
OffsetRect
MapVirtualKeyW
CopyRect
PtInRect
GetSystemMetrics
GetCursorPos
RegQueryInfoKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
RegOpenKeyW
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
SHGetFileInfoW
SHGetMalloc
ShellExecuteW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
StringFromCLSID
SysFreeString
SysStringLen
SysAllocString
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
PathCanonicalizeW
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
memcmp
memset
memcpy
wcsstr
memmove
__std_exception_copy
__std_exception_destroy
_except_handler4_common
__std_type_info_destroy_list
__CxxFrameHandler3
_purecall
_CxxThrowException
_initterm_e
_initterm
_invalid_parameter_noinfo
_cexit
_crt_atexit
_invalid_parameter_noinfo_noreturn
_errno
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
wmemcpy_s
strcmp
wcslen
wcsncpy_s
wcscpy_s
wcscat_s
strlen
_callnewh
free
_recalloc
malloc
_wtol
_wtoi
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vswprintf_s
_except1
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ