1ea974779e1e864669de0e4ec498c9b920f84b458bd7611dce115074f91aae9b

Sharing

Copy URL Twitter E-mail

General

Target

1ea974779e1e864669de0e4ec498c9b920f84b458bd7611dce115074f91aae9b
Size

13.8MB
MD5

eda6eeb62e7640315a0c8fcadb59b958
SHA1

e8d016bcb6717b38d07e7a8075e9812e984205ea
SHA256

1ea974779e1e864669de0e4ec498c9b920f84b458bd7611dce115074f91aae9b
SHA512

8c4c282ffef6eff0a2732645de3a575b9b316b6dbd06c1b3d0c4db5dfe9fb851d571f733e034b28a9e48ac33c3dd7e1c0d596290d8a9dde734f13c32a293f1a7
SSDEEP

393216:ejDTKlQjvSS55xUb8nKE9oBmvSSn5W3OqBO2D:enT9SSzKb8nV96mSSnjWOc

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/archive/manual_sign/wjcq_ntaskbar.exe	upx
static1/unpack001/archive/manual_sign/wjcq_ntaskbar_repush.exe	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/archive/manual_sign/MicroGame_wjcq_tp_repush_wjcq1220.exe
unpack001/archive/manual_sign/MicroGame_wjcq_tp_wjcq1220.exe
unpack002/out.upx
unpack003/out.upx

Files

1ea974779e1e864669de0e4ec498c9b920f84b458bd7611dce115074f91aae9b
.zip
archive/manual_sign/MicroGame_wjcq_ntaskbar_repush_wjcq1219.exe
.exe windows:5 windows x86 arch:x86

09dfcf10be7b8a62a35de68b7fc5c42c

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e2:75:80:48:91:5a:96:a9:da:ff:82:ad:f4:89:5f:39:66:f8:68:35:51:db:80:1b:c3:b4:3c:f4:09:31:f1:c2
Signer

Actual PE Digest

e2:75:80:48:91:5a:96:a9:da:ff:82:ad:f4:89:5f:39:66:f8:68:35:51:db:80:1b:c3:b4:3c:f4:09:31:f1:c2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MakeSureDirectoryPathExists

kernel32

CreateToolhelp32Snapshot
MoveFileExW
FindNextFileW
FindFirstFileW
GetFileAttributesW
SetFileAttributesW
CreateFileW
GetFullPathNameW
RemoveDirectoryW
GetTempFileNameW
GetStartupInfoW
lstrlenW
FindClose
SetFilePointer
WriteFile
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
OpenProcess
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocalTime
GetCurrentProcess
CreateProcessW
lstrcpynW
CreateMutexW
SetLastError
GetVersionExW
GetTickCount
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
SetErrorMode
QueryDepthSList
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
GetCommandLineW
lstrcmpW
GetTickCount64
MultiByteToWideChar
MoveFileW
CopyFileW
DeleteFileW
FindResourceExW
FindResourceW
GetModuleHandleW
LoadLibraryW
CreateEventW
CloseHandle
SizeofResource
LoadResource
WaitForMultipleObjects
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Process32FirstW
RaiseException
GetShortPathNameW
GetProcessHeap
ReleaseSemaphore
VirtualProtect
GetThreadTimes
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetFileType
HeapSize
HeapFree
HeapReAlloc
FreeLibraryAndExitThread
ExitThread
RtlUnwind
InterlockedFlushSList
GetSystemWindowsDirectoryW
CreateFileA
lstrcmpiA
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
LockResource
DecodePointer
lstrcmpA
DeviceIoControl
GetLastError
Process32NextW
UnregisterWaitEx
RegisterWaitForSingleObject
OutputDebugStringA
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
FormatMessageW
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThread
GetNativeSystemInfo
TryEnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetFileTime
GetSystemDirectoryW
GetTempPathW
CreateDirectoryW
GetFileSize
ReadFile
SetEndOfFile
GetStdHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetFileSizeEx
LocalFree
ReleaseMutex
LocalFileTimeToFileTime
DosDateTimeToFileTime
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FlushFileBuffers
GetACP
FreeResource
ExitProcess
MulDiv
IsBadReadPtr
ResetEvent
GetVersion
InterlockedExchange
InterlockedCompareExchange
ResumeThread
CreateThread
SetThreadPriority
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetFilePointerEx

user32

PostMessageW
DestroyIcon
UnregisterClassW
LoadImageW
MoveWindow
wsprintfW
CopyRect
OffsetRect
UnionRect
EqualRect
SetCursor
DrawFocusRect
RegisterClassW
EnableWindow
GetMenu
SetPropW
GetPropW
AdjustWindowRectEx
wvsprintfW
InflateRect
IsChild
GetFocus
GetKeyState
GetUpdateRect
IsRectEmpty
GetClassNameW
IntersectRect
IsIconic
SetWindowRgn
FindWindowExW
CharPrevW
DrawTextW
SetRect
DrawIconEx
CreateCaret
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
RemovePropW
GetWindowDC
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
FillRect
PeekMessageW
WaitMessage
CallMsgFilterW
GetQueueStatus
MsgWaitForMultipleObjectsEx
GetIconInfo
LoadStringW
DispatchMessageW
TranslateMessage
GetMessageW
LoadCursorW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
FindWindowW
GetSystemMetrics
CreateDialogParamW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
LoadIconW
GetWindow
GetParent
GetDesktopWindow
SetWindowLongW
GetWindowLongW
PtInRect
MapWindowPoints
ScreenToClient
GetCursorPos
GetWindowRect
MessageBoxW
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
SwitchToThisWindow
UpdateWindow
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetAsyncKeyState
SetFocus
IsZoomed
IsWindowVisible
SetWindowPos
UpdateLayeredWindow
ShowWindow
IsWindow
CreateWindowExW
PostQuitMessage
SendMessageW
RegisterWindowMessageW
CharNextW
DestroyWindow
DefWindowProcW
GetClientRect

gdi32

GetCharABCWidthsW
GetClipBox
LineTo
RoundRect
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
BitBlt
SetTextColor
MoveToEx
TextOutW
ExtTextOutW
CombineRgn
CreateDCW
SetDIBitsToDevice
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgnIndirect
DeleteDC
DeleteObject
RestoreDC
SaveDC
SelectClipRgn
SelectObject
CreateRoundRectRgn
CreateDIBSection
GetObjectW
GetDIBits
SetWindowOrgEx
GetTextMetricsW
Rectangle
SetViewportOrgEx
GetStockObject
CreatePen
CreateFontIndirectW
OffsetViewportOrgEx
GetDeviceCaps
RectVisible
GetTextExtentPoint32W
SetStretchBltMode

advapi32

CheckTokenMembership
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
GetTokenInformation
RegQueryValueExW
RegCreateKeyW

shell32

ord165
ShellExecuteExW
SHCreateDirectoryExW
ShellExecuteW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHFileOperationW
SHChangeNotify

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoCreateGuid
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning

oleaut32

SafeArrayPutElement
SafeArrayCreate
VariantClear
SysAllocString
SysFreeString
VarUI4FromStr
VariantInit
SysAllocStringLen

shlwapi

PathIsDirectoryA
PathFindFileNameW
PathFileExistsA
SHSetValueW
SHGetValueW
PathCombineW
StrCpyW
SHDeleteKeyW
PathRemoveFileSpecW
PathIsDirectoryW
PathFileExistsW
StrStrIW
StrStrIA
StrCmpIW
StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
AssocQueryStringW
PathAppendW

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

gdiplus

GdiplusShutdown
GdipDrawEllipseI
GdipDrawPath
ord1
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImagePointsI
GdipFillPath
GdipSetInterpolationMode
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneBitmapAreaI
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdiplusStartup
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipFillRectangleI
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipSetSmoothingMode
GdipFillEllipseI
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGraphicsClear
GdipDrawImageRectI
GdipCreatePath
GdipDeletePath
GdipClosePathFigure
GdipAddPathArcI
GdipCreateTexture

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

wininet

InternetSetCookieW
InternetGetConnectedState
InternetCrackUrlW
InternetGetCookieExW

iphlpapi

GetAdaptersInfo

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

msimg32

GradientFill
AlphaBlend

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
archive/manual_sign/MicroGame_wjcq_ntaskbar_wjcq1219.exe
.exe windows:5 windows x86 arch:x86

09dfcf10be7b8a62a35de68b7fc5c42c

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:75:12:6f:f5:ac:ca:51:6d:9c:00:aa:12:0b:83:19:82:29:f0:69:db:e5:f7:df:19:16:7e:91:28:d8:8d:74
Signer

Actual PE Digest

02:75:12:6f:f5:ac:ca:51:6d:9c:00:aa:12:0b:83:19:82:29:f0:69:db:e5:f7:df:19:16:7e:91:28:d8:8d:74

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MakeSureDirectoryPathExists

kernel32

CreateToolhelp32Snapshot
MoveFileExW
FindNextFileW
FindFirstFileW
GetFileAttributesW
SetFileAttributesW
CreateFileW
GetFullPathNameW
RemoveDirectoryW
GetTempFileNameW
GetStartupInfoW
lstrlenW
FindClose
SetFilePointer
WriteFile
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
OpenProcess
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocalTime
GetCurrentProcess
CreateProcessW
lstrcpynW
CreateMutexW
SetLastError
GetVersionExW
GetTickCount
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
SetErrorMode
QueryDepthSList
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
GetCommandLineW
lstrcmpW
GetTickCount64
MultiByteToWideChar
MoveFileW
CopyFileW
DeleteFileW
FindResourceExW
FindResourceW
GetModuleHandleW
LoadLibraryW
CreateEventW
CloseHandle
SizeofResource
LoadResource
WaitForMultipleObjects
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Process32FirstW
RaiseException
GetShortPathNameW
GetProcessHeap
ReleaseSemaphore
VirtualProtect
GetThreadTimes
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetFileType
HeapSize
HeapFree
HeapReAlloc
FreeLibraryAndExitThread
ExitThread
RtlUnwind
InterlockedFlushSList
GetSystemWindowsDirectoryW
CreateFileA
lstrcmpiA
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
LockResource
DecodePointer
lstrcmpA
DeviceIoControl
GetLastError
Process32NextW
UnregisterWaitEx
RegisterWaitForSingleObject
OutputDebugStringA
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
FormatMessageW
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThread
GetNativeSystemInfo
TryEnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetFileTime
GetSystemDirectoryW
GetTempPathW
CreateDirectoryW
GetFileSize
ReadFile
SetEndOfFile
GetStdHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetFileSizeEx
LocalFree
ReleaseMutex
LocalFileTimeToFileTime
DosDateTimeToFileTime
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FlushFileBuffers
GetACP
FreeResource
ExitProcess
MulDiv
IsBadReadPtr
ResetEvent
GetVersion
InterlockedExchange
InterlockedCompareExchange
ResumeThread
CreateThread
SetThreadPriority
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetFilePointerEx

user32

PostMessageW
DestroyIcon
UnregisterClassW
LoadImageW
MoveWindow
wsprintfW
CopyRect
OffsetRect
UnionRect
EqualRect
SetCursor
DrawFocusRect
RegisterClassW
EnableWindow
GetMenu
SetPropW
GetPropW
AdjustWindowRectEx
wvsprintfW
InflateRect
IsChild
GetFocus
GetKeyState
GetUpdateRect
IsRectEmpty
GetClassNameW
IntersectRect
IsIconic
SetWindowRgn
FindWindowExW
CharPrevW
DrawTextW
SetRect
DrawIconEx
CreateCaret
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
RemovePropW
GetWindowDC
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
FillRect
PeekMessageW
WaitMessage
CallMsgFilterW
GetQueueStatus
MsgWaitForMultipleObjectsEx
GetIconInfo
LoadStringW
DispatchMessageW
TranslateMessage
GetMessageW
LoadCursorW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
FindWindowW
GetSystemMetrics
CreateDialogParamW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
LoadIconW
GetWindow
GetParent
GetDesktopWindow
SetWindowLongW
GetWindowLongW
PtInRect
MapWindowPoints
ScreenToClient
GetCursorPos
GetWindowRect
MessageBoxW
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
SwitchToThisWindow
UpdateWindow
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetAsyncKeyState
SetFocus
IsZoomed
IsWindowVisible
SetWindowPos
UpdateLayeredWindow
ShowWindow
IsWindow
CreateWindowExW
PostQuitMessage
SendMessageW
RegisterWindowMessageW
CharNextW
DestroyWindow
DefWindowProcW
GetClientRect

gdi32

GetCharABCWidthsW
GetClipBox
LineTo
RoundRect
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
BitBlt
SetTextColor
MoveToEx
TextOutW
ExtTextOutW
CombineRgn
CreateDCW
SetDIBitsToDevice
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgnIndirect
DeleteDC
DeleteObject
RestoreDC
SaveDC
SelectClipRgn
SelectObject
CreateRoundRectRgn
CreateDIBSection
GetObjectW
GetDIBits
SetWindowOrgEx
GetTextMetricsW
Rectangle
SetViewportOrgEx
GetStockObject
CreatePen
CreateFontIndirectW
OffsetViewportOrgEx
GetDeviceCaps
RectVisible
GetTextExtentPoint32W
SetStretchBltMode

advapi32

CheckTokenMembership
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
GetTokenInformation
RegQueryValueExW
RegCreateKeyW

shell32

ord165
ShellExecuteExW
SHCreateDirectoryExW
ShellExecuteW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHFileOperationW
SHChangeNotify

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoCreateGuid
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning

oleaut32

SafeArrayPutElement
SafeArrayCreate
VariantClear
SysAllocString
SysFreeString
VarUI4FromStr
VariantInit
SysAllocStringLen

shlwapi

PathIsDirectoryA
PathFindFileNameW
PathFileExistsA
SHSetValueW
SHGetValueW
PathCombineW
StrCpyW
SHDeleteKeyW
PathRemoveFileSpecW
PathIsDirectoryW
PathFileExistsW
StrStrIW
StrStrIA
StrCmpIW
StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
AssocQueryStringW
PathAppendW

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

gdiplus

GdiplusShutdown
GdipDrawEllipseI
GdipDrawPath
ord1
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImagePointsI
GdipFillPath
GdipSetInterpolationMode
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneBitmapAreaI
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdiplusStartup
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipFillRectangleI
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipSetSmoothingMode
GdipFillEllipseI
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGraphicsClear
GdipDrawImageRectI
GdipCreatePath
GdipDeletePath
GdipClosePathFigure
GdipAddPathArcI
GdipCreateTexture

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

wininet

InternetSetCookieW
InternetGetConnectedState
InternetCrackUrlW
InternetGetCookieExW

iphlpapi

GetAdaptersInfo

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

msimg32

GradientFill
AlphaBlend

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
archive/manual_sign/MicroGame_wjcq_tp_repush_wjcq1220.exe
.exe windows:5 windows x86 arch:x86

09dfcf10be7b8a62a35de68b7fc5c42c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MakeSureDirectoryPathExists

kernel32

CreateToolhelp32Snapshot
MoveFileExW
FindNextFileW
FindFirstFileW
GetFileAttributesW
SetFileAttributesW
CreateFileW
GetFullPathNameW
RemoveDirectoryW
GetTempFileNameW
GetStartupInfoW
lstrlenW
FindClose
SetFilePointer
WriteFile
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
OpenProcess
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocalTime
GetCurrentProcess
CreateProcessW
lstrcpynW
CreateMutexW
SetLastError
GetVersionExW
GetTickCount
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
SetErrorMode
QueryDepthSList
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
GetCommandLineW
lstrcmpW
GetTickCount64
MultiByteToWideChar
MoveFileW
CopyFileW
DeleteFileW
FindResourceExW
FindResourceW
GetModuleHandleW
LoadLibraryW
CreateEventW
CloseHandle
SizeofResource
LoadResource
WaitForMultipleObjects
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Process32FirstW
RaiseException
GetShortPathNameW
GetProcessHeap
ReleaseSemaphore
VirtualProtect
GetThreadTimes
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetFileType
HeapSize
HeapFree
HeapReAlloc
FreeLibraryAndExitThread
ExitThread
RtlUnwind
InterlockedFlushSList
GetSystemWindowsDirectoryW
CreateFileA
lstrcmpiA
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
LockResource
DecodePointer
lstrcmpA
DeviceIoControl
GetLastError
Process32NextW
UnregisterWaitEx
RegisterWaitForSingleObject
OutputDebugStringA
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
FormatMessageW
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThread
GetNativeSystemInfo
TryEnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetFileTime
GetSystemDirectoryW
GetTempPathW
CreateDirectoryW
GetFileSize
ReadFile
SetEndOfFile
GetStdHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetFileSizeEx
LocalFree
ReleaseMutex
LocalFileTimeToFileTime
DosDateTimeToFileTime
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FlushFileBuffers
GetACP
FreeResource
ExitProcess
MulDiv
IsBadReadPtr
ResetEvent
GetVersion
InterlockedExchange
InterlockedCompareExchange
ResumeThread
CreateThread
SetThreadPriority
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetFilePointerEx

user32

PostMessageW
DestroyIcon
UnregisterClassW
LoadImageW
MoveWindow
wsprintfW
CopyRect
OffsetRect
UnionRect
EqualRect
SetCursor
DrawFocusRect
RegisterClassW
EnableWindow
GetMenu
SetPropW
GetPropW
AdjustWindowRectEx
wvsprintfW
InflateRect
IsChild
GetFocus
GetKeyState
GetUpdateRect
IsRectEmpty
GetClassNameW
IntersectRect
IsIconic
SetWindowRgn
FindWindowExW
CharPrevW
DrawTextW
SetRect
DrawIconEx
CreateCaret
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
RemovePropW
GetWindowDC
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
FillRect
PeekMessageW
WaitMessage
CallMsgFilterW
GetQueueStatus
MsgWaitForMultipleObjectsEx
GetIconInfo
LoadStringW
DispatchMessageW
TranslateMessage
GetMessageW
LoadCursorW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
FindWindowW
GetSystemMetrics
CreateDialogParamW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
LoadIconW
GetWindow
GetParent
GetDesktopWindow
SetWindowLongW
GetWindowLongW
PtInRect
MapWindowPoints
ScreenToClient
GetCursorPos
GetWindowRect
MessageBoxW
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
SwitchToThisWindow
UpdateWindow
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetAsyncKeyState
SetFocus
IsZoomed
IsWindowVisible
SetWindowPos
UpdateLayeredWindow
ShowWindow
IsWindow
CreateWindowExW
PostQuitMessage
SendMessageW
RegisterWindowMessageW
CharNextW
DestroyWindow
DefWindowProcW
GetClientRect

gdi32

GetCharABCWidthsW
GetClipBox
LineTo
RoundRect
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
BitBlt
SetTextColor
MoveToEx
TextOutW
ExtTextOutW
CombineRgn
CreateDCW
SetDIBitsToDevice
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgnIndirect
DeleteDC
DeleteObject
RestoreDC
SaveDC
SelectClipRgn
SelectObject
CreateRoundRectRgn
CreateDIBSection
GetObjectW
GetDIBits
SetWindowOrgEx
GetTextMetricsW
Rectangle
SetViewportOrgEx
GetStockObject
CreatePen
CreateFontIndirectW
OffsetViewportOrgEx
GetDeviceCaps
RectVisible
GetTextExtentPoint32W
SetStretchBltMode

advapi32

CheckTokenMembership
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
GetTokenInformation
RegQueryValueExW
RegCreateKeyW

shell32

ord165
ShellExecuteExW
SHCreateDirectoryExW
ShellExecuteW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHFileOperationW
SHChangeNotify

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoCreateGuid
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning

oleaut32

SafeArrayPutElement
SafeArrayCreate
VariantClear
SysAllocString
SysFreeString
VarUI4FromStr
VariantInit
SysAllocStringLen

shlwapi

PathIsDirectoryA
PathFindFileNameW
PathFileExistsA
SHSetValueW
SHGetValueW
PathCombineW
StrCpyW
SHDeleteKeyW
PathRemoveFileSpecW
PathIsDirectoryW
PathFileExistsW
StrStrIW
StrStrIA
StrCmpIW
StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
AssocQueryStringW
PathAppendW

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

gdiplus

GdiplusShutdown
GdipDrawEllipseI
GdipDrawPath
ord1
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImagePointsI
GdipFillPath
GdipSetInterpolationMode
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneBitmapAreaI
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdiplusStartup
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipFillRectangleI
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipSetSmoothingMode
GdipFillEllipseI
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGraphicsClear
GdipDrawImageRectI
GdipCreatePath
GdipDeletePath
GdipClosePathFigure
GdipAddPathArcI
GdipCreateTexture

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

wininet

InternetSetCookieW
InternetGetConnectedState
InternetCrackUrlW
InternetGetCookieExW

iphlpapi

GetAdaptersInfo

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

msimg32

GradientFill
AlphaBlend

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
archive/manual_sign/MicroGame_wjcq_tp_wjcq1220.exe
.exe windows:5 windows x86 arch:x86

09dfcf10be7b8a62a35de68b7fc5c42c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MakeSureDirectoryPathExists

kernel32

CreateToolhelp32Snapshot
MoveFileExW
FindNextFileW
FindFirstFileW
GetFileAttributesW
SetFileAttributesW
CreateFileW
GetFullPathNameW
RemoveDirectoryW
GetTempFileNameW
GetStartupInfoW
lstrlenW
FindClose
SetFilePointer
WriteFile
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
OpenProcess
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocalTime
GetCurrentProcess
CreateProcessW
lstrcpynW
CreateMutexW
SetLastError
GetVersionExW
GetTickCount
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
SetErrorMode
QueryDepthSList
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
GetCommandLineW
lstrcmpW
GetTickCount64
MultiByteToWideChar
MoveFileW
CopyFileW
DeleteFileW
FindResourceExW
FindResourceW
GetModuleHandleW
LoadLibraryW
CreateEventW
CloseHandle
SizeofResource
LoadResource
WaitForMultipleObjects
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Process32FirstW
RaiseException
GetShortPathNameW
GetProcessHeap
ReleaseSemaphore
VirtualProtect
GetThreadTimes
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetFileType
HeapSize
HeapFree
HeapReAlloc
FreeLibraryAndExitThread
ExitThread
RtlUnwind
InterlockedFlushSList
GetSystemWindowsDirectoryW
CreateFileA
lstrcmpiA
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
LockResource
DecodePointer
lstrcmpA
DeviceIoControl
GetLastError
Process32NextW
UnregisterWaitEx
RegisterWaitForSingleObject
OutputDebugStringA
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
FormatMessageW
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThread
GetNativeSystemInfo
TryEnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetFileTime
GetSystemDirectoryW
GetTempPathW
CreateDirectoryW
GetFileSize
ReadFile
SetEndOfFile
GetStdHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetFileSizeEx
LocalFree
ReleaseMutex
LocalFileTimeToFileTime
DosDateTimeToFileTime
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FlushFileBuffers
GetACP
FreeResource
ExitProcess
MulDiv
IsBadReadPtr
ResetEvent
GetVersion
InterlockedExchange
InterlockedCompareExchange
ResumeThread
CreateThread
SetThreadPriority
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetFilePointerEx

user32

PostMessageW
DestroyIcon
UnregisterClassW
LoadImageW
MoveWindow
wsprintfW
CopyRect
OffsetRect
UnionRect
EqualRect
SetCursor
DrawFocusRect
RegisterClassW
EnableWindow
GetMenu
SetPropW
GetPropW
AdjustWindowRectEx
wvsprintfW
InflateRect
IsChild
GetFocus
GetKeyState
GetUpdateRect
IsRectEmpty
GetClassNameW
IntersectRect
IsIconic
SetWindowRgn
FindWindowExW
CharPrevW
DrawTextW
SetRect
DrawIconEx
CreateCaret
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
RemovePropW
GetWindowDC
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
FillRect
PeekMessageW
WaitMessage
CallMsgFilterW
GetQueueStatus
MsgWaitForMultipleObjectsEx
GetIconInfo
LoadStringW
DispatchMessageW
TranslateMessage
GetMessageW
LoadCursorW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
FindWindowW
GetSystemMetrics
CreateDialogParamW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
LoadIconW
GetWindow
GetParent
GetDesktopWindow
SetWindowLongW
GetWindowLongW
PtInRect
MapWindowPoints
ScreenToClient
GetCursorPos
GetWindowRect
MessageBoxW
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
SwitchToThisWindow
UpdateWindow
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetAsyncKeyState
SetFocus
IsZoomed
IsWindowVisible
SetWindowPos
UpdateLayeredWindow
ShowWindow
IsWindow
CreateWindowExW
PostQuitMessage
SendMessageW
RegisterWindowMessageW
CharNextW
DestroyWindow
DefWindowProcW
GetClientRect

gdi32

GetCharABCWidthsW
GetClipBox
LineTo
RoundRect
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
BitBlt
SetTextColor
MoveToEx
TextOutW
ExtTextOutW
CombineRgn
CreateDCW
SetDIBitsToDevice
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgnIndirect
DeleteDC
DeleteObject
RestoreDC
SaveDC
SelectClipRgn
SelectObject
CreateRoundRectRgn
CreateDIBSection
GetObjectW
GetDIBits
SetWindowOrgEx
GetTextMetricsW
Rectangle
SetViewportOrgEx
GetStockObject
CreatePen
CreateFontIndirectW
OffsetViewportOrgEx
GetDeviceCaps
RectVisible
GetTextExtentPoint32W
SetStretchBltMode

advapi32

CheckTokenMembership
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
GetTokenInformation
RegQueryValueExW
RegCreateKeyW

shell32

ord165
ShellExecuteExW
SHCreateDirectoryExW
ShellExecuteW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHFileOperationW
SHChangeNotify

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoCreateGuid
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning

oleaut32

SafeArrayPutElement
SafeArrayCreate
VariantClear
SysAllocString
SysFreeString
VarUI4FromStr
VariantInit
SysAllocStringLen

shlwapi

PathIsDirectoryA
PathFindFileNameW
PathFileExistsA
SHSetValueW
SHGetValueW
PathCombineW
StrCpyW
SHDeleteKeyW
PathRemoveFileSpecW
PathIsDirectoryW
PathFileExistsW
StrStrIW
StrStrIA
StrCmpIW
StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
AssocQueryStringW
PathAppendW

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

gdiplus

GdiplusShutdown
GdipDrawEllipseI
GdipDrawPath
ord1
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImagePointsI
GdipFillPath
GdipSetInterpolationMode
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneBitmapAreaI
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdiplusStartup
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipFillRectangleI
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipSetSmoothingMode
GdipFillEllipseI
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGraphicsClear
GdipDrawImageRectI
GdipCreatePath
GdipDeletePath
GdipClosePathFigure
GdipAddPathArcI
GdipCreateTexture

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

wininet

InternetSetCookieW
InternetGetConnectedState
InternetCrackUrlW
InternetGetCookieExW

iphlpapi

GetAdaptersInfo

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

msimg32

GradientFill
AlphaBlend

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
archive/manual_sign/wjcq_ntaskbar.exe
.exe windows:5 windows x86 arch:x86

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:33:18:da:ba:58:1d:93:6d:a0:d8:db:a3:b6:2b:bc:33:ef:e3:8a:37:d6:64:a7:a6:c1:af:c6:6e:6c:c9:7e
Signer

Actual PE Digest

18:33:18:da:ba:58:1d:93:6d:a0:d8:db:a3:b6:2b:bc:33:ef:e3:8a:37:d6:64:a7:a6:c1:af:c6:6e:6c:c9:7e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 806KB - Virtual size: 808KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 303KB - Virtual size: 303KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
archive/manual_sign/wjcq_ntaskbar_repush.exe
.exe windows:5 windows x86 arch:x86

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:25:89:e4:4b:e6:50:ad:7d:8b:f5:0b:43:ff:44:f6:ae:7a:cc:14:7c:33:32:92:6f:28:a7:ae:47:51:72:14
Signer

Actual PE Digest

02:25:89:e4:4b:e6:50:ad:7d:8b:f5:0b:43:ff:44:f6:ae:7a:cc:14:7c:33:32:92:6f:28:a7:ae:47:51:72:14

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 806KB - Virtual size: 808KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 303KB - Virtual size: 303KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

09dfcf10be7b8a62a35de68b7fc5c42c

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

e2:75:80:48:91:5a:96:a9:da:ff:82:ad:f4:89:5f:39:66:f8:68:35:51:db:80:1b:c3:b4:3c:f4:09:31:f1:c2Signer

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

urlmon

comctl32

gdiplus

version

crypt32

wintrust

wininet

iphlpapi

winmm

msimg32

imm32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 308KB - Virtual size: 308KB

.data Size: 30KB - Virtual size: 46KB

.rsrc Size: 2.4MB - Virtual size: 2.4MB

.reloc Size: 79KB - Virtual size: 79KB

09dfcf10be7b8a62a35de68b7fc5c42c

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

02:75:12:6f:f5:ac:ca:51:6d:9c:00:aa:12:0b:83:19:82:29:f0:69:db:e5:f7:df:19:16:7e:91:28:d8:8d:74Signer

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

e2:75:80:48:91:5a:96:a9:da:ff:82:ad:f4:89:5f:39:66:f8:68:35:51:db:80:1b:c3:b4:3c:f4:09:31:f1:c2
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 308KB - Virtual size: 308KB

.data
Size: 30KB - Virtual size: 46KB

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

.reloc
Size: 79KB - Virtual size: 79KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

02:75:12:6f:f5:ac:ca:51:6d:9c:00:aa:12:0b:83:19:82:29:f0:69:db:e5:f7:df:19:16:7e:91:28:d8:8d:74
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 308KB - Virtual size: 308KB

.data
Size: 30KB - Virtual size: 46KB

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

.reloc
Size: 79KB - Virtual size: 79KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 308KB - Virtual size: 308KB

.data
Size: 30KB - Virtual size: 46KB

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

.reloc
Size: 79KB - Virtual size: 79KB