d6e0ddd88cb71b24d547d7633e6b3d0f6ddee2a7f0907554503b10cec3034be2

Sharing

Copy URL Twitter E-mail

General

Target

d6e0ddd88cb71b24d547d7633e6b3d0f6ddee2a7f0907554503b10cec3034be2
Size

2.8MB
MD5

ea25c625aafedfc710f6395a75d204a1
SHA1

4f51f8abe2a2979e612e169802625569bb756ead
SHA256

d6e0ddd88cb71b24d547d7633e6b3d0f6ddee2a7f0907554503b10cec3034be2
SHA512

93bbca4f9f7377faaa8ae127cfcb7b061825b0e3ef7cd60cdaa42d75cc6c07ac9ba875974f4546c1dd8d412fa1eab28fe260a073b3af1982d9c15a6511b9b8a7
SSDEEP

49152:VvCXhSzC5yZrAJ10tD+a54ZhjUqY21jUtN1W2eb68w5G8h/UlTZPLqzm:RCxHnz+DLuZFNYi4tN1pfrsTZPLqzm

Score

1^/10

Malware Config

Signatures

Files

d6e0ddd88cb71b24d547d7633e6b3d0f6ddee2a7f0907554503b10cec3034be2
.zip
Gam\PegueMoick.exe
.exe windows:5 windows x86 arch:x86

9b0ec1795cfba04d39290d9b6cac2b7f

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

de:b1:21:56:3c:e4:a4:bb:d9:de:55:e0:52:6c:e4:8d:fb:83:81:7c:90:8d:c1:af:e1:c6:39:78:e9:a0:6e:a0
Signer

Actual PE Digest

de:b1:21:56:3c:e4:a4:bb:d9:de:55:e0:52:6c:e4:8d:fb:83:81:7c:90:8d:c1:af:e1:c6:39:78:e9:a0:6e:a0

Digest Algorithm

sha256

PE Digest Matches

true

62:14:83:0e:69:29:41:68:b9:ec:ee:6b:3c:c7:c2:70:f0:8a:d6:01
Signer

Actual PE Digest

62:14:83:0e:69:29:41:68:b9:ec:ee:6b:3c:c7:c2:70:f0:8a:d6:01

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseMutex
FindResourceA
FreeLibrary
LoadResource
UpdateResourceA
EndUpdateResourceW
EnumResourceTypesA
SizeofResource
EnumResourceLanguagesA
SetLastError
BeginUpdateResourceW
LoadLibraryA
LockResource
BeginUpdateResourceA
UpdateResourceW
EnumResourceNamesA
EndUpdateResourceA
WideCharToMultiByte
MultiByteToWideChar
CreateProcessW
GetCurrentProcess
GetModuleHandleW
OpenProcess
WaitForSingleObject
GetVersionExW
TerminateProcess
CreateDirectoryA
GetProcAddress
Process32FirstW
GetSystemInfo
GetModuleFileNameA
Process32NextW
CreateToolhelp32Snapshot
CreateProcessA
GetSystemDirectoryA
GetStartupInfoA
CreatePipe
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
GetExitCodeProcess
HeapReAlloc
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateMutexW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateThread
Sleep
DeleteFileA
FindNextFileW
FindClose
RemoveDirectoryA
GetFileAttributesA
FindFirstFileW
DeleteFileW
CloseHandle
GetLastError
CreateFileW
ReadFile
WriteFile
SetFilePointer
GetFileSize
LoadLibraryW
CreateFileA
GetProcessHeap
GetLocaleInfoW
HeapSize
SetConsoleCtrlHandler
FlushFileBuffers
FatalAppExitA
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
SetStdHandle
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetCurrentThread
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
InterlockedExchange
InterlockedCompareExchange
GetCommandLineW
HeapSetInformation
MoveFileA
HeapFree
GetSystemTimeAsFileTime
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
HeapAlloc
GetTimeFormatA
GetDateFormatA
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
SetUnhandledExceptionFilter
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount

user32

FindWindowA
GetSystemMetrics
FindWindowExW
IsWindow
FindWindowW
GetWindowRect
PostMessageW
GetWindowThreadProcessId
GetWindowLongW

advapi32

RegDeleteValueA
RegCreateKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegDeleteTreeA
RegRestoreKeyA
RegCloseKey
AdjustTokenPrivileges
CheckTokenMembership
FreeSid
RegEnumValueA
AllocateAndInitializeSid
DuplicateTokenEx
RegOpenKeyExA
LookupPrivilegeValueW
CreateProcessWithTokenW
RegOpenKeyW
RegQueryValueExA
GetTokenInformation
OpenProcessToken
RegSaveKeyA

shell32

SHGetSpecialFolderPathA
SHGetFolderPathA
ShellExecuteExA
ShellExecuteA

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

GetModuleFileNameExA

imagehlp

MakeSureDirectoryPathExists

ws2_32

WSAStartup
connect
inet_ntoa
htons
recv
getsockopt
send
gethostbyname
closesocket
__WSAFDIsSet
select
socket

netapi32

Netbios

Sections

.text
Size: 347KB - Virtual size: 347KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Gam\PorStemer.exe
.exe windows:5 windows x86 arch:x86

9fda0c4400f7dd3dbe0d4c07cbf39f9c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:37:e4:a3:64:36:43:89:5f:b5:30:ca:e3:b1:7f:67:c2:22:9d:c3:41:c7:c8:15:54:84:79:d1:4b:f6:7d:69
Signer

Actual PE Digest

03:37:e4:a3:64:36:43:89:5f:b5:30:ca:e3:b1:7f:67:c2:22:9d:c3:41:c7:c8:15:54:84:79:d1:4b:f6:7d:69

Digest Algorithm

sha256

PE Digest Matches

true

5e:38:a1:c8:94:84:d3:73:d1:d2:d1:7d:5c:d0:7f:ee:64:ca:0f:e2
Signer

Actual PE Digest

5e:38:a1:c8:94:84:d3:73:d1:d2:d1:7d:5c:d0:7f:ee:64:ca:0f:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imagehlp

MakeSureDirectoryPathExists

user32

MapVirtualKeyW
ToUnicodeEx
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
SetClassLongW
DestroyAcceleratorTable
SetParent
UnregisterClassW
GetNextDlgGroupItem
InvalidateRgn
SetRect
CopyAcceleratorTableW
CharNextW
GetMenuDefaultItem
SetMenuDefaultItem
CreatePopupMenu
IsMenu
MonitorFromPoint
UpdateLayeredWindow
EnableScrollBar
UnionRect
IsRectEmpty
IsZoomed
GetAsyncKeyState
NotifyWinEvent
MessageBeep
SetWindowRgn
LoadMenuW
IntersectRect
OffsetRect
CharUpperW
DestroyIcon
WaitMessage
ReleaseCapture
WindowFromPoint
SetCapture
KillTimer
SetTimer
DeleteMenu
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
CopyImage
LoadCursorW
GetSysColorBrush
RealChildWindowFromPoint
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
InflateRect
InvalidateRect
DrawStateW
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
GetMenuStringW
InsertMenuW
RemoveMenu
GetDesktopWindow
DefFrameProcW
GetNextDlgTabItem
EndDialog
GetMessageW
TranslateMessage
GetActiveWindow
SetWindowContextHelpId
MapDialogRect
GetCursorPos
ClientToScreen
IsWindowEnabled
ShowOwnedPopups
SetCursor
PostQuitMessage
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetKeyboardLayout
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
InvertRect
RemovePropW
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
RedrawWindow
IsWindowVisible
ValidateRect
UpdateWindow
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxW
CreateWindowExW
GetClassInfoExW
RegisterClassW
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
SetWindowPos
CopyRect
PtInRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
GetSystemMenu
IsIconic
DrawIcon
GetClientRect
LoadIconW
AppendMenuW
SendMessageW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
EnableWindow
GetClassInfoW
CreateMenu
IsClipboardFormatAvailable
GetUpdateRect
GetWindowLongW
GetWindowRect
IsWindow
GetSystemMetrics
GetWindowThreadProcessId
PostMessageW
GetDoubleClickTime
IsCharLowerW
GetKeyboardState
LoadAcceleratorsW
CreateAcceleratorTableW
SetCursorPos
BringWindowToTop
SetWindowsHookExW
LockWindowUpdate
GetKeyNameTextW
MapVirtualKeyExW
SubtractRect
DestroyCursor
GetWindowRgn
HideCaret
GetIconInfo
LoadImageW
TranslateAcceleratorW
InsertMenuItemW
ReuseDDElParam
UnpackDDElParam
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
RegisterClipboardFormatW
FrameRect
CharUpperBuffW
CopyIcon
GetPropW
PostThreadMessageW
CreateDialogIndirectParamW

advapi32

RegEnumKeyExW
RegEnumValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyW
RegQueryValueW
OpenProcessToken

shell32

SHAppBarMessage
DragQueryFileW
DragFinish
ShellExecuteW
SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetFolderPathA
SHGetSpecialFolderPathA

ws2_32

recv
socket
__WSAFDIsSet
htons
gethostbyname
send
getsockopt
select
WSAStartup
connect
closesocket
inet_ntoa

netapi32

Netbios

kernel32

UnhandledExceptionFilter
QueryPerformanceCounter
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetUnhandledExceptionFilter
VirtualQuery
HeapSize
HeapQueryInformation
ExitThread
ExitProcess
HeapReAlloc
RaiseException
RtlUnwind
GetFileType
SetStdHandle
DecodePointer
EncodePointer
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
GetStartupInfoW
HeapSetInformation
GetCommandLineW
FindResourceExW
GetDiskFreeSpaceW
GetUserDefaultLCID
VirtualProtect
SearchPathW
GetProfileIntW
GetTickCount
GetFileTime
GetFileSizeEx
IsDebuggerPresent
SetFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
SetFileAttributesW
GetFileAttributesExW
SetErrorMode
GetNumberFormatW
GetWindowsDirectoryW
GetTempPathW
GetTempFileNameW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
MoveFileW
lstrcmpiW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetStringTypeW
LCMapStringW
WriteConsoleW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetProcessHeap
SetEnvironmentVariableA
GetDriveTypeW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
SetVolumeLabelW
IsProcessorFeaturePresent
GetConsoleCP
GetFileAttributesW
GetConsoleMode
GetFullPathNameA
lstrlenA
GetCurrentDirectoryW
SystemTimeToFileTime
FileTimeToSystemTime
GetThreadLocale
GetSystemDirectoryW
GlobalGetAtomNameW
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GlobalFlags
CopyFileW
GlobalSize
FormatMessageW
LocalFree
MulDiv
InterlockedDecrement
ReleaseActCtx
CreateActCtxW
GlobalUnlock
lstrcpyW
CreateFileA
GetFileSize
SetFilePointer
WriteFile
ReadFile
CreateFileW
GetLastError
CloseHandle
DeleteFileW
FindFirstFileW
GetFileAttributesA
FindClose
FindNextFileW
DeleteFileA
Sleep
CreateThread
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
FindResourceA
FreeLibrary
LoadResource
UpdateResourceA
EndUpdateResourceW
EnumResourceTypesA
SizeofResource
EnumResourceLanguagesA
SetLastError
BeginUpdateResourceW
LoadLibraryA
LockResource
BeginUpdateResourceA
UpdateResourceW
EnumResourceNamesA
EndUpdateResourceA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetModuleHandleW
OpenProcess
LoadLibraryW
GetVersionExW
TerminateProcess
CreateDirectoryA
GetProcAddress
Process32FirstW
GetSystemInfo
GetModuleFileNameA
Process32NextW
CreateToolhelp32Snapshot
VirtualAlloc
GetModuleHandleA
FindResourceW
GetCommandLineA
GetStdHandle
CreateMutexA
SetCurrentDirectoryA
GetCurrentDirectoryA
lstrlenW
lstrcmpW
DeactivateActCtx
ActivateActCtx
InitializeCriticalSectionAndSpinCount
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GetCurrentThreadId
FreeResource
InterlockedExchange
LoadLibraryExW
GetLocaleInfoW
GlobalAlloc
GlobalLock
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GetModuleFileNameW
GetCurrentThread
lstrcmpA
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetCurrentProcessId
GlobalFree
SetThreadPriority
ResumeThread

gdi32

GetWindowOrgEx
LPtoDP
SetPaletteEntries
ExtFloodFill
EnumFontFamiliesExW
Rectangle
SetPixel
StretchBlt
SetDIBColorTable
OffsetRgn
GetSystemPaletteEntries
RealizePalette
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
Polygon
Ellipse
Polyline
CreateEllipticRgn
CreatePolygonRgn
DPtoLP
PatBlt
GetMapMode
CombineRgn
SetRectRgn
GetRgnBox
GetTextColor
GetBkColor
CreateDIBSection
CreateRoundRectRgn
GetTextCharsetInfo
EnumFontFamiliesW
GetTextMetricsW
CreateRectRgnIndirect
CreateCompatibleBitmap
CreateDIBitmap
GetTextExtentPoint32W
CreateFontIndirectW
CreateHatchBrush
CreateSolidBrush
CreatePen
SelectPalette
GetStockObject
CreateCompatibleDC
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
GetViewportOrgEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
DeleteObject
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateDCW
CopyMetaFileW
GetDeviceCaps
GetObjectW
SetBkColor
SetTextColor
CreateBitmap
GetTextFaceW
SetPixelV
FillRgn
PtInRegion
FrameRgn
GetBoundsRect
GetObjectType

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

comctl32

ImageList_GetIconSize
InitCommonControlsEx

shlwapi

PathIsUNCW
PathStripToRootW
PathFindFileNameW
PathFindExtensionW
PathRemoveFileSpecW

ole32

CoInitializeEx
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoUninitialize
CoInitialize
CoCreateInstance
OleDuplicateData
CreateStreamOnHGlobal
ReleaseStgMedium
OleIsCurrentClipboard
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
OleInitialize
CoRegisterMessageFilter
CoRevokeClassObject
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
CoFreeUnusedLibraries
OleUninitialize
OleCreateMenuDescriptor
CoTaskMemAlloc
DoDragDrop
OleFlushClipboard

oleaut32

OleCreateFontIndirect
VarBstrFromDate
SysFreeString
SysAllocString
SysStringLen
VariantInit
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantClear
SysAllocStringLen

oledlg

OleUIBusyW

gdiplus

GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDrawImageI

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 329KB - Virtual size: 329KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Gam\ShedulerPte.exe
.exe windows:5 windows x86 arch:x86

f71708ac18c429ab65f0c4e2c7da643a

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:cf:b5:94:ff:f2:5f:b1:c4:cd:a5:9d:71:fb:e2:fb:ee:dd:c6:f6:02:4f:44:4d:0f:3d:cc:a5:d9:ec:e3:99
Signer

Actual PE Digest

03:cf:b5:94:ff:f2:5f:b1:c4:cd:a5:9d:71:fb:e2:fb:ee:dd:c6:f6:02:4f:44:4d:0f:3d:cc:a5:d9:ec:e3:99

Digest Algorithm

sha256

PE Digest Matches

true

6f:74:00:ea:83:e4:21:ef:b8:c5:45:d6:d2:59:a0:46:d1:3d:7b:82
Signer

Actual PE Digest

6f:74:00:ea:83:e4:21:ef:b8:c5:45:d6:d2:59:a0:46:d1:3d:7b:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
CreateThread
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
FindResourceA
FreeLibrary
LoadResource
UpdateResourceA
EndUpdateResourceW
EnumResourceTypesA
SizeofResource
EnumResourceLanguagesA
SetLastError
BeginUpdateResourceW
LoadLibraryA
LockResource
BeginUpdateResourceA
UpdateResourceW
EnumResourceNamesA
EndUpdateResourceA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetModuleHandleW
OpenProcess
LoadLibraryW
GetVersionExW
TerminateProcess
GetProcAddress
Process32FirstW
GetSystemInfo
GetModuleFileNameA
Process32NextW
CreateToolhelp32Snapshot
GetExitCodeProcess
CreateProcessA
WinExec
GetCommandLineA
GetProcessHeap
SetEndOfFile
WriteConsoleW
HeapReAlloc
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetFileAttributesA
CloseHandle
GetLastError
CreateFileW
ReadFile
WriteFile
SetFilePointer
CreateFileA
GetUserDefaultLCID
GetLocaleInfoW
HeapSize
FlushFileBuffers
IsValidCodePage
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
SetStdHandle
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
InterlockedExchange
GetCommandLineW
HeapSetInformation
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
SetUnhandledExceptionFilter
ExitProcess
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
TlsAlloc

user32

GetSystemMetrics
PostMessageW

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken

shell32

SHGetSpecialFolderPathA
SHGetFolderPathA

ws2_32

inet_ntoa
WSAStartup
select
getsockopt
send
gethostbyname
closesocket
__WSAFDIsSet
socket
recv
htons
connect

netapi32

Netbios

Sections

.text
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Gam\demount32.dll
.dll regsvr32 windows:5 windows x86 arch:x86

05c50410df471ab3ee7ed852f7daed17

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cb:79:8f:92:13:1f:7d:c6:39:63:4d:bc:c6:8e:5a:b5:d4:af:fa:65:48:00:c5:d1:79:1c:0a:1a:41:0b:ce:b2
Signer

Actual PE Digest

cb:79:8f:92:13:1f:7d:c6:39:63:4d:bc:c6:8e:5a:b5:d4:af:fa:65:48:00:c5:d1:79:1c:0a:1a:41:0b:ce:b2

Digest Algorithm

sha256

PE Digest Matches

true

1d:8f:3f:99:bc:2d:32:e9:5e:9e:a2:d6:89:50:2a:71:36:52:1c:69
Signer

Actual PE Digest

1d:8f:3f:99:bc:2d:32:e9:5e:9e:a2:d6:89:50:2a:71:36:52:1c:69

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

uxtheme

GetThemeFont
CloseThemeData
DrawThemeParentBackground
GetThemeColor
OpenThemeData
IsAppThemed

gdi32

CreateFontIndirectW
DeleteObject
CreateSolidBrush

advapi32

RegOpenKeyExA
RegEnumKeyW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW
OpenProcessToken
RegQueryValueExA
RegCreateKeyExW
RegCloseKey

kernel32

HeapReAlloc
WriteConsoleW
SetEndOfFile
GetProcessHeap
SetFilePointer
WriteFile
ReadFile
CreateFileW
GetLastError
CloseHandle
GetCurrentProcess
GetProcAddress
Process32FirstW
GetModuleFileNameA
Process32NextW
CreateToolhelp32Snapshot
GetCurrentProcessId
Sleep
CreateThread
CreateMutexW
WaitForSingleObject
ReleaseMutex
FindResourceA
FreeLibrary
LoadResource
UpdateResourceA
EndUpdateResourceW
EnumResourceTypesA
SizeofResource
EnumResourceLanguagesA
SetLastError
BeginUpdateResourceW
LoadLibraryA
LockResource
BeginUpdateResourceA
UpdateResourceW
CompareStringW
EndUpdateResourceA
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
OpenProcess
LoadLibraryW
GetVersionExW
GetFileAttributesA
TerminateProcess
CreateDirectoryA
GetSystemInfo
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GlobalDeleteAtom
TerminateThread
CreateProcessA
WritePrivateProfileStringW
GetPrivateProfileIntW
GlobalFindAtomW
SetEvent
GetModuleFileNameW
lstrlenW
DisableThreadLibraryCalls
CreateEventW
OpenEventW
GlobalAddAtomW
GetVersion
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
RtlUnwind
RaiseException
GetCommandLineA
GetCurrentThreadId
ExitProcess
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
InterlockedExchange
DecodePointer
EncodePointer
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapSize
EnumResourceNamesA
SetEnvironmentVariableA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetStartupInfoW
HeapCreate
HeapDestroy
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateFileA
GetLocaleInfoW
GetTimeZoneInformation
FlushFileBuffers
IsProcessorFeaturePresent

user32

GetSysColorBrush
SystemParametersInfoW
CallNextHookEx
FindWindowW
GetWindowTextLengthW
GetSysColor
GetWindowTextW
FillRect
SetWindowsHookExW
UnhookWindowsHookEx
DestroyWindow
SetTimer
UnregisterClassW
KillTimer
LoadCursorW
SetFocus
PtInRect
InvalidateRect
ShowWindow
IsWindow
CreateWindowExW
RegisterClassW
SendMessageW
UpdateWindow
DefWindowProcW
GetWindowLongW
SetWindowLongW
GetSystemMetrics
PostMessageW
FindWindowExW

shell32

SHGetFolderPathA
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
SHLoadInProc

ole32

CoCreateInstance
CoUninitialize
StringFromGUID2
CoInitialize

imagehlp

MakeSureDirectoryPathExists

ws2_32

__WSAFDIsSet
closesocket
gethostbyname
socket
getsockopt
recv
htons
select
WSAStartup
inet_ntoa
connect
send

netapi32

Netbios

gdiplus

GdiplusStartup
GdiplusShutdown

shlwapi

PathFileExistsA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetClassObjectEx
DllGetClassObjectNew
DllInstall
DllRegisterServer
DllShowBar
DllUnregisterServer
UnInstall

Sections

.text
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Gam\demount64.dll
.dll regsvr32 windows:5 windows x64 arch:x64

e76ba15250ca47f37cc57bcf6484883f

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:0c:09:3b:66:93:3f:8a:18:80:39:5b:f6:4d:66:8f:26:e7:a0:08:79:a5:95:27:d7:08:37:21:68:ac:93:36
Signer

Actual PE Digest

82:0c:09:3b:66:93:3f:8a:18:80:39:5b:f6:4d:66:8f:26:e7:a0:08:79:a5:95:27:d7:08:37:21:68:ac:93:36

Digest Algorithm

sha256

PE Digest Matches

true

7a:45:d1:c1:e0:ef:3f:14:11:80:98:13:38:8f:da:37:3b:c8:a7:60
Signer

Actual PE Digest

7a:45:d1:c1:e0:ef:3f:14:11:80:98:13:38:8f:da:37:3b:c8:a7:60

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\PC客户端打包\C++\BzProjectsNew\DeskTesk32_1675754621\Release\deskband64.pdb

Imports

uxtheme

GetThemeFont
CloseThemeData
DrawThemeParentBackground
GetThemeColor
OpenThemeData
IsAppThemed

gdi32

CreateFontIndirectW
DeleteObject
CreateSolidBrush

advapi32

RegOpenKeyExA
RegEnumKeyW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW
OpenProcessToken
RegQueryValueExA
RegCreateKeyExW
RegCloseKey

kernel32

HeapReAlloc
WriteConsoleW
SetEndOfFile
GetProcessHeap
SetFilePointer
WriteFile
ReadFile
CreateFileW
GetLastError
CloseHandle
GetCurrentProcess
GetProcAddress
Process32FirstW
GetModuleFileNameA
Process32NextW
CreateToolhelp32Snapshot
GetCurrentProcessId
Sleep
CreateThread
CreateMutexW
WaitForSingleObject
ReleaseMutex
FindResourceA
FreeLibrary
LoadResource
UpdateResourceA
EndUpdateResourceW
SizeofResource
SetLastError
BeginUpdateResourceW
LoadLibraryA
LockResource
BeginUpdateResourceA
UpdateResourceW
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
OpenProcess
LoadLibraryW
GetVersionExW
GetFileAttributesA
TerminateProcess
CreateDirectoryA
GetSystemInfo
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GlobalDeleteAtom
TerminateThread
CreateProcessA
WritePrivateProfileStringW
GetPrivateProfileIntW
GlobalFindAtomW
SetEvent
GetModuleFileNameW
lstrlenW
DisableThreadLibraryCalls
CreateEventW
OpenEventW
GlobalAddAtomW
GetVersion
RtlVirtualUnwind
RtlCaptureContext
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RaiseException
GetCommandLineA
FlsSetValue
GetCurrentThreadId
ExitProcess
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
DecodePointer
EncodePointer
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsFree
FlsAlloc
HeapSize
SetStdHandle
EndUpdateResourceA
SetEnvironmentVariableA
InitializeCriticalSectionAndSpinCount
GetFileType
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetStartupInfoW
HeapSetInformation
HeapCreate
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateFileA
GetLocaleInfoW
GetTimeZoneInformation
FlushFileBuffers
HeapDestroy

user32

GetSysColor
FillRect
GetWindowTextLengthW
CallNextHookEx
GetSysColorBrush
SystemParametersInfoW
FindWindowW
GetWindowTextW
FindWindowExW
SetWindowsHookExW
UnhookWindowsHookEx
DestroyWindow
SetTimer
UnregisterClassW
KillTimer
LoadCursorW
GetWindowLongPtrW
SetFocus
PtInRect
InvalidateRect
ShowWindow
IsWindow
CreateWindowExW
RegisterClassW
SetWindowLongPtrW
SendMessageW
UpdateWindow
DefWindowProcW
GetWindowLongW
SetWindowLongW
PostMessageW
GetSystemMetrics

shell32

SHLoadInProc
SHGetFolderPathA
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CoUninitialize
StringFromGUID2
CoInitialize

imagehlp

MakeSureDirectoryPathExists

ws2_32

__WSAFDIsSet
closesocket
gethostbyname
socket
getsockopt
recv
htons
select
WSAStartup
inet_ntoa
connect
send

netapi32

Netbios

gdiplus

GdiplusStartup
GdiplusShutdown

shlwapi

PathFileExistsA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetClassObjectEx
DllGetClassObjectNew
DllInstall
DllRegisterServer
DllShowBar
DllUnregisterServer
UnInstall

Sections

.text
Size: 268KB - Virtual size: 267KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PrompotRecord.exe
.exe windows:5 windows x86 arch:x86

b96b50eb6405606d5c2b3ea7baa06dea

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:47:82:5f:ba:b1:f4:f0:48:af:af:75:03:40:3c:a1:b2:49:e6:3f:53:3a:8b:52:16:37:af:f3:b6:1d:92:b0
Signer

Actual PE Digest

05:47:82:5f:ba:b1:f4:f0:48:af:af:75:03:40:3c:a1:b2:49:e6:3f:53:3a:8b:52:16:37:af:f3:b6:1d:92:b0

Digest Algorithm

sha256

PE Digest Matches

true

d6:73:f9:31:c9:e3:a5:c1:0e:84:89:1e:82:4c:52:d2:e4:55:0a:6f
Signer

Actual PE Digest

d6:73:f9:31:c9:e3:a5:c1:0e:84:89:1e:82:4c:52:d2:e4:55:0a:6f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime

kernel32

BeginUpdateResourceA
EnumResourceLanguagesA
EnumResourceNamesA
EnumResourceTypesA
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetSystemInfo
GetProcAddress
LoadLibraryW
GetModuleHandleA
GetModuleFileNameA
GetCurrentProcess
GetFileAttributesA
TerminateProcess
CreateDirectoryA
CreateEventA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
ResetEvent
GetOverlappedResult
FreeResource
GetCurrentProcessId
GetCurrentThreadId
SetCurrentDirectoryA
SetCurrentDirectoryW
GetModuleFileNameW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
HeapSize
GetLocaleInfoW
IsValidCodePage
LeaveCriticalSection
GetACP
FlushFileBuffers
LoadLibraryA
GetStdHandle
SetHandleCount
HeapCreate
GetConsoleMode
GetConsoleCP
GetFileType
InitializeCriticalSectionAndSpinCount
SetStdHandle
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
GetCPInfo
LCMapStringW
GetStartupInfoW
HeapSetInformation
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
RtlUnwind
RaiseException
DecodePointer
EncodePointer
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
EnterCriticalSection
DeleteCriticalSection
FreeEnvironmentStringsW
InitializeCriticalSection
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetEndOfFile
GetProcessHeap
LocalFree
CreateThread
CreateFileA
SetFilePointer
SetLastError
FindResourceA
FreeLibrary
SizeofResource
LoadResource
LockResource
BeginUpdateResourceW
UpdateResourceA
EndUpdateResourceA
WaitForSingleObject
ExitProcess
CloseHandle
ReadFile
WriteFile
CreateFileW
GetLastError
GetFileSize
GetCommandLineA
Sleep
GetOEMCP

user32

GetCursorPos
PtInRect
GetDC
ReleaseDC
InvalidateRect
SetWindowRgn
DialogBoxParamA
UnregisterHotKey
RegisterHotKey
LoadIconA
SetClassLongA
SetTimer
EndDialog
IsDlgButtonChecked
EnableWindow
SendDlgItemMessageA
SetFocus
CheckDlgButton
SetDlgItemInt
GetDlgItemTextA
SetDlgItemTextA
GetDesktopWindow
GetIconInfo
GetAsyncKeyState
DrawIconEx
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
InvalidateRgn
IsWindowVisible
ScreenToClient
SetWindowTextA
GetDlgItem
SendMessageA
EnumChildWindows
ShowWindow
CreateDialogParamA
SetWindowLongA
GetClientRect
GetClassNameA
DestroyWindow
SetWindowPos
CallWindowProcA
GetWindowLongA
FindWindowExA
GetWindowRect
GetSystemMetrics
PostMessageA
GetDlgItemInt

gdi32

BitBlt
CreateRectRgn
CombineRgn
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
CreateRectRgnIndirect

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegOpenKeyA
RegCloseKey

shell32

SHGetFolderPathA
SHGetSpecialFolderPathA

ole32

CoCreateInstance
CoTaskMemFree

ws2_32

connect
recv
send
gethostbyname
select
__WSAFDIsSet
getsockopt
htons
socket
WSAStartup
inet_ntoa
closesocket

netapi32

Netbios

Sections

.text
Size: 297KB - Virtual size: 296KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninstall.exe
.exe windows:5 windows x86 arch:x86

9bedaef9f941729a6f516d1a37c894a6

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Not Before

10/02/2023, 02:14

Not After

09/02/2024, 10:52

Subject

CN=上海首享广告有限公司,O=上海首享广告有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

26/05/2021, 06:46

Not After

18/05/2027, 06:46

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a3:3a:b2:58:80:a3:5e:17:d2:3f:47:88:b3:a5:12:9f:51:f3:a0:eb:1b:2b:bc:de:e5:98:f5:ca:c7:ef:70:03
Signer

Actual PE Digest

a3:3a:b2:58:80:a3:5e:17:d2:3f:47:88:b3:a5:12:9f:51:f3:a0:eb:1b:2b:bc:de:e5:98:f5:ca:c7:ef:70:03

Digest Algorithm

sha256

PE Digest Matches

true

e3:ab:36:cb:d8:1b:06:13:b5:8f:98:42:ad:f9:06:67:35:23:9e:f1
Signer

Actual PE Digest

e3:ab:36:cb:d8:1b:06:13:b5:8f:98:42:ad:f9:06:67:35:23:9e:f1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFileExistsW

kernel32

IsProcessorFeaturePresent
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeW
QueryPerformanceCounter
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
CreateFileA
GetProcessHeap
SetEnvironmentVariableA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
GetFileType
HeapCreate
LCMapStringW
SetHandleCount
GetModuleHandleW
GlobalFree
GlobalUnlock
GlobalLock
SetStdHandle
GlobalAlloc
SizeofResource
LockResource
LoadResource
FindResourceW
GetLastError
CreateMutexW
ExitProcess
lstrcatW
lstrcpyW
GetEnvironmentVariableW
GetModuleFileNameW
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
RemoveDirectoryW
MultiByteToWideChar
DeleteFileW
GetFileSize
ReadFile
SetFilePointer
CreateFileW
WriteFile
CloseHandle
FindClose
FindNextFileW
FindFirstFileW
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
FreeLibrary
FindResourceA
SetLastError
LoadLibraryA
EndUpdateResourceA
UpdateResourceA
Sleep
BeginUpdateResourceA
EnumResourceLanguagesA
EnumResourceNamesA
VirtualQuery
VirtualAlloc
HeapSize
HeapQueryInformation
HeapReAlloc
ExitThread
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
RtlUnwind
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineW
FindResourceExW
GetUserDefaultLCID
VirtualProtect
SearchPathW
GetProfileIntW
GetTickCount
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
GetFileAttributesExW
SetErrorMode
GetNumberFormatW
GetWindowsDirectoryW
GetTempPathW
GetTempFileNameW
FileTimeToSystemTime
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
lstrcmpiW
GetCurrentDirectoryW
GlobalGetAtomNameW
EnumResourceTypesA
GetVersionExW
CreateProcessW
lstrlenA
InterlockedIncrement
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedDecrement
ReleaseActCtx
CreateActCtxW
CopyFileW
GlobalSize
FormatMessageW
LocalFree
MulDiv
GetCurrentProcessId
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
CreateEventW
SuspendThread
SetEvent
ResumeThread
lstrcmpA
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
LoadLibraryExW
InterlockedExchange
lstrlenW
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
InitializeCriticalSectionAndSpinCount
ActivateActCtx
DeactivateActCtx
lstrcmpW
ReleaseMutex
WaitForSingleObject
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryW
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
LoadLibraryW
GetFileAttributesW
GetProcAddress
GetSystemInfo
WideCharToMultiByte
CreateDirectoryW

user32

GetWindowRgn
DestroyCursor
MapDialogRect
SubtractRect
MapVirtualKeyExW
IsCharLowerW
GetDoubleClickTime
CharUpperBuffW
CopyIcon
RegisterClipboardFormatW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
GetUpdateRect
FrameRect
IsClipboardFormatAvailable
PostThreadMessageW
CreateMenu
IsMenu
UpdateLayeredWindow
UnionRect
MonitorFromPoint
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
UnpackDDElParam
ReuseDDElParam
InsertMenuItemW
TranslateAcceleratorW
GetNextDlgGroupItem
LoadImageW
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
GetMenuDefaultItem
LockWindowUpdate
BringWindowToTop
SetCursorPos
SetRect
CreateAcceleratorTableW
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
CopyAcceleratorTableW
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
DrawStateW
MessageBeep
SetClassLongW
GetAsyncKeyState
NotifyWinEvent
CreatePopupMenu
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
OffsetRect
IsRectEmpty
IntersectRect
UnregisterClassW
CharUpperW
DestroyIcon
WaitMessage
ReleaseCapture
WindowFromPoint
SetCapture
KillTimer
SetTimer
DeleteMenu
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
LoadCursorW
GetSysColorBrush
CopyImage
RealChildWindowFromPoint
MapVirtualKeyW
GetKeyNameTextW
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
InflateRect
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
GetMenuStringW
InsertMenuW
RemoveMenu
GetDesktopWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
GetWindowThreadProcessId
ShowOwnedPopups
SetCursor
GetMessageW
TranslateMessage
GetActiveWindow
GetCursorPos
EnableWindow
EndPaint
BeginPaint
GetClientRect
MessageBoxW
PostQuitMessage
IsWindowEnabled
ShowWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
LoadMenuW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
IsWindow
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
DrawIcon
AppendMenuW
SendMessageW
SetMenuDefaultItem
GetSystemMenu
IsIconic
UpdateWindow
InvalidateRect
LoadIconW
GetSystemMetrics
MoveWindow
PostMessageW
SetWindowLongW
GetWindowLongW
GetWindow
PtInRect
CopyRect
SetWindowPos
GetMenu
CallWindowProcW
DefWindowProcW
GetDlgCtrlID
GetWindowPlacement
SetWindowPlacement
SetScrollInfo
GetScrollInfo
DeferWindowPos
EqualRect
ScreenToClient
GetWindowRect
GetParent
AdjustWindowRectEx
GetSysColor
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
GetMenuItemCount
GetMenuItemID
GetSubMenu
ValidateRect
IsWindowVisible
RedrawWindow
ShowScrollBar
SetForegroundWindow
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
SetMenu
GetKeyState
TrackPopupMenu

gdi32

CreatePatternBrush
CreateCompatibleDC
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateSolidBrush
CreateHatchBrush
CreateFontIndirectW
GetTextExtentPoint32W
CreateRectRgnIndirect
PatBlt
CreateDIBitmap
CreateCompatibleBitmap
GetTextMetricsW
EnumFontFamiliesW
GetTextCharsetInfo
SetRectRgn
CombineRgn
DPtoLP
CreateDIBSection
CreateRoundRectRgn
CreatePolygonRgn
GetBkColor
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
GetRgnBox
SetDIBColorTable
ExtSelectClipRgn
SetPixel
Rectangle
EnumFontFamiliesExW
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetTextFaceW
SetPixelV
GetPaletteEntries
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetTextColor
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
SetBkColor
GetObjectW
CreateBitmap
GetDeviceCaps
CopyMetaFileW
CreateDCW
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetMapMode
GetClipBox
DeleteObject
SetLayout
GetLayout
SetTextAlign
StretchBlt
CreateFontW
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegSetValueExW
RegQueryValueExW
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegEnumValueA
RegOpenKeyW
RegCreateKeyExA
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA

shell32

DragFinish
ShellExecuteExW
SHChangeNotify
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteA
SHGetSpecialFolderPathW
SHGetFileInfoW
SHGetDesktopFolder
SHBrowseForFolderW
DragQueryFileW
SHAppBarMessage

comctl32

ImageList_GetIconSize

ole32

CoInitializeEx
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
RevokeDragDrop
CoLockObjectExternal
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
DoDragDrop
RegisterDragDrop
OleGetClipboard
CoCreateGuid
CoTaskMemFree
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
GetHGlobalFromStream
CoInitialize

oleaut32

SysStringLen
VariantClear
SysAllocString
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
SysAllocStringLen
SysFreeString
VariantInit
VariantChangeType

gdiplus

GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipDrawImageRectI
GdipCreateFromHDC
GdipDeleteGraphics
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipFree
GdipAlloc

netapi32

Netbios

ws2_32

inet_ntoa
WSAStartup
socket
htons
gethostbyname
connect
recv
send
closesocket
select
__WSAFDIsSet
getsockopt

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 296KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b0ec1795cfba04d39290d9b6cac2b7f

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1Certificate

Extended Key Usages

Key Usages

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

de:b1:21:56:3c:e4:a4:bb:d9:de:55:e0:52:6c:e4:8d:fb:83:81:7c:90:8d:c1:af:e1:c6:39:78:e9:a0:6e:a0Signer

62:14:83:0e:69:29:41:68:b9:ec:ee:6b:3c:c7:c2:70:f0:8a:d6:01Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

version

psapi

imagehlp

ws2_32

netapi32

Sections

.text Size: 347KB - Virtual size: 347KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 7KB - Virtual size: 16KB

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 16KB - Virtual size: 16KB

9fda0c4400f7dd3dbe0d4c07cbf39f9c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1Certificate

Extended Key Usages

Key Usages

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

de:b1:21:56:3c:e4:a4:bb:d9:de:55:e0:52:6c:e4:8d:fb:83:81:7c:90:8d:c1:af:e1:c6:39:78:e9:a0:6e:a0
Signer

62:14:83:0e:69:29:41:68:b9:ec:ee:6b:3c:c7:c2:70:f0:8a:d6:01
Signer

.text
Size: 347KB - Virtual size: 347KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 7KB - Virtual size: 16KB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 16KB - Virtual size: 16KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

03:37:e4:a3:64:36:43:89:5f:b5:30:ca:e3:b1:7f:67:c2:22:9d:c3:41:c7:c8:15:54:84:79:d1:4b:f6:7d:69
Signer

5e:38:a1:c8:94:84:d3:73:d1:d2:d1:7d:5c:d0:7f:ee:64:ca:0f:e2
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 329KB - Virtual size: 329KB

.data
Size: 32KB - Virtual size: 63KB

.rsrc
Size: 66KB - Virtual size: 66KB

.reloc
Size: 180KB - Virtual size: 180KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

5c:fc:94:da:fa:9a:2a:7d:fd:1c:10:ec:36:fe:fd:d1
Certificate

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

03:cf:b5:94:ff:f2:5f:b1:c4:cd:a5:9d:71:fb:e2:fb:ee:dd:c6:f6:02:4f:44:4d:0f:3d:cc:a5:d9:ec:e3:99
Signer

6f:74:00:ea:83:e4:21:ef:b8:c5:45:d6:d2:59:a0:46:d1:3d:7b:82
Signer