2182d64d0b3489d4e4313035391d4775_JaffaCakes118

resource
unpack001/$_2_/curllib.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 045004ce594115c91ee0c8b949c1192794291e234f64df034101f99784b651f8
MD5 2182d64d0b3489d4e4313035391d4775
SHA1 0378c467ffee73f4eb957fdd8f04db497f603687
SHA512 d9782563ea038ad4dbea7d30e883ec4ea8da8b219a8452c462de4df70f131ef7f3bd8cd8884a4d0ed67d39061dc26b2375591d0c210bb56a8463d5b1c336fafd
SSDEEP 98304:yQdv4++X1Fhpzt43EhG1ZXvZxdzGdd2owge/P15PU3:ndv+tdtaS0vxKddcg6P15P
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

1a:0d:66:c9:e4:ad:41:3c:98:75:a1:40:f2:70:4e:b6:e0:b4:a1:11

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Chains

Nov 19, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Serial Number

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 17, 2013 - Feb 16, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$_2_/Ad.exe

IMPHASH 3a8bee4a7464cd82bca0b8c043e5f05d
SHA256 7e6264a4d4e30a845dfff70491970a697c275d05bcd572bf484d3b821a8a95f5
MD5 218a0f93c33d9da19beb9396e251ea58
SHA1 ba28b69133ee9e79dca3b0d478f1777af1a900f3
SHA512 21b4c505f8c7b59b64ecb76551f051d035cb26af5d76c3818a5d00acc849686381b08bbba93fcd86353bb0c83a2a549ef7c7247a88c679c57c2e1499c24df386
SSDEEP 768:yiJRKDbEOKtIhxBKRGiDli/tmgkHO+QD:yiJRxOKtIhxR+lEmdO+Q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ec:6c:f1:e8:2f:79:22:d8:55:bd:36:78:ec:1a:ff:ed:85:ab:18:3e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Chains

May 8, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Serial Number

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 17, 2013 - Feb 16, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

11065

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\VipDownload\binD\Ad.pdb

kernel32

GlobalAlloc GlobalLock FindResourceExW ReadFile GlobalUnlock GetModuleFileNameW CloseHandle LoadResource GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter SetFilePointer GetCurrentProcess TerminateProcess GetStartupInfoW InterlockedCompareExchange Sleep InterlockedExchange GetVersionExA DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy LockResource CreateFileW SizeofResource OutputDebugStringW GetLastError UnhandledExceptionFilter FindResourceW

user32

KillTimer UpdateLayeredWindow ScreenToClient SetWindowPos GetWindowDC GetWindowRect SetTimer UpdateWindow ShowWindow RegisterClassExW UnregisterClassA GetDesktopWindow ReleaseDC GetMessageW LoadCursorW DispatchMessageW TranslateMessage GetWindowThreadProcessId IsWindow FindWindowExW PostQuitMessage PtInRect SetForegroundWindow SetCursor AttachThreadInput GetCursorPos GetForegroundWindow DefWindowProcW CreateWindowExW

gdi32

SelectObject CreateDIBSection CreateCompatibleDC DeleteObject DeleteDC

shell32

ShellExecuteW CommandLineToArgvW

ole32

CreateStreamOnHGlobal

shlwapi

PathAppendW PathRemoveFileSpecW

gdiplus

GdipBitmapLockBits GdipDisposeImage GdipBitmapUnlockBits GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth

msimg32

AlphaBlend

msvcr80

_CxxThrowException ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook _except_handler4_common __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _controlfp_s _initterm _wcmdln exit _XcptFilter _exit _cexit __wgetmainargs _amsg_exit ?terminate@@YAXXZ __CxxFrameHandler3 _decode_pointer _onexit _initterm_e _invoke_watson ??3@YAXPAX@Z memcpy memcpy_s wcslen memmove_s ??2@YAPAXI@Z abs labs memset free _unlock __dllonexit _encode_pointer _lock

$_2_/DownloadProxyPS.dll

IMPHASH b177dcb186702f9a4775e053e2fa1e17
SHA256 1ce25ffc0d8671f5c44573ec190533860cc3bec823d2dcfaf4548a0bd76add50
MD5 9c629978377e3edc8d0b001115f93eec
SHA1 c563aad2e04b0e69b3ceeb722f7f7e85dd3cb410
SHA512 34cb1eafd31385094bc0f2f03da80fb94662a7a966dff7f9be974b5e850e2c588e82546edfaf244b7f20046fd63421495b7a429d50184d074b83208d86dcd619
SSDEEP 768:A1fVSO9ZV/algl30jcuPv114iNpdVtAcpg5n:OAOkeEcuXVN9tVpgF
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

2c:7d:3d:70:ed:19:4c:f5:bc:2b:3c:89:69:48:07:b8:5c:7e:b4:72

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Chains

May 15, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Serial Number

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 17, 2013 - Feb 16, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

5295

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\src\tencentdl\Tencentdl_v127\Output\Release\DownloadProxyPS.pdb

kernel32

DisableThreadLibraryCalls LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetLocaleInfoA MultiByteToWideChar HeapSize RtlUnwind HeapReAlloc VirtualAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo InitializeCriticalSection LoadLibraryA GetCurrentThreadId GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetProcAddress GetModuleHandleA ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement Sleep SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WriteFile LeaveCriticalSection EnterCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent

rpcrt4

NdrOleAllocate NdrOleFree IUnknown_QueryInterface_Proxy IUnknown_AddRef_Proxy IUnknown_Release_Proxy NdrStubForwardingFunction NdrStubCall2 CStdStubBuffer_QueryInterface CStdStubBuffer_Connect CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease NdrDllUnregisterProxy NdrDllRegisterProxy NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject CStdStubBuffer_AddRef

oleaut32

BSTR_UserSize BSTR_UserMarshal BSTR_UserUnmarshal BSTR_UserFree

$_2_/QQVipDownloader.exe

IMPHASH 76ae033ee18616f9c4fa679c0adcdd07
SHA256 e997d69e9649210f79167f2a8501196ac2a62a23944b5d0d39b1e9bd7e3b774f
MD5 65dbfaf76be7baf0369e1a202f8499cc
SHA1 542dca77ea0f20b91b8ebac80e326686dd507c55
SHA512 0880bc2a3182708e3ac620f4028a85eb1683bda96f0246ea5751c9ad20c3ea2c1e9879751b4f57fea0ee16b41347a93be88ef0f87661583971204179b917b608
SSDEEP 12288:pDfAIZBLC7KNkg2BirPUTYLzD3zk2U5LZE+KGngCRyEi1QOCXSSY9p8s96+9AUys:pDfAIZBZkg2B4UsKKLEiGi9X0cAUSK6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

89:89:40:01:bd:5b:10:3a:de:ce:5b:96:9b:b6:37:76:a5:86:95:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Chains

Sep 3, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Serial Number

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 17, 2013 - Feb 16, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

583825

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\VipDownload\binD\QQVipDownloader.pdb

gdiplus

GdipCreateFontFamilyFromName GdipCreateSolidFill GdipDeleteFont GdipDeleteFontFamily GdipCreateFromHDC GdipDeleteBrush GdiplusStartup GdipCloneBrush GdipCreateFont GdipGetImageWidth GdipDisposeImage GdipGetImageHeight GdipAlloc GdipFree GdipCloneImage GdipCreateBitmapFromStream GdipBitmapUnlockBits GdipBitmapLockBits GdipDrawString

msimg32

AlphaBlend

comctl32

InitCommonControlsEx _TrackMouseEvent

curllib

curl_global_cleanup curl_global_init curl_easy_perform curl_easy_init curl_easy_cleanup curl_easy_setopt curl_version_info

kernel32

WriteFile FreeLibrary FlushFileBuffers GetVolumeInformationW CopyFileW FormatMessageW GetVersionExA lstrcmpW LoadLibraryA CompareStringW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW FreeResource InterlockedExchange CompareStringA LoadLibraryExW GetLocaleInfoW lstrcmpA EnumResourceLanguagesW GetVersion ConvertDefaultLocale GetThreadLocale lstrlenA GetModuleHandleA FindNextFileW FileTimeToSystemTime FileTimeToLocalFileTime TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree GlobalFlags LockFile UnlockFile SetEndOfFile GetFileTime GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent ExitProcess GetSystemTimeAsFileTime WriteConsoleW GetFileType GetStdHandle RaiseException RtlUnwind ExitThread HeapReAlloc VirtualProtect VirtualAlloc GetSystemInfo HeapSize FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetCurrentDirectoryA GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW CreateFileA SetStdHandle WriteConsoleA GetConsoleOutputCP GetDriveTypeA SetEnvironmentVariableA WaitForSingleObject ResetEvent SetEvent CreateEventA GetTickCount Sleep MulDiv LoadLibraryW lstrlenW LocalAlloc LocalFree SetFilePointer ReadFile GetLongPathNameW GetFileSize RemoveDirectoryW DeleteFileW CreateDirectoryW FindClose FindFirstFileW LeaveCriticalSection GlobalUnlock GlobalLock GetWindowsDirectoryW MultiByteToWideChar InterlockedIncrement InterlockedDecrement GetCurrentProcess SetUnhandledExceptionFilter WriteProcessMemory GetProcAddress SetErrorMode GetCurrentThreadId GetCurrentProcessId VirtualQuery GetProcessHeap HeapAlloc VirtualAllocEx ReadProcessMemory TerminateProcess WaitForMultipleObjects CreateProcessW SearchPathW DuplicateHandle CreateEventW EnterCriticalSection SuspendThread OpenThread Thread32Next Thread32First CreateToolhelp32Snapshot HeapFree GetSystemDirectoryW WideCharToMultiByte GetModuleHandleW DeleteCriticalSection InitializeCriticalSection GetDiskFreeSpaceExW OutputDebugStringW GetDriveTypeW CreateThread IsValidCodePage GetLogicalDriveStringsW WritePrivateProfileStringW GetLastError CreateMutexW SetLastError GetFileAttributesW lstrcpynW OutputDebugStringA GetCurrentThread GlobalFree GlobalAlloc GetModuleFileNameA GetModuleFileNameW CloseHandle DeviceIoControl CreateFileW GetPrivateProfileStringW GetPrivateProfileIntW SetThreadLocale GetVersionExW LockResource SizeofResource LoadResource FindResourceW InterlockedCompareExchange FormatMessageA GetLocalTime TerminateThread IsBadReadPtr GetFullPathNameW

user32

BeginPaint GrayStringW DrawTextExW TabbedTextOutW SetWindowContextHelpId MapDialogRect DestroyMenu CharNextW GetMessageW TranslateMessage ValidateRect IsDialogMessageW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem GetActiveWindow CreateDialogIndirectParamW IsWindowEnabled GetNextDlgTabItem EndDialog LoadIconW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus GetWindowTextW GetLastActivePopup DispatchMessageW GetTopWindow GetMessageTime GetMessagePos PeekMessageW MapWindowPoints UpdateWindow GetMenu GetClassInfoExW AdjustWindowRectEx GetParent SetWindowPlacement GetDlgCtrlID CallWindowProcW SystemParametersInfoA GetWindowPlacement GetWindow GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetDC CreateCaret InvalidateRect IsClipboardFormatAvailable HideCaret SetRectEmpty EqualRect SetCaretPos SystemParametersInfoW GetSysColor SetWindowsHookExW mouse_event UnhookWindowsHookEx CallNextHookEx SetActiveWindow SetWindowLongW AttachThreadInput UpdateLayeredWindow GetWindowThreadProcessId GetForegroundWindow GetWindowDC UnionRect ReleaseDC FillRect DrawTextW SetCursor SetCapture IsRectEmpty ReleaseCapture ClientToScreen IntersectRect GetKeyState SetForegroundWindow OffsetRect DrawIcon AppendMenuW GetSystemMenu PostQuitMessage FindWindowA GetWindowRect UnregisterClassW PostThreadMessageW MessageBeep GetNextDlgGroupItem CharUpperW GetSysColorBrush RegisterClipboardFormatW InvalidateRgn SetRect CopyAcceleratorTableW EndPaint GetWindowLongW LoadCursorW DefWindowProcW GetClientRect MoveWindow CopyRect GetDlgItemInt SetFocus SetDlgItemInt SendDlgItemMessageW GetSystemMetrics CreateWindowExW RegisterWindowMessageW DestroyWindow SetTimer ScreenToClient LoadImageW GetCursorPos MessageBoxW ShowWindow KillTimer IsIconic IsWindowVisible RegisterClassW GetClassInfoW GetDesktopWindow SendMessageW IsWindow FindWindowExW SetWindowTextW SetDlgItemTextW GetDlgItemTextW IsDlgButtonChecked CheckDlgButton GetDlgItem SetWindowPos PostMessageW EnableWindow PtInRect UnregisterClassA SendMessageTimeoutW ShowCaret

gdi32

SelectObject ExtSelectClipRgn CreateDIBSection DeleteObject BitBlt CreateRectRgnIndirect GetRgnBox GetMapMode GetWindowExtEx GetViewportExtEx ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape TextOutW RectVisible PtVisible StretchBlt CreateCompatibleDC GetObjectW GetStockObject CreateFontIndirectW SetMapMode RestoreDC SaveDC ExtTextOutW GetTextColor GetBkColor CreateBitmap SetBkColor GetClipBox GetDeviceCaps CreateSolidBrush GetTextExtentPoint32W SetTextColor SetBkMode DeleteDC

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegQueryValueW RegEnumKeyW RegSetValueExA RegCreateKeyA RegOpenKeyA RegQueryValueExA RegOpenKeyW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegDeleteKeyW AccessCheck MapGenericMask RevertToSelf OpenThreadToken ImpersonateSelf GetFileSecurityW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW Shell_NotifyIconW ShellExecuteW ShellExecuteExW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc SHBrowseForFolderW

shlwapi

wnsprintfW PathRemoveFileSpecW PathFileExistsW PathAppendW PathFindFileNameW PathFindExtensionW PathStripToRootW PathIsUNCW

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter StgCreateDocfile OleCreate OleInitialize OleUninitialize CoLoadLibrary CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CreateStreamOnHGlobal CoCreateInstance CoUninitialize CoInitializeEx CoCreateGuid CoInitialize CoTaskMemFree CoTaskMemAlloc StringFromCLSID CLSIDFromProgID CLSIDFromString CoFreeUnusedLibraries CoDisconnectObject CoRevokeClassObject OleIsCurrentClipboard CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream CoFreeLibrary OleFlushClipboard

oleaut32

LoadTypeLi SafeArrayDestroy OleCreateFontIndirect VariantInit SysStringLen VarBstrCmp SysAllocStringByteLen SysAllocString VariantChangeType VariantClear VariantCopy SysAllocStringLen SystemTimeToVariantTime VariantTimeToSystemTime VarBstrFromDate SysFreeString VarDateFromStr

imm32

ImmAssociateContext

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

riched20

ord4

netapi32

NetApiBufferFree Netbios NetWkstaTransportEnum

ws2_32

gethostbyname closesocket WSACleanup WSAStartup ioctlsocket setsockopt ntohs ntohl htonl recvfrom inet_addr htons sendto bind send recv connect listen WSAGetLastError getpeername accept inet_ntoa select __WSAFDIsSet socket

$_2_/Skin/SkinConfig.ini

SHA256 ff179b9e9b54c3787e56301039a5366478dbc78d9b35c3cba9d7e603e8fda728
MD5 b5fc61cd206621acfd95d433391a040e
SHA1 a883fd895ab1f85cf907f1526751249b27d72ff8
SHA512 7d4076df7b8b434460a4918e07e21a7761d96a80b3c9692dca645b3c534400f9ec01b74900d044cb56fa0247d251f52da5786dc9a0f0ff9f7cf1e7d9122d5aeb
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/ad_exit.png

SHA256 db84dc92115d92b231144859d08fc21fbf9202c3ab9025745688b69ec697d598
MD5 1b6e3932de54788c932e9179a45f8489
SHA1 b364d997f0883e6037ab5b46f2ec11bc9d61190d
SHA512 4a167ea9297cba4b61c3d811af27534cdfe1648613e349d9c856af6e4efc7d7f0d0e4a580415d7d015c52ad8d7d709029e348695ab01248e7526f8e69a601919
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/bk.png

SHA256 46d7f3ddfa293d729025206fad8921a09662adecc1c21e33e240d4d722ccaab5
MD5 2ba3a69dd2be0ee99799a5168064a0c8
SHA1 d29c07954e7e68dc1da81175c62fcbea4849dd66
SHA512 87dbe4daa7ac14ad6bd09d0370a973aa4e61bab76e2d066157314e5eac38e7f762bf8768c6a9c58d2186665d87a7f8c8d9d10389fc818e71c8cd5e32dfa09c44
SSDEEP 3072:IwJcQnM3klaoHMJDlkiamxjuOXWIz0OdWlefGRJxkdm5FKh4xso1C:IwJFM3k8omWiamxjuuzjdVGR//Tmo1C
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/btn_pause_task.png

SHA256 784e9ca146c9d562005b2642f208fb60f298965c2d0385609eb7188296205674
MD5 11e185373402208df9730c41ccf6e00f
SHA1 7aedca274d4ac0355acda8fee4337509e16b4ce9
SHA512 47cb336045a88a396d3f08aad33a659b1f949c1e06eb2bff3a0e2468c135d2d56ff6d82db024b35fb1ef3271b7b8c8d19cde3a071ac6d24e5f27b09ac41bebed
SSDEEP 192:FPSHIIHUCD4waMCFEFmGuuhy+/wZ0z/HksGiSqBhYz33RxDkHAyKr:450wNCumGPwq/EdiSqBo3nkgZr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/btn_resume_task.png

SHA256 6f5f444ab68c09046b88ea7f79108e7fc7b9b9100f549aefd4ef104a85cce9a3
MD5 8fb0f7a1f4430b476a8ffd1851c214d2
SHA1 02aabb66504546e60cd7ab574fb926e60ea50e3e
SHA512 e89af028b74a2a7864f29e158e8fb33be52b58a5e1fa4ec661401ce36b0ffa790ce4d85c89f43e9a19e228f4002e9b5bf4877bd52e06c0be6a66414fb8fb650d
SSDEEP 192:FPSHIIHUCD4wantUZJxaxUu6YDgmlcNU6QDCfDjQABLIxFgwy6bArShMj:450wraxUutlhCQABqvy6bA2hs
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/btn_retry_task.png

SHA256 7585972041acbe0e00dfb91f76d02ffbf3a6998e8439e1e78b45b901d13ec239
MD5 2aaed8865e7744c3411ea07e198230f4
SHA1 871dc6fd24d7542920b178ed4db9a4301376623d
SHA512 47af3617533be97921edd37c507442c9b50629cde7134632ecbb50533384dd876fc59df82677a51614ecf4c6dafd0347bb8d7e194442bb9828a6626336679cc4
SSDEEP 192:FPSHIIHUCD4wa6GoUwwpg+9Nhn/hEzbYKh60s7URKnM/4Dp7MD:450wmonumvlh60swRK5xU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/btn_setup.png

SHA256 dec8719ea000ef4a5a04db43398be0aecd55b615e3a2c499553b5c8ed64a34bb
MD5 ddd46a390b72cbd7bdfbd37c6f3621df
SHA1 508bc693ab224f0c9b672314d6dc71bd26b7bf77
SHA512 97892580ea36eda1279d4ec5df34d7db39a9b43bc72d1dfc9b76df9313c08f55d6ed97012540bcb95baefcb421023542659001b1cf05b40fdeaf51e4ab299c56
SSDEEP 384:K50wBHQmYSFdDoq2yMEJ0UliyIdtihUNFGoN2OjtH:ArwgkmpqtihUN0ajN
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/btn_start_task.png

SHA256 f4f38ab0bff198d04b815fa6f7c767c600ff04f6f15354a1e1bfa54f0e2c5de4
MD5 c713ed3425559a814f307219d8bbb0e8
SHA1 3172f371e7e0c3524a00f8eca6173dcd40b6be7c
SHA512 14811f10d30b911d651ec9333271bdc289e57c99c030e06957942301d3330451f945cd0d3a87dfd71d08cb50c5b9612618088a907c9c7efa1e1ede375fde8b33
SSDEEP 384:K50wwnuqg6mHqRYbSTGGMrFo8LNX3VOKxBCVAeCXX0:Auuqgtyic8LNX3fxvO
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/btn_topspeed.png

SHA256 e63984cf41dd5e6463d453be0c6e1777082f9f9002187535b50afa717d0fc2bd
MD5 aa5fd04334398b12c9079557b1711158
SHA1 d4708cf29af1eedafaf56c1892a70af48847f81a
SHA512 6b04319707842d8e728d444143214312b73b9fbbfec4130f0528325f21d998381424040aa210d2b295713a8296d0e10a47329be1a8b7e8bdd13c129d2bdae3f8
SSDEEP 384:K50wY7n+2Ih7rqLajKUM7k4JSU2MSL63BW4vaqb1:A0n+nJrqLajw7NgU29O7aqb1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/close.png

SHA256 307e527d1d1c0dc5b71184a6a35a6fe9cd6c9417032adc237ee813e79762bfb6
MD5 7abcdd5eee9a27dbee2b1d6be2c80459
SHA1 25458e868ea6e1d768514b09a56e1f1e31e0a65c
SHA512 36ece3e5c1b8b3e4edf7316a4e9b32ae7716605a2c3e7a9edf7a0d0e96fd5c0b15c37b81f3220a944e59d347c5f8d7636c6a80550ff934b1448defcd74b0077e
SSDEEP 96:dSMllcHitlIxv9vk7C1+I4wWHLihk/x5oQXQsAuiZZuh:dSHIIHUCD4waI0piZZW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/dlg_bk.png

SHA256 116201d0999484f5c48b78478539efb7a1b4d411e058ece8d154996cc14764a0
MD5 e3e8a170f06334f232e2d81363665e12
SHA1 1d536af32216652a9209af41ad077b11a9d96e17
SHA512 37ef15880fe8b17dc77c0668741152d237b4283e68e16f33b29d4d6632726153f0e31aa3db57c2e3ae477f1e602f2770dc3d4981107c567f1bbd78d527f67aae
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/dlg_bk_about.png

SHA256 b83183e4c52b381a1bb044bc844ed781a59fe8b89be35a15f0b0fb44ea6b9373
MD5 db36d457b3d4946e49bab1117f8707af
SHA1 eec96f65627ba91c3136321a57b1badd6a4758dc
SHA512 dd40fbc86833973d9d5e1d2d3cdaeab0eef1fbf916bcab9eb7c68f943a39b909148db521e614e4a5c97c28e2541e13d3e7224bbf47d64e925a09cc223ddb4620
SSDEEP 192:x+vazps6mDKbMAHDpkeXU1D2T8JM7UvHFtQbsf43yid5onPOYqV:OWKlubfDpq/iuFebYidiP4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/dlg_bk_login.png

SHA256 b7621372d7e88c65f2000fdecb6f30538e0e5a56763a9237a2e9dc59e7c1b96c
MD5 53c9ed156869f16c0b2963f4d852c2be
SHA1 0f14912c6ac78443b464dd1f522f0f9501e14538
SHA512 2ce480bc80cd0050152fc333db3ce91297872c4a07539bd475a386b64187634851ee2f83f450fb097c76458229de41e7f8300624d48251b4ad43b21384b36ba5
SSDEEP 192:RcQ9eeavo8vaxt7jXqWaDV5I+DEZmhqv0JD3Tvy9LagGeqw4V:WQ97a/avaW2Do8juegj2V
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/dlg_btn.png

SHA256 66784220ce9c45e15062b5cc9f72f74fa1a3426a05ac29d34adf4d35f6cd4264
MD5 38ff55fc0474135545f2ed597b4fb0a3
SHA1 efddd42cb859d9e78d3520423299c93b6da26b2e
SHA512 6b8d16463e4370aef07f0d0e6236e18b437a3d3728262bea2443337dee466c73d182e51e4e923d0570e20307ce2ae175b89b84448a5448bc1212e63a94c88484
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/dlg_checkbox_off.png

SHA256 ceecb012b81858644bc32772f55714a2d7cd203a3d279f91cc5de79047d89cbd
MD5 91a2fcb133ad471d5824d14146037ad1
SHA1 4089801c5b918de78415cadc83bb89bb0a3ec812
SHA512 a4367fca2dd328c3ed0e60fed5de60b9121db2c3dd9f855871a5112e4b5bfae0d6cdd5b2bca1cb16e3a8e629510a4a73d20a0f683823f8cd7e5ab0ac391998bd
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/dlg_checkbox_on.png

SHA256 13d40a3568ec7248771c42b213100abecfc1f629e531af3bbdc5d9acb97dbc3f
MD5 58d9819c3e240cc9e40aec74ed61dcf7
SHA1 cd44a739cc7e4fdd485299136bb6b9d96f56b030
SHA512 a13db542bf22e37dd7f469ae1c3b0f8849d09b00003f304d6bda7d4f6b228eb7fda3781fdc3c598dd5f34a5cfc15bd673e2d0c26c5489e127bc31509aa94a851
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/dlg_close.png

SHA256 cc257d96a70f5cd88d5010131cd2efd07a024cbaa91916a8bb6313d7cc068feb
MD5 bf7de6ee2c4e0d5375f487640edd6dfa
SHA1 344d1f7342f332acea299a73f411a5624a201102
SHA512 82d0d4926913c409c1144e8ed5e6c7460c482bd1ffcacd200369c64efcec35ebeba8dc5370c01dedeef3d012a83225d67a8ea238e3e6e9c561c3fe1da903836f
SSDEEP 96:SSMllcHitlIxv9vk7C1+I4wWHLihk/xe2zMMmeHWqO:SSHIIHUCD4wa0wnI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/dlg_input.png

SHA256 da5436dbcb425318d073e63dfc9af3d4e61cb5c762460c5b591fa03e74efa462
MD5 43e461c7fc88f9e19bcbbd3d999bd96f
SHA1 8497e331e882d9837922fa04997b563d51d5aa59
SHA512 6a82925c79951b7bb90a8fff6e0874b4a322149cacb199dd04e5a9b5699528886f0089287e807b8d959261f91ca8ee5381c0c683b47f12e43a98cdbcc82ae5a4
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/dlg_open_vip.png

SHA256 f2f808e90ec7f5c1e37547de32cc0ee700d2cdf4c489f736f1c42bb1c79145a5
MD5 a5e35e0f62b9515d670ea9802d3eea96
SHA1 b45d8570922ae87a18efcab39058a7bfb866f264
SHA512 43e2a3bbc5b2d79b5649c382fb369a2f5c6b7f44c0853e0a7bf06880337c3b1a9353d8921cedb8c37372509a7afdc38d7e2816a53248f5a36fa157776d6fb017
SSDEEP 192:syDfZi+gxa07DMsCakDX8Gt15mOKgbtGm5J8t:syJJ07AsCCGGw5Ot
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/file_path_input.png

SHA256 a174c337b30437ee798ab264a190960d388267728739f3d1bed04d24c3ffc6c6
MD5 ede0b5c5471a142968e340b5af2b9c17
SHA1 9bb363603f7967424b25015f3fb499193f82bac1
SHA512 4db53aaf54e3cbbdab166276538b3d7eb42cfe9a8b3dabc3ea46dbcf7fb161d4a100dd2bbd877051db4dfb54c9bfb3d92c3245b579793052ddaba225e4f0c2cb
SSDEEP 96:fSMllcHitlIxv9vk7C1+I4wWHLihk/xl0XCn5W24u/l:fSHIIHUCD4wariEWCN
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/gift_box.png

SHA256 22a5298fbe9f24946d83d7710e899d15b3c5d0af787208900e328746489d38f9
MD5 f5157b28fa71f359624f6168caf68f08
SHA1 34a07683cad277732a9cb3af6d6c745b747b9c47
SHA512 f25df5946c33d902e06f4d7d1ec44869f90ec5c41fda49395c1ebf9dccca0482bc595987f5253904552ed454932611b9e6b449d45add04eb7a3e1f730c5837c0
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/gift_tip_bk.png

SHA256 4974f4488dd7e08ca1c72a0b4fcdcfb33d0dc668df9de5062cfd632833f7e70a
MD5 7254e0b5d1bad062dc41818d70f3d45a
SHA1 7d0263d4925dc8a2c210f8316ead8410ef67d8a1
SHA512 352a61ec80128a0ca2551c1799a1f9bf6960fadca9fab0929846e9aaadecf63100ade0160b6eb67533b406fce22352d060bc875e1532c00e1413f9675e6572dd
SSDEEP 384:btaJcdcdEWe09QKm/3v1HgTfrvHhrIIPRIrm/CDwyJIV1/Ca4XoS8APlFX966b:bcJc3h09JmfviXvBMvi/CPRdXokPlm6b
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/gift_tip_get.png

SHA256 4202927efb3cf7d837ea86ee5b2b8ac67aded7b4b0a1f43dc1b44b3f4db3447d
MD5 8e2368a15b44e3a7a00425d407809578
SHA1 029c489e66b32461f8ac8687f066ba1dcabea89e
SHA512 03658c47543b6b7ffa82022ba91621e3e8a5aeb23e4a6c875775ca75d9d91d035577d55c3882665f6f5168a8b4b56be4dcd7f507e6d219010df76160f3f40828
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/icon_path.png

SHA256 6eeabb69a9bbb476320cba23c087814779d4cb9bf546474aab652978b08b8154
MD5 fcb0e233e9ded5104af8a055e2361239
SHA1 35646cfc861bb52645778560f8279b1cb88c9017
SHA512 edf2f601bf59cb3ee5b5e234d6b1fbd8c79c54c94557744071e97a81b37a58e112c92deab6fcfb7c936980674ae76cb1904996c57ced509ab7ae3225200b3147
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/icon_success.png

SHA256 c7aa76050ad40d6d7eed552f5d93d7912db83a4f10a2d7c2ab5412ce0e40ee76
MD5 d1a7f07c7725bc8072a2411b25b67e5f
SHA1 ea6b88f027af2a83e4a8f6985db066fba68a411f
SHA512 a02e637b62277cfe8c76a7c879aa1ee8ac8a7be8f365752b50869a77159fc1f19009ae4f8d0cb990241370646e34f0194cc4599b475800b534cb97b7c37b45b1
SSDEEP 96:SSMllcHitlIxv9vk7C1+I4wWHLihk/xl4D+sAeDgsC/I+72lAcJ2RDSbr:SSHIIHUCD4wa0D+7I+aH2OX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/list_bk.png

SHA256 b7c3a10e366a2bf46310abb466dcbbc330f074dba71997eb7a3856051d3dfeed
MD5 9d14ab636d968deeac502ca2fcf6fe4d
SHA1 c858d389c2b1e07377be762fba5a82fdb4b71330
SHA512 3c13430e5d5c70afc339236f886526709a06595b2a7d2cf066125a761ba872825763bc5622f0789859f490d7e28f9294c4c3f24d41aef2eac6f6db581cfec4aa
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/menu_bk.png

SHA256 4a7c0312c2971ed08adf6d070390b68cf838c903af077961c8ebd865b864497f
MD5 b7487b4032c8aab9b41a2df07649b684
SHA1 52bcee90b2d37580b2fb63e6bcb5f8fd49213be5
SHA512 37cd565ac248457ca475070a8b1ec7df3a4f90eb751c13a7220f6823b2d64d2ae0a0687e4116407bf96c6c9aa4eb593589e13f7e3a4631c418f8e27a166a7896
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/menu_hilight.png

SHA256 4e35e65654905b54cb542266607b5f73a88018d6dbf951b5588bc2ce531cad85
MD5 87b3a6f0a87aded28792a6bccccf2d24
SHA1 3c19ffa150b367b64767729eebd7721221593581
SHA512 d4a0af6e0ba1888a82603b6307f78740d04ce07a172ef3e7885cb4408aeee656de28dc04840f6dc51fcfcbe1cb39ab4f24bc805eab5323b1a6979d5aea4f6c8e
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/menu_seperator.png

SHA256 33d4ced0ee0b7ea09fee981d16025e9b24f2b5db05404a67df78493b34607ac5
MD5 9b0dd202e90b9d172279feeb9c801ca0
SHA1 2d95e9ec56eff71fb1505e6e851b56af021daf13
SHA512 1f1bdc096c3635891c17d0c9458b7a9a950785737f58690766fceb1e114258ac7c0a5c97536dfab20c2ca816ec9035d00235d847f5b96e2d4fd7f823540746e2
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/min.png

SHA256 f664131f8414985afb7f643d0e0620fd159837ba97102522f9551d1ecc18f2dc
MD5 6552695d4ba2e580dca7079c5a4fbb41
SHA1 4ed6f2f05b6b1bbc2e0269f2db3ab2ef2fa72383
SHA512 9e2724592a1f830f0c0ad126b04d55421b19bbf4bd7d80b75e02728232d918a22eba7ddf5b8e05553a2a4924ee3f96340c29cfefe55edeeb21dc34ce8584b716
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/progress_bk.png

SHA256 a174c337b30437ee798ab264a190960d388267728739f3d1bed04d24c3ffc6c6
MD5 ede0b5c5471a142968e340b5af2b9c17
SHA1 9bb363603f7967424b25015f3fb499193f82bac1
SHA512 4db53aaf54e3cbbdab166276538b3d7eb42cfe9a8b3dabc3ea46dbcf7fb161d4a100dd2bbd877051db4dfb54c9bfb3d92c3245b579793052ddaba225e4f0c2cb
SSDEEP 96:fSMllcHitlIxv9vk7C1+I4wWHLihk/xl0XCn5W24u/l:fSHIIHUCD4wariEWCN
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/progress_fg.png

SHA256 6bfbc506a80894f8d028b8bf67a2b44f026b5645398eb6b9a44735b89ed5ec97
MD5 55b09e49fab9e2132e041d730e5ca39c
SHA1 0b5d32069489ebbd13afe00a51223919a5b98ce9
SHA512 03858665cd27ba3ea49f9004b9104fd88755ac260a8f19d8f05b95a87dd5f5b26ee1330a26c356422cc164048a246a1439c716f9a446734d90b8cde435955f44
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/setting.png

SHA256 34947745baeb6277146b49e1697906f748f57dc98f694f02868e6c770c85067b
MD5 d3fcb0f81262fa3d4837cebd0a5d63f1
SHA1 b32ae9c2ebf17ddd7ffd86e73d7a531282c80976
SHA512 2092a5917659f868c61effeda0cf2490f9789d4db169d74f1cf8d8903413c71d1664d0b8787022568fdf30b546e3a4d08b5e5c98090369bf4573cac022ea550d
SSDEEP 96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xE62avmwc/1aerRZr/HHYoHn/:dSHIIHUCD4wa0apKVrRxHHln/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/tips_bk.png

SHA256 44c5c55fc8aa8f55c0ecde908b9004fa24c276961a0610b9c9a1eac5abc72f95
MD5 55a29098819101c6411e04105a631a28
SHA1 99bdab4990d01fd07a889a4ac1865787b2f5d862
SHA512 90fa7a45ad4873b2f2e05d3f2674ed16cbe4bd69797fb16360df3dde2db980f8eefda21052362b248d9934147743ec4183a76b1e60e10fa9707cdcee473decd0
SSDEEP 96:vQbuosMBuDVMpX4vy/Z9lKSuxqRmF4cd+9/zj4zCjNlqsj+dSNlAF+DwE02:vIBuxKX4K/DSxQmF4cdGVWsOSzAkB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/tips_game_acc.png

SHA256 cb51b647fde8d59dea70969a4693342f0c4e616c6207b19d69e43a02f7143e5f
MD5 59cc401a92ecaefb639787b2ffa32401
SHA1 4362fb094274a3278c9ed09d31068e6694285539
SHA512 c31f9bd8e7ec92bb415954a0bff1a738f9d2423c8e56d331760c0dbedd6a4f799f747f2703c1bee2a4b21c6d4daad5b5c1472e9fd9fe1c7c3626ccd16d29b9c9
SSDEEP 3072:mSBhj7anxhAzvObyAM+WenmHnwiwgUn6zK:V8Mz+WWmHwwA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/Skin/tips_vip.png

SHA256 cb28a574bdf7739625e9514de5a29284fcb753e4dd3cade4a802b22f33c83bd8
MD5 698f0f6b3ac7d59f4a2b1e79816ca43c
SHA1 dc669ba45a22f13bc88d35c83add403a9e9a1de0
SHA512 888d2a84d594f19138261e80936d201500612db16a82bf6709338cc3755df23a62b022b04e57448ad80501dc6393b8802961a5f8c230a53b540350beaa1a6d47
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/vip_off.png

SHA256 ae8cd06e107bf8e5579893f1b55829cc9d8ca7a6ef4b1981e10014b88688b78d
MD5 8db07a573e81b698ee336ea4ec67e06e
SHA1 578b2efd89de40a229dccf7cf9c460f617c4505e
SHA512 fb3d582d2e6d3027e0463ff408195f9498bfbf1148860f7b623052c879eddb5f22adf9ddf04b1c19b07dbf2829815842ebcba1a17526025e4e15fb3eb7f04a1c
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/vip_on.png

SHA256 cfa5ba9ef927dba66789395cc05ec1646e614d90b36e581bc739cfa3ce53fce2
MD5 7c13a8470cdbe34b231c67acec7b5b97
SHA1 a0e7d2fd4d5cae5bc779e1849355a02c3d045c15
SHA512 a88ace3372f42b3f840874227358c9cdbf390a262fe9b68777f6e033478ff0f968bc0622ce4b0b7b84c25a4749d3c2416dfa51c3112cb55a0e3834cae7c8348d
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/Skin/vipdl.ico

SHA256 41b78db81a97aee638f799f8b2e15bb6ed0367485724bd28643a0581db058036
MD5 03a936b0ce979d64726961891b40120d
SHA1 1f8c234ba765e016dc4dcab5249756800ee975bf
SHA512 d1ac63680f52838d25f1e46c0bb1da0d17c557d0a4f5eeb15ccc0fb1a871f978be4936f59e4bf9398edbd5a11888cd24b07dfecec937198428965a89eb773755
SSDEEP 384:IArc7X4frdjOsxwmimMlMefR9uazT7tvcbw2GjYO91y+J9lEPFOwADBsKw7pMk:IIpoFlJfRog/tysxZJ9+/cGKwp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_2_/SkinConfig.ini

SHA256 ff179b9e9b54c3787e56301039a5366478dbc78d9b35c3cba9d7e603e8fda728
MD5 b5fc61cd206621acfd95d433391a040e
SHA1 a883fd895ab1f85cf907f1526751249b27d72ff8
SHA512 7d4076df7b8b434460a4918e07e21a7761d96a80b3c9692dca645b3c534400f9ec01b74900d044cb56fa0247d251f52da5786dc9a0f0ff9f7cf1e7d9122d5aeb
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/TXSSOSetup.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 8aa5ad11255f7526bd924a14b2ad0f4511ec2abf9f80abc5d2ac3d147490088a
MD5 e9756141d085d3b332014d7f9b184480
SHA1 7527574eb3b415744815ec4c51ae423ee58494e7
SHA512 20f6c37ca83d4fe3cc34fe0018d184447ec2c2c990930601eeb9e5f29e8da4cc1b172894deada85d0bdcbb7bb09e907a757aa2932aaaea46fa5ed19444a0a439
SSDEEP 24576:PBKYYrcWwGWZBxY/7jeN9B8dz8w47dywfUKIKvyqNJvbqaEaJe:2oWwG+Bx28odYy4UKl0dge
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

3c:f0:ca:9e:2d:08:c3:ca:66:df:5d:7f:7a:83:7c:8a:46:e3:14:f6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Chains

Jan 25, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Sep 30, 2010 - Jan 1, 2014

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Serial Number

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 17, 2013 - Feb 16, 2016

Minor OS version

0

Major OS version

5

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_2_/Tencentdl.exe

IMPHASH 555485ed0b309686c90411861f6dfd07
SHA256 fcaf44a74ec98e9780ddded45729dab1dc292c3a1bfed1c1a7ce56f1fed9b604
MD5 7e8dfc56349967d134ccdc9de4cd772f
SHA1 80f9636e5f2b7509d50e3e865b5c0d921348fff0
SHA512 b25fa86519cc23157f253ab816e8f8dfab54c5eddb72ec2092ece5b33767131f2ebdb4c791a2e28688c3bbbddc0db1e34d046f309592f95bf4665f5f12617010
SSDEEP 12288:4QcPCATq82+oqwBPeOzXcYdQ05l2NAmTq5RAPeK17b163XfP6P:4QcToqsiYNl2NApvB0n163XfPo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d3:fa:42:73:98:ab:d6:e2:bb:30:0c:84:75:74:ce:ab:9e:20:9d:65

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Chains

May 19, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Serial Number

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 17, 2013 - Feb 16, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

513739

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\src\tencentdl\Tencentdl_v127\Output\Release\Tencentdl.pdb

wininet

HttpEndRequestW InternetWriteFile HttpSendRequestExW HttpAddRequestHeadersW HttpOpenRequestW InternetConnectW InternetCloseHandle InternetOpenW HttpQueryInfoW

kernel32

FindNextFileW FindFirstFileW HeapFree GetProcessHeap InitializeCriticalSectionAndSpinCount TlsGetValue TlsSetValue SetWaitableTimer OutputDebugStringA PostQueuedCompletionStatus HeapAlloc QueueUserAPC TerminateThread WaitForMultipleObjects GetQueuedCompletionStatus CreateIoCompletionPort SetLastError InterlockedCompareExchange FlushInstructionCache GetCurrentProcess GetSystemTimeAsFileTime GetTickCount SleepEx CreateEventW CreateWaitableTimerW DeleteFileW lstrcpynW OpenProcess CreateToolhelp32Snapshot CopyFileW Sleep CreateThread GetCommandLineW LoadLibraryW GetVersionExW lstrlenA DeviceIoControl CreateFileW RemoveDirectoryW SetFileAttributesW MoveFileW GetFileSize FlushFileBuffers WriteFile ReadFile SetFilePointer WideCharToMultiByte GetLocalTime ResetEvent ReleaseSemaphore CreateSemaphoreW WritePrivateProfileStringW GetPrivateProfileIntW lstrcmpW RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc VirtualProtect VirtualAlloc FindClose GetSystemInfo VirtualQuery ExitThread FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW CreateDirectoryW GetVersionExA GetStartupInfoW GetStdHandle GetModuleFileNameA HeapDestroy HeapCreate VirtualFree HeapSize TlsAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetFullPathNameW GetCurrentDirectoryA SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA QueryPerformanceCounter GetCurrentProcessId LoadLibraryA GetLocaleInfoA GetLocaleInfoW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode GetTimeZoneInformation SetStdHandle CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetDriveTypeA SetEndOfFile CompareStringA CompareStringW SetEnvironmentVariableA ResumeThread SetThreadPriority GetModuleHandleA InterlockedExchangeAdd GetCurrentThreadId SetEvent SetFileTime SearchPathW Thread32Next Thread32First SuspendThread OpenThread CreateProcessW DuplicateHandle WriteProcessMemory VirtualAllocEx SetErrorMode WaitForSingleObject CreateEventA LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary GetModuleFileNameW TlsFree InterlockedExchange CloseHandle lstrcmpiW GetLastError IsProcessorFeaturePresent GetThreadLocale OpenEventA SystemTimeToFileTime CreateWaitableTimerA LocalFree FormatMessageA DeleteCriticalSection InitializeCriticalSection RaiseException LeaveCriticalSection EnterCriticalSection GetSystemDirectoryW GetModuleHandleW GetProcAddress InterlockedIncrement lstrlenW InterlockedDecrement GetFileAttributesW ExitProcess

user32

GetWindowTextW ReleaseCapture GetCapture WindowFromPoint LoadImageW GetCursorPos GetSubMenu GetIconInfo DestroyIcon TrackPopupMenu MonitorFromPoint GetMonitorInfoW GetSysColor LoadMenuW DrawIconEx GetLastActivePopup SetForegroundWindow LoadIconW ShowOwnedPopups IsWindowVisible InvalidateRect ClientToScreen BringWindowToTop MoveWindow GetWindow GetSystemMetrics EnableWindow ShowWindow wsprintfW DefWindowProcW CallWindowProcW GetParent MapWindowPoints DestroyMenu SystemParametersInfoW SetRect PtInRect CreateWindowExW GetMessageW DispatchMessageW TranslateMessage CharUpperW CreateDialogParamW PostThreadMessageW CharNextW SetWindowPos SendMessageW IsWindow DestroyWindow EndDialog LoadBitmapW DrawTextW GetWindowLongW SetWindowLongW RedrawWindow FindWindowW GetWindowRect LoadStringW DialogBoxParamW GetActiveWindow IsIconic GetDlgItem GetClientRect PostMessageW UnregisterClassA SetWindowTextW

gdi32

DeleteObject CreateFontW GetObjectW ExtTextOutW SetBkColor CreateCompatibleBitmap SaveDC RestoreDC SelectObject SetBkMode DeleteDC CreateSolidBrush SetTextColor BitBlt CreateCompatibleDC StretchBlt

advapi32

RegQueryValueExW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW IsTextUnicode RegOpenKeyW FreeSid CheckTokenMembership AllocateAndInitializeSid RegQueryValueExA RegOpenKeyExA RegQueryInfoKeyW

shell32

SHGetFileInfoW ShellExecuteW SHGetSpecialFolderPathW CommandLineToArgvW Shell_NotifyIconW

ole32

CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree CoTaskMemRealloc CoRevokeClassObject StringFromGUID2 CoRegisterClassObject StringFromCLSID CLSIDFromProgID CoCreateGuid CoFreeLibrary CoTaskMemAlloc CoLoadLibrary

oleaut32

LoadRegTypeLi LoadTypeLi VariantInit VariantClear VarUI4FromStr UnRegisterTypeLi RegisterTypeLi SysStringLen SysFreeString SysAllocStringByteLen SysAllocString

shlwapi

wnsprintfW PathFileExistsW

comctl32

_TrackMouseEvent

ws2_32

__WSAFDIsSet ntohs inet_ntoa accept getpeername WSAGetLastError listen connect recv send bind sendto socket recvfrom setsockopt ioctlsocket WSACleanup WSAStartup ntohl htonl getaddrinfo htons closesocket gethostbyname inet_addr select

imm32

ImmDisableIME

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

netapi32

NetApiBufferFree Netbios NetWkstaTransportEnum

psapi

GetModuleBaseNameW GetModuleFileNameExW EnumProcessModules

iphlpapi

GetAdaptersAddresses GetIpForwardTable GetAdaptersInfo

$_2_/VerConfig.ini

SHA256 9537cb075ceffc761989f0b5c4d5ee0745853d15eb93db678cfbb42965a330cf
MD5 342b2a65b76d6c09163b42e7872c0ebe
SHA1 3e5660f1eadf72bc62196de56d968d3a221b8206
SHA512 671b5141e2fb4805e6ba71addaa5d05d4f05e547dd9465ca8465571e6d38566e2b195a3dacf26378e6feac195c808cf1ad24577a8562e195ebb994a913c09b9a
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/bugreport.exe

IMPHASH 4b9f98c3cc39d350cf2d92c792f53ef4
SHA256 18a53e047d0536e49385177d00d526f252de98d5d04e58e057c7684f820788c2
MD5 cae77f70a1dbc517f1281403f0a68c1e
SHA1 96fdd9317aa6236ccd396dd469c46eda564326f2
SHA512 b33c4e3de966847e280fd827c39c0dfad1e65a7c24f28b7572eb35aca0c36fc0544eab3e34d5b80613543bf7c644a1b41dc3d7886e1b4923a93077ccadb2799c
SSDEEP 6144:mtpUeG1HPZRRYBmH43UDCVyTBqFtfGJOENMcDN7Y7t7q9:mfGfYBmHEaCVyTsFkTMcp7YJe9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

3c:e6:cc:0f:d1:cc:38:5a:5e:ae:ca:ce:82:4f:57:93:d8:f1:8b:71

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Chains

Apr 8, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Sep 30, 2010 - Jan 1, 2014

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Serial Number

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 17, 2013 - Feb 16, 2016

Minor OS version

0

Major OS version

4

Entry point

125754

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

j:\Code\SVN\QQ1.91\Output\PdbFinal\bugreport.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

dbghelp

SymGetModuleInfoW SymLoadModule SymInitialize SymSetOptions SymCleanup

wininet

InternetOpenA InternetCloseHandle InternetReadFile HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenUrlA

psapi

GetModuleFileNameExW GetModuleFileNameExA

comctl32

ImageList_Create ImageList_ReplaceIcon InitCommonControlsEx

tinyxml

?ToDocument@TiXmlDocument@@UAEPAV1@XZ ?ToDocument@TiXmlDocument@@UBEPBV1@XZ ?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ ?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ ?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ ?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ ?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ ?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ ??0TiXmlDocument@@QAE@XZ ?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ ?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ ?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ ?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ ?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ ?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ ?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z ?Value@TiXmlNode@@QBEPBDXZ ?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ ?GetText@TiXmlElement@@QBEPBDXZ ??1TiXmlDocument@@UAE@XZ ?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z ?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z ?Attribute@TiXmlElement@@QBEPBDPBD@Z ?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ

kernel32

HeapDestroy HeapReAlloc GetVersionExA InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale InterlockedCompareExchange GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapSize DeviceIoControl GetSystemTimeAsFileTime GetCurrentProcess GetProcessTimes QueryPerformanceCounter LeaveCriticalSection GetCommandLineW InitializeCriticalSection MoveFileW VirtualQuery SetFileAttributesW VirtualAlloc GetCurrentThreadId GetModuleHandleW HeapAlloc GetProcessHeap VirtualProtect CloseHandle HeapFree GetTickCount SetCurrentDirectoryW lstrcatW DeleteFileW CopyFileW LoadLibraryW FindFirstFileW GetExitCodeProcess FindNextFileW VirtualQueryEx TerminateProcess FindClose CreateFileA SetEvent lstrcpyW WaitForSingleObject CreateProcessW SizeofResource LockResource LoadResource FreeLibrary FindResourceExW OpenThread ReadProcessMemory FindResourceW WriteProcessMemory CreateThread OpenProcess GetLastError lstrlenW MultiByteToWideChar GlobalAlloc GlobalLock IsDBCSLeadByte GlobalUnlock GlobalFree InterlockedIncrement InterlockedDecrement Sleep WideCharToMultiByte FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime FreeResource CreateEventW ResumeThread CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateFileW WriteFile DeleteCriticalSection RaiseException GetTempPathW WritePrivateProfileStringW CreateDirectoryW GetVersionExW ReadFile SetFilePointer GetProcAddress GetFileSize GetModuleFileNameW GetPrivateProfileSectionW GetSystemDefaultLCID GetPrivateProfileIntW GetThreadSelectorEntry VirtualFree GetFileAttributesW GetCurrentProcessId EnterCriticalSection

user32

GetClassInfoExW DefWindowProcW IsWindow DestroyMenu TrackPopupMenu GetWindowThreadProcessId GetMenuItemCount CreatePopupMenu ReleaseDC ClientToScreen KillTimer BeginPaint GetSysColorBrush GetKeyState RegisterClassExW GetWindow CloseClipboard EnableWindow SetClipboardData SendDlgItemMessageW GetWindowTextW EmptyClipboard SetTimer GetWindowTextLengthW OpenClipboard RegisterClipboardFormatW CallWindowProcW InvalidateRect MapDialogRect GetWindowRect MapWindowPoints DrawTextW GetDC SetWindowLongW EndPaint GetDesktopWindow PostMessageW EndDialog DrawIconEx GetDlgItem GetClientRect ShowWindow LoadImageW SetWindowPos SetWindowTextW SendMessageW LoadIconW CreateWindowExW DestroyWindow UnregisterClassA SetDlgItemTextW DialogBoxParamW

gdi32

SetTextColor SetBkMode CreateFontW DeleteObject SelectObject GetStockObject

advapi32

RegQueryValueExW RegCloseKey RegDeleteValueW RegOpenKeyExW RegCreateKeyExW RegSetValueExW

shell32

ord155 SHBindToParent SHGetDesktopFolder ShellExecuteW SHGetFileInfoW SHGetSpecialFolderPathW ShellExecuteExW

ole32

CreateStreamOnHGlobal DoDragDrop OleUninitialize OleInitialize

oleaut32

SysStringLen SysFreeString SysAllocStringByteLen SysStringByteLen SysAllocString

gdiplus

GdipLoadImageFromStreamICM GdipImageSelectActiveFrame GdipGetPropertyItem GdipAlloc GdipFree GdiplusShutdown GdiplusStartup GdipCreateFromHDC GdipGetPropertyItemSize GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipDeleteGraphics GdipDisposeImage GdipCloneImage GdipDrawImageRectI GdipGetImageHeight GdipGetImageWidth

shlwapi

PathFileExistsW

msvcp80

??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z ?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z ?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z ??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z ??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z ??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z ??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z ??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z

msvcr80

wcschr _wcslwr_s ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ _mbschr wcsrchr memset wcscmp ??_V@YAXPAX@Z ??0exception@std@@QAE@ABV01@@Z ??0exception@std@@QAE@ABQBD@Z ??2@YAPAXI@Z _mbslwr_s _mbsstr _snprintf srand wcslen memcpy_s _purecall memmove_s ??3@YAXPAX@Z _vscwprintf _mbscmp vswprintf_s _vscprintf vsprintf_s free __argc __wargv wcsncmp swscanf _invalid_parameter_noinfo malloc memcpy ??0exception@std@@QAE@XZ _time32 strlen _wcsicmp memcmp iswspace strcmp strtoul fseek ftell fwrite fclose fprintf _lock wcscpy _encode_pointer __dllonexit _unlock wcscat _wfopen _onexit _decode_pointer ?terminate@@YAXXZ _amsg_exit strncpy_s tolower sprintf_s isalnum _wtoi _time64 memmove wcsncpy iswalnum iswalpha iswdigit _gmtime32 _snwprintf fread wcscat_s wcscpy_s strchr strncmp __wgetmainargs _cexit _exit _XcptFilter exit _wcmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler4_common _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ _invoke_watson _controlfp_s _beginthreadex wcsstr towlower strrchr atoi isspace __CxxFrameHandler3 _mbsicmp _CxxThrowException

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WinVerifyTrust WTHelperGetProvSignerFromChain

iphlpapi

GetAdaptersAddresses GetAdaptersInfo

netapi32

Netbios

$_2_/config.ini

SHA256 d8beb2ea287478581b565e22754fbe4614477ef343a856a95a50017e09909c29
MD5 95e1584f78364644b807a43f60f10dbc
SHA1 83407e6b710c0dae12d0fe6f65426843bfa3d615
SHA512 034736dddf79436c0ad7047375db86db63ecdfbb790fb1adfe1b63211b70391671e27cd70393e4790a301c8733312997113753979330a55714be85130f38f0af
MD5 SHA1 SHA512

NSIS installer

installer

$_2_/curllib.dll

IMPHASH e7e76bacda92f81d0eefd0a58978a370
SHA256 f79808272d03aa7a2e904438f97a63dee8d0d62fd4ed77709eb80ca3bdba6510
MD5 45882035d3e92e52b511c497432c0f80
SHA1 beebd03fafda345f2068c8892272d66bf7726ac2
SHA512 4a00a0d8d0dd4fa3774722c5dad647e86127f1a1abe83df7b80388c6ef1aa69089402fc12a06a3fc4f800335db5ca99345b8d75b584a2b467f9a43254c303817
SSDEEP 6144:8AGm5prJ+hxfZZmfrnY4LwKFWj6sd+xAI9:8AGm5/++rn3W+F
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

178887

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

recvfrom sendto send select __WSAFDIsSet ioctlsocket listen accept WSAStartup WSACleanup gethostname getservbyport gethostbyaddr getservbyname htonl inet_ntoa gethostbyname inet_addr WSASetLastError recv socket closesocket connect setsockopt getpeername getsockopt htons bind ntohs getsockname WSAGetLastError

wldap32

ord22 ord211 ord143 ord60 ord50 ord26 ord30 ord32 ord35 ord79 ord200 ord33 ord301 ord27 ord41 ord46

kernel32

GetStdHandle GetFileType WaitForMultipleObjects PeekNamedPipe ReadFile FormatMessageA GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter DisableThreadLibraryCalls IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange InterlockedExchange Sleep SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection ExpandEnvironmentStringsA WaitForSingleObject CloseHandle GetSystemDirectoryA LoadLibraryA GetProcAddress FreeLibrary GetLastError SleepEx GetTickCount

msvcr80

_malloc_crt tolower fseek __sys_nerr strerror fflush _gmtime64 fputc sprintf memmove memchr getenv _errno strstr _encoded_null _decode_pointer _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common _strdup _close _fileno _open _read _stricmp _encode_pointer strchr memcpy memset _time64 _strtoi64 strncmp strrchr strtol sscanf _strnicmp fclose fgets fopen __iob_func qsort fputs strcpy_s calloc free strncpy_s strtoul sprintf_s strcat_s islower isalpha isupper isdigit isprint isalnum isgraph isspace isxdigit _beginthreadex malloc realloc fwrite _fstat64 _lseeki64 _stat64 fread strncpy

$_2_/dlcore.dll

IMPHASH 84f24142cdc33b2e9b18677314bfa3cc
SHA256 ad1425b8497cf8b5891adbd51371c3ceb0f977e6e417b6c3f3262e6b6f01e2fc
MD5 0ed92ed82d4d1b22fe231c177b45eac5
SHA1 d858a692e6c0a364137c4d0190816809b8c37f7f
SHA512 8d7d60e84314ba2b5b1a9248e6ddf1f2723844ebde1953343ee5f825f1d3e30a5a9a504d028c9311f9aa82c17929c4927769b7ae6df986003b2c1aaef0be3aa1
SSDEEP 49152:JSGO70WM3G4HmQohT02dkqQsEhAtyhBFVTCzNG6TxD3mOXA:cf0WKGIQ0+QsDCO
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

74:71:58:2b:78:c8:62:e5:80:92:f0:b0:b9:75:37:41:ee:f7:a4:11

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Chains

May 19, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Serial Number

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 17, 2013 - Feb 16, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

1482934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\src\tencentdl\newcom_mini_127\output\binstatic\dlcore.pdb

ws2_32

select __WSAFDIsSet accept listen WSAStartup connect closesocket recv send inet_addr gethostbyname bind sendto setsockopt recvfrom socket inet_ntoa ntohl ntohs WSACleanup WSAAsyncGetHostByName WSACancelAsyncRequest gethostname getpeername ioctlsocket getservbyport gethostbyaddr getservbyname getsockopt getsockname WSAIoctl WSASetLastError WSAGetLastError htons htonl

kernel32

CloseHandle GetCurrentThreadId GetLocalTime GetModuleFileNameA GetModuleHandleA WideCharToMultiByte FindClose FindFirstFileW GetFileAttributesW CreateEventA SetEvent ResetEvent WaitForSingleObject DeleteFileW MultiByteToWideChar InterlockedDecrement lstrlenA InterlockedIncrement ReleaseSemaphore CreateSemaphoreA WaitForMultipleObjects TerminateThread MoveFileW CreateFileW CopyFileA GetDiskFreeSpaceExA GetLogicalDrives InterlockedExchange OpenMutexA GetLastError CreateMutexA ReleaseMutex CopyFileW FindNextFileW GetPrivateProfileStringW RemoveDirectoryW Process32Next Process32First CreateToolhelp32Snapshot GetProcessTimes OpenProcess lstrlenW RaiseException lstrcmpiA QueryPerformanceCounter Sleep GetModuleFileNameW IsDBCSLeadByte GetTickCount FreeLibrary SizeofResource LoadResource FindResourceA LoadLibraryExA SetThreadLocale GetThreadLocale GetVersionExA MoveFileA DeleteFileA GetCurrentProcessId GetSystemTimeAsFileTime GetCurrentProcess WriteFile SetFilePointer GetFileSizeEx CreateFileA FindFirstFileA GetProcAddress ReadFile VirtualQuery LoadLibraryA QueryPerformanceFrequency SetLastError FormatMessageA SleepEx GetSystemDirectoryA PeekNamedPipe GetFileType GetStdHandle ExpandEnvironmentStringsA OpenSemaphoreW LocalFree CreateFileMappingW OpenMutexW CreateEventW GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetACP GetLocaleInfoA InterlockedCompareExchange FindNextFileA SetFileAttributesA DeviceIoControl SetThreadPriority UnmapViewOfFile OutputDebugStringA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection MapViewOfFile TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SystemTimeToFileTime SetFilePointerEx GetVolumeInformationA SetEndOfFile GetModuleHandleExA CreateFileMappingA MapViewOfFileEx GetVolumeInformationW FlushFileBuffers GetFileSize GetTempPathA GetCurrentDirectoryA GetPrivateProfileIntW WritePrivateProfileStringW GlobalAlloc GlobalFree GetCurrentThread Module32First Module32Next

user32

ShowWindow wsprintfW UnregisterClassA IsIconic PostQuitMessage DefWindowProcA CreateWindowExA RegisterClassExA DispatchMessageA TranslateMessage GetMessageA CharNextA IsWindow PostMessageA SendMessageTimeoutA FindWindowA SendMessageA GetClassInfoExA

gdi32

GetStockObject

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges CryptGetHashParam CryptDestroyHash CryptReleaseContext CryptHashData CryptAcquireContextA CryptCreateHash RegQueryValueExA SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor IsTextUnicode RegCreateKeyA RegOpenKeyA GetFileSecurityW ImpersonateSelf OpenThreadToken RevertToSelf MapGenericMask AccessCheck RegEnumValueA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA

shell32

SHGetFolderPathA SHGetSpecialFolderPathW SHGetSpecialFolderPathA

ole32

CoFreeLibrary CoLoadLibrary CoInitialize CoCreateGuid CoUninitialize CoCreateInstance StringFromGUID2 CoTaskMemFree CoTaskMemRealloc OleRun CoTaskMemAlloc

oleaut32

SysFreeString UnRegisterTypeLi SysStringLen VarUI4FromStr VariantInit GetErrorInfo SafeArrayCreateVector SafeArrayCreate SafeArrayPutElement SafeArrayDestroy VariantCopy SysStringByteLen SysAllocStringByteLen VariantChangeType VariantClear LoadTypeLi SysAllocString RegisterTypeLi

shlwapi

PathRemoveExtensionA StrCmpW

psapi

GetProcessMemoryInfo

msvcr80

__clean_type_info_names_internal _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ __CppXcptFilter _adjust_fdiv ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??3@YAXPAX@Z strlen memcpy_s memmove_s ??_V@YAXPAX@Z free memset _time32 memcpy _invalid_parameter_noinfo ??2@YAPAXI@Z __CxxFrameHandler3 _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??0exception@std@@QAE@XZ ??0bad_cast@std@@QAE@PBD@Z ??1bad_cast@std@@UAE@XZ ??0bad_cast@std@@QAE@ABV01@@Z localeconv memchr strcspn sprintf_s rand srand _beginthreadex memcmp atoi strstr strncpy strrchr _purecall fclose fflush fwrite _vsnprintf_s wcslen strncpy_s isspace sscanf _stricmp fgetc fputc ungetc setvbuf tolower fgetpos fseek fsetpos _difftime32 _atoi64 ??8type_info@@QBE_NABV0@@Z _strtoi64 _strtoui64 _findclose _findnext32i64 _findfirst32i64 strcmp malloc _time64 calloc _recalloc _resetstkoflw strcpy_s wcsncpy_s strcat_s fprintf __iob_func strchr wcsrchr _vscwprintf vswprintf_s strncat _vscprintf vsprintf_s wcsncpy iswspace fopen atof fputs _snprintf fgets isalpha strncmp isalnum realloc strerror __sys_nerr _errno fread strtoul strtol isxdigit memmove qsort isdigit sprintf _fstat64 _lseeki64 getenv _gmtime64 _stat64 islower isupper isprint isgraph towlower _wstat32i64 _wmkdir _wsplitpath _wcsicmp wcscmp _close _read ?_open@@YAHPBDHH@Z swscanf_s _mbsnbcpy_s toupper _itoa __crtLCMapStringA __pctype_func ___lc_codepage_func ___lc_handle_func _calloc_crt ___mb_cur_max_l_func setlocale __uncaught_exception _invoke_watson _fsopen wcstombs_s _wfsopen _get_osplatform mbstowcs_s strtod __crtGetStringTypeW __crtLCMapStringW _create_locale _ui64toa_s _free_locale _malloc_crt ??0exception@std@@QAE@ABQBDH@Z _realloc_crt abort _Gettnames _Strftime _Getdays _Getmonths __crtCompareStringA ___lc_collate_cp_func __crtCompareStringW _strdup _write _open _strnicmp _endthreadex _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer ?terminate@@YAXXZ _except_handler4_common _encoded_null _initterm _initterm_e _amsg_exit

netapi32

NetWkstaTransportEnum NetApiBufferFree Netbios

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle InternetReadFile

wldap32

ord46 ord22 ord211 ord143 ord60 ord50 ord26 ord30 ord27 ord301 ord33 ord200 ord79 ord32 ord35 ord41

$_2_/extract.dll

IMPHASH 102033a12b8cf17a451a9e9760020138
SHA256 f2181e41d5950fcb762edf6b9cbb665e94004a7f1102b606c331690e6069a501
MD5 9da51d4506bd094fbfc7d337338fc872
SHA1 1b5799ef6b66ac9471842f17570813e7c42cdb27
SHA512 07dfae7c04ea2815ed78af9e29313050338bfec5a8e08a8846c0f846d6d27b79b7bfe2c3b4dbf3758aa22f88342aadf5513dcbcd6a718b9dd939996d6ce9e044
SSDEEP 6144:xR1C/1D8BnHgvH/5udZip+IUOrJTbSfvyux0egTK3:xDC/1D8BH0HBvUIUOrux0ege3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

67:aa:51:35:62:bb:5c:b1:19:94:ea:25:f5:78:37:54:5f:40:c7:2e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Chains

Nov 25, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Serial Number

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 26, 2010 - Jan 25, 2013

Minor OS version

0

Major OS version

4

Entry point

189865

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\vcoutput\Release\7z\Extract.pdb

kernel32

GetVersionExA MultiByteToWideChar WideCharToMultiByte GetLastError DeleteCriticalSection EnterCriticalSection LeaveCriticalSection QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId WaitForMultipleObjects VirtualAlloc VirtualFree GetProcAddress GetModuleHandleA CloseHandle WaitForSingleObject CreateEventA SetEvent ResetEvent CreateSemaphoreA ReleaseSemaphore InitializeCriticalSection SetCurrentDirectoryA AreFileApisANSI SetFileTime CreateFileW SetLastError SetFileAttributesA RemoveDirectoryA MoveFileA CreateDirectoryA DeleteFileA GetWindowsDirectoryA GetSystemDirectoryA GetWindowsDirectoryW GetSystemDirectoryW SetFileAttributesW RemoveDirectoryW MoveFileW CreateDirectoryW DeleteFileW GetShortPathNameA lstrlenA GetFullPathNameA GetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryW SearchPathA GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW GetFullPathNameW SearchPathW FindClose FindCloseChangeNotification FindFirstChangeNotificationA FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FindFirstChangeNotificationW GetLogicalDriveStringsA GetLogicalDriveStringsW GetFileSize SetFilePointer GetFileInformationByHandle ReadFile WriteFile SetEndOfFile CreateFileA CompareFileTime GetSystemInfo GlobalMemoryStatus DosDateTimeToFileTime FileTimeToDosDateTime SystemTimeToFileTime GetSystemTime CompareStringW CompareStringA GetTimeZoneInformation LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetLocaleInfoW GetLocaleInfoA LoadLibraryA RtlUnwind RaiseException HeapAlloc HeapFree ExitThread CreateThread GetCommandLineA GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement GetCurrentThread FatalAppExitA HeapReAlloc HeapDestroy HeapCreate ExitProcess GetStdHandle GetModuleFileNameA Sleep HeapSize SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage SetConsoleCtrlHandler FreeLibrary InterlockedExchange SetEnvironmentVariableA

user32

CharPrevA CharToOemA CharNextA CharLowerW CharUpperW CharLowerA CharUpperA CharPrevExA

oleaut32

VariantCopy SysFreeString VariantClear SysAllocString SysAllocStringByteLen

$_2_/tinyxml.dll

IMPHASH 2524407d3051eac98e4560fe35989f1a
SHA256 0460e9e03edf807453e66f0332c84a4f8ea8ace16e25b8c2e62abe12a6b7eebc
MD5 e42fb6e8b70cef85bfaae7cd0e716e21
SHA1 463a423283b5c22056cca0c2bcad1969194e69c2
SHA512 c30105e53c89756eab9d7c92d35e9934ece9ac9ecdec92cb56e63ffdf2b1ec3294dedc4942fd0dfae16367968f697786179534b9b0de7f2962e0c95a406a7056
SSDEEP 1536:R/ehBLJag+yYfuwjLPIGsvNY96EgQUx8J4LoNB4e0ee:REL4hfuwjLPIZNY96EgQU2fNB4eE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

56:18:19:61:2a:b2:1f:c0:51:61:f2:3d:26:d1:87:2c:4e:e0:15:1a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Chains

Apr 9, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Serial Number

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 17, 2013 - Feb 16, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

33737

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

R:\Code\HummerSDK_QQ5.2\Output\PdbFinal\tinyxml.pdb

kernel32

MultiByteToWideChar GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange GetSystemTimeAsFileTime

msvcr80

isalnum strncmp strchr memset ?terminate@@YAXXZ _encode_pointer _malloc_crt free _encoded_null _decode_pointer __iob_func isalpha _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook _except_handler4_common __clean_type_info_names_internal _unlock __dllonexit _lock _onexit fclose fseek ftell fread _vsnprintf_s atof atoi sscanf_s fprintf fputc ferror fopen _initterm_e _wfopen tolower isspace _purecall strcmp ??_V@YAXPAX@Z ??_U@YAPAXI@Z _wassert strlen memmove __CxxFrameHandler3 memcpy ??3@YAXPAX@Z ??2@YAPAXI@Z _initterm

msvcp80

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ

??0TiXmlAttribute@@QAE@PBD0@Z ??0TiXmlAttribute@@QAE@XZ ??0TiXmlAttributeSet@@QAE@XZ ??0TiXmlBase@@QAE@XZ ??0TiXmlComment@@QAE@ABV0@@Z ??0TiXmlComment@@QAE@PBD@Z ??0TiXmlComment@@QAE@XZ ??0TiXmlDeclaration@@QAE@ABV0@@Z ??0TiXmlDeclaration@@QAE@PBD00@Z ??0TiXmlDeclaration@@QAE@XZ ??0TiXmlDocument@@IAE@PBD@Z ??0TiXmlDocument@@QAE@ABV0@@Z ??0TiXmlDocument@@QAE@XZ ??0TiXmlElement@@QAE@ABV0@@Z ??0TiXmlElement@@QAE@PBD@Z ??0TiXmlNode@@IAE@W4NodeType@0@@Z ??0TiXmlPrinter@@QAE@ABV0@@Z ??0TiXmlPrinter@@QAE@XZ ??0TiXmlText@@QAE@ABV0@@Z ??0TiXmlText@@QAE@PBD@Z ??0TiXmlUnknown@@QAE@ABV0@@Z ??0TiXmlUnknown@@QAE@XZ ??1TiXmlAttribute@@UAE@XZ ??1TiXmlAttributeSet@@QAE@XZ ??1TiXmlBase@@UAE@XZ ??1TiXmlComment@@UAE@XZ ??1TiXmlDeclaration@@UAE@XZ ??1TiXmlDocument@@UAE@XZ ??1TiXmlElement@@UAE@XZ ??1TiXmlNode@@UAE@XZ ??1TiXmlPrinter@@UAE@XZ ??1TiXmlText@@UAE@XZ ??1TiXmlUnknown@@UAE@XZ ??4TiXmlComment@@QAEXABV0@@Z ??4TiXmlDeclaration@@QAEXABV0@@Z ??4TiXmlDocument@@QAEXABV0@@Z ??4TiXmlElement@@QAEXABV0@@Z ??4TiXmlPrinter@@QAEAAV0@ABV0@@Z ??4TiXmlText@@QAEXABV0@@Z ??4TiXmlUnknown@@QAEXABV0@@Z ??8TiXmlAttribute@@QBE_NABV0@@Z ??MTiXmlAttribute@@QBE_NABV0@@Z ??OTiXmlAttribute@@QBE_NABV0@@Z ??_7TiXmlAttribute@@6B@ ??_7TiXmlBase@@6B@ ??_7TiXmlComment@@6B@ ??_7TiXmlDeclaration@@6B@ ??_7TiXmlDocument@@6B@ ??_7TiXmlElement@@6B@ ??_7TiXmlNode@@6B@ ??_7TiXmlPrinter@@6B@ ??_7TiXmlText@@6B@ ??_7TiXmlUnknown@@6B@ ?Accept@TiXmlComment@@UBE_NPAVTiXmlVisitor@@@Z ?Accept@TiXmlDeclaration@@UBE_NPAVTiXmlVisitor@@@Z ?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z ?Accept@TiXmlElement@@UBE_NPAVTiXmlVisitor@@@Z ?Accept@TiXmlText@@UBE_NPAVTiXmlVisitor@@@Z ?Accept@TiXmlUnknown@@UBE_NPAVTiXmlVisitor@@@Z ?Add@TiXmlAttributeSet@@QAEXPAVTiXmlAttribute@@@Z ?Attribute@TiXmlElement@@QBEPBDPBD@Z ?Attribute@TiXmlElement@@QBEPBDPBDPAH@Z ?Attribute@TiXmlElement@@QBEPBDPBDPAN@Z ?Blank@TiXmlText@@IBE_NXZ ?CDATA@TiXmlText@@QBE_NXZ ?CStr@TiXmlPrinter@@QAEPBDXZ ?Clear@TiXmlNode@@QAEXXZ ?ClearError@TiXmlDocument@@QAEXXZ ?ClearThis@TiXmlElement@@IAEXXZ ?Clone@TiXmlComment@@UBEPAVTiXmlNode@@XZ ?Clone@TiXmlDeclaration@@UBEPAVTiXmlNode@@XZ ?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ ?Clone@TiXmlElement@@UBEPAVTiXmlNode@@XZ ?Clone@TiXmlText@@MBEPAVTiXmlNode@@XZ ?Clone@TiXmlUnknown@@UBEPAVTiXmlNode@@XZ ?Column@TiXmlBase@@QBEHXZ ?ConvertUTF32ToUTF8@TiXmlBase@@KAXKPADPAH@Z ?CopyTo@TiXmlComment@@IBEXPAV1@@Z ?CopyTo@TiXmlDeclaration@@IBEXPAV1@@Z ?CopyTo@TiXmlDocument@@ABEXPAV1@@Z ?CopyTo@TiXmlElement@@IBEXPAV1@@Z ?CopyTo@TiXmlNode@@IBEXPAV1@@Z ?CopyTo@TiXmlText@@IBEXPAV1@@Z ?CopyTo@TiXmlUnknown@@IBEXPAV1@@Z ?DoIndent@TiXmlPrinter@@AAEXXZ ?DoLineBreak@TiXmlPrinter@@AAEXXZ ?DoubleValue@TiXmlAttribute@@QBENXZ ?EncodeString@TiXmlBase@@SAXABVTiXmlString@@PAV2@@Z ?Encoding@TiXmlDeclaration@@QBEPBDXZ ?Error@TiXmlDocument@@QBE_NXZ ?ErrorCol@TiXmlDocument@@QBEHXZ ?ErrorDesc@TiXmlDocument@@QBEPBDXZ ?ErrorId@TiXmlDocument@@QBEHXZ ?ErrorRow@TiXmlDocument@@QBEHXZ ?Find@TiXmlAttributeSet@@QAEPAVTiXmlAttribute@@PBD@Z ?Find@TiXmlAttributeSet@@QBEPBVTiXmlAttribute@@PBD@Z ?First@TiXmlAttributeSet@@QAEPAVTiXmlAttribute@@XZ ?First@TiXmlAttributeSet@@QBEPBVTiXmlAttribute@@XZ ?FirstAttribute@TiXmlElement@@QAEPAVTiXmlAttribute@@XZ ?FirstAttribute@TiXmlElement@@QBEPBVTiXmlAttribute@@XZ ?FirstChild@TiXmlNode@@QAEPAV1@PBD@Z ?FirstChild@TiXmlNode@@QAEPAV1@XZ ?FirstChild@TiXmlNode@@QBEPBV1@PBD@Z ?FirstChild@TiXmlNode@@QBEPBV1@XZ ?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z ?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ ?FirstChildElement@TiXmlNode@@QBEPBVTiXmlElement@@PBD@Z ?FirstChildElement@TiXmlNode@@QBEPBVTiXmlElement@@XZ ?GetChar@TiXmlBase@@KAPBDPBDPADPAHW4TiXmlEncoding@@@Z ?GetDocument@TiXmlNode@@QAEPAVTiXmlDocument@@XZ ?GetDocument@TiXmlNode@@QBEPBVTiXmlDocument@@XZ ?GetEntity@TiXmlBase@@KAPBDPBDPADPAHW4TiXmlEncoding@@@Z ?GetText@TiXmlElement@@QBEPBDXZ ?GetUserData@TiXmlBase@@QAEPAXXZ ?GetUserData@TiXmlBase@@QBEPBXXZ ?Identify@TiXmlNode@@IAEPAV1@PBDW4TiXmlEncoding@@@Z ?Indent@TiXmlPrinter@@QAEPBDXZ ?InsertAfterChild@TiXmlNode@@QAEPAV1@PAV1@ABV1@@Z ?InsertBeforeChild@TiXmlNode@@QAEPAV1@PAV1@ABV1@@Z ?InsertEndChild@TiXmlNode@@QAEPAV1@ABV1@@Z ?IntValue@TiXmlAttribute@@QBEHXZ ?IsAlpha@TiXmlBase@@KAHEW4TiXmlEncoding@@@Z ?IsAlphaNum@TiXmlBase@@KAHEW4TiXmlEncoding@@@Z ?IsWhiteSpace@TiXmlBase@@KA_ND@Z ?IsWhiteSpace@TiXmlBase@@KA_NH@Z ?IsWhiteSpaceCondensed@TiXmlBase@@SA_NXZ ?IterateChildren@TiXmlNode@@QAEPAV1@PBDPBV1@@Z ?IterateChildren@TiXmlNode@@QAEPAV1@PBV1@@Z ?IterateChildren@TiXmlNode@@QBEPBV1@PBDPBV1@@Z ?IterateChildren@TiXmlNode@@QBEPBV1@PBV1@@Z ?Last@TiXmlAttributeSet@@QAEPAVTiXmlAttribute@@XZ ?Last@TiXmlAttributeSet@@QBEPBVTiXmlAttribute@@XZ ?LastAttribute@TiXmlElement@@QAEPAVTiXmlAttribute@@XZ ?LastAttribute@TiXmlElement@@QBEPBVTiXmlAttribute@@XZ ?LastChild@TiXmlNode@@QAEPAV1@PBD@Z ?LastChild@TiXmlNode@@QAEPAV1@XZ ?LastChild@TiXmlNode@@QBEPBV1@PBD@Z ?LastChild@TiXmlNode@@QBEPBV1@XZ ?LineBreak@TiXmlPrinter@@QAEPBDXZ ?LinkEndChild@TiXmlNode@@QAEPAV1@PAV1@@Z ?LoadFile@TiXmlDocument@@QAE_NPAU_iobuf@@W4TiXmlEncoding@@@Z ?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z ?LoadXML@TiXmlDocument@@QAE_NPADHW4TiXmlEncoding@@@Z ?Name@TiXmlAttribute@@QBEPBDXZ ?NameTStr@TiXmlAttribute@@QBEABVTiXmlString@@XZ ?Next@TiXmlAttribute@@QAEPAV1@XZ ?Next@TiXmlAttribute@@QBEPBV1@XZ ?NextSibling@TiXmlNode@@QAEPAV1@PBD@Z ?NextSibling@TiXmlNode@@QAEPAV1@XZ ?NextSibling@TiXmlNode@@QBEPBV1@PBD@Z ?NextSibling@TiXmlNode@@QBEPBV1@XZ ?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z ?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ ?NextSiblingElement@TiXmlNode@@QBEPBVTiXmlElement@@PBD@Z ?NextSiblingElement@TiXmlNode@@QBEPBVTiXmlElement@@XZ ?NoChildren@TiXmlNode@@QBE_NXZ ?Parent@TiXmlNode@@QAEPAV1@XZ ?Parent@TiXmlNode@@QBEPBV1@XZ ?Parse@TiXmlAttribute@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Parse@TiXmlComment@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Parse@TiXmlDeclaration@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Parse@TiXmlElement@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Parse@TiXmlText@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Parse@TiXmlUnknown@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Previous@TiXmlAttribute@@QAEPAV1@XZ ?Previous@TiXmlAttribute@@QBEPBV1@XZ ?PreviousSibling@TiXmlNode@@QAEPAV1@PBD@Z ?PreviousSibling@TiXmlNode@@QAEPAV1@XZ ?PreviousSibling@TiXmlNode@@QBEPBV1@PBD@Z ?PreviousSibling@TiXmlNode@@QBEPBV1@XZ ?Print@TiXmlAttribute@@QBEXPAU_iobuf@@HPAVTiXmlString@@@Z ?Print@TiXmlAttribute@@UBEXPAU_iobuf@@H@Z ?Print@TiXmlComment@@UBEXPAU_iobuf@@H@Z ?Print@TiXmlDeclaration@@UBEXPAU_iobuf@@H@Z ?Print@TiXmlDeclaration@@UBEXPAU_iobuf@@HPAVTiXmlString@@@Z ?Print@TiXmlDocument@@QBEXXZ ?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z ?Print@TiXmlElement@@UBEXPAU_iobuf@@H@Z ?Print@TiXmlText@@UBEXPAU_iobuf@@H@Z ?Print@TiXmlUnknown@@UBEXPAU_iobuf@@H@Z ?QueryDoubleAttribute@TiXmlElement@@QBEHPBDPAN@Z ?QueryDoubleValue@TiXmlAttribute@@QBEHPAN@Z ?QueryFloatAttribute@TiXmlElement@@QBEHPBDPAM@Z ?QueryIntAttribute@TiXmlElement@@QBEHPBDPAH@Z ?QueryIntValue@TiXmlAttribute@@QBEHPAH@Z ?ReadName@TiXmlBase@@KAPBDPBDPAVTiXmlString@@W4TiXmlEncoding@@@Z ?ReadText@TiXmlBase@@KAPBDPBDPAVTiXmlString@@_N02W4TiXmlEncoding@@@Z ?ReadValue@TiXmlElement@@IAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?Remove@TiXmlAttributeSet@@QAEXPAVTiXmlAttribute@@@Z ?RemoveAttribute@TiXmlElement@@QAEXPBD@Z ?RemoveChild@TiXmlNode@@QAE_NPAV1@@Z ?ReplaceChild@TiXmlNode@@QAEPAV1@PAV1@ABV1@@Z ?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ ?RootElement@TiXmlDocument@@QBEPBVTiXmlElement@@XZ ?Row@TiXmlBase@@QBEHXZ ?SaveFile@TiXmlDocument@@QBE_NPAU_iobuf@@@Z ?SaveFile@TiXmlDocument@@QBE_NPB_W@Z ?SetAttribute@TiXmlElement@@QAEXPBD0@Z ?SetAttribute@TiXmlElement@@QAEXPBDH@Z ?SetCDATA@TiXmlText@@QAEX_N@Z ?SetCondenseWhiteSpace@TiXmlBase@@SAX_N@Z ?SetDocument@TiXmlAttribute@@QAEXPAVTiXmlDocument@@@Z ?SetDoubleAttribute@TiXmlElement@@QAEXPBDN@Z ?SetDoubleValue@TiXmlAttribute@@QAEXN@Z ?SetError@TiXmlDocument@@QAEXHPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ?SetIndent@TiXmlPrinter@@QAEXPBD@Z ?SetIntValue@TiXmlAttribute@@QAEXH@Z ?SetLineBreak@TiXmlPrinter@@QAEXPBD@Z ?SetName@TiXmlAttribute@@QAEXPBD@Z ?SetStreamPrinting@TiXmlPrinter@@QAEXXZ ?SetTabSize@TiXmlDocument@@QAEXH@Z ?SetUserData@TiXmlBase@@QAEXPAX@Z ?SetValue@TiXmlAttribute@@QAEXPBD@Z ?SetValue@TiXmlNode@@QAEXPBD@Z ?Size@TiXmlPrinter@@QAEIXZ ?SkipWhiteSpace@TiXmlBase@@KAPBDPBDW4TiXmlEncoding@@@Z ?Standalone@TiXmlDeclaration@@QBEPBDXZ ?StringEqual@TiXmlBase@@KA_NPBD0_NW4TiXmlEncoding@@@Z ?TabSize@TiXmlDocument@@QBEHXZ ?ToComment@TiXmlComment@@UAEPAV1@XZ ?ToComment@TiXmlComment@@UBEPBV1@XZ ?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ ?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ ?ToDeclaration@TiXmlDeclaration@@UAEPAV1@XZ ?ToDeclaration@TiXmlDeclaration@@UBEPBV1@XZ ?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ ?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ ?ToDocument@TiXmlDocument@@UAEPAV1@XZ ?ToDocument@TiXmlDocument@@UBEPBV1@XZ ?ToDocument@TiXmlNode@@UAEPAVTiXmlDocument@@XZ ?ToDocument@TiXmlNode@@UBEPBVTiXmlDocument@@XZ ?ToElement@TiXmlElement@@UAEPAV1@XZ ?ToElement@TiXmlElement@@UBEPBV1@XZ ?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ ?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ ?ToLower@TiXmlBase@@KAHHW4TiXmlEncoding@@@Z ?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ ?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ ?ToText@TiXmlText@@UAEPAV1@XZ ?ToText@TiXmlText@@UBEPBV1@XZ ?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ ?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ ?ToUnknown@TiXmlUnknown@@UAEPAV1@XZ ?ToUnknown@TiXmlUnknown@@UBEPBV1@XZ ?Type@TiXmlNode@@QBEHXZ ?Value@TiXmlAttribute@@QBEPBDXZ ?Value@TiXmlNode@@QBEPBDXZ ?ValueTStr@TiXmlNode@@QBEABVTiXmlString@@XZ ?Version@TiXmlDeclaration@@QBEPBDXZ ?Visit@TiXmlPrinter@@UAE_NABVTiXmlComment@@@Z ?Visit@TiXmlPrinter@@UAE_NABVTiXmlDeclaration@@@Z ?Visit@TiXmlPrinter@@UAE_NABVTiXmlText@@@Z ?Visit@TiXmlPrinter@@UAE_NABVTiXmlUnknown@@@Z ?VisitEnter@TiXmlPrinter@@UAE_NABVTiXmlDocument@@@Z ?VisitEnter@TiXmlPrinter@@UAE_NABVTiXmlElement@@PBVTiXmlAttribute@@@Z ?VisitExit@TiXmlPrinter@@UAE_NABVTiXmlDocument@@@Z ?VisitExit@TiXmlPrinter@@UAE_NABVTiXmlElement@@@Z ?condenseWhiteSpace@TiXmlBase@@0_NA ?entity@TiXmlBase@@0PAUEntity@1@A ?errorString@TiXmlBase@@1PAPBDA ?utf8ByteTable@TiXmlBase@@2QBHB

Name

.text

Size

44KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_2_/tnproxy.dll

IMPHASH 10e96c81ba42657121a41ca1610a4458
SHA256 26c906e83d280f03e021a5730908cc40551f8ef98e048b9ae001354ec83ae736
MD5 3bad47f1e11387358ba090fbc2682713
SHA1 e7e7843d3fd4f45fdb65ff40936bc28a10651589
SHA512 c00f7079746cc0ab961680ca784cac036ad60c2883e032fea9d8ac4791579f5cb952a341efb0068a38f81ab84c6dc870ddd8ae5ddb66d17a812a80fc8e1486eb
SSDEEP 12288:aY2sKZ+fh+jtdwPBAMvyAXlOsJhYV0J7OQf1LoP+MmIlF/w2MfNXn0K43qsvXB3p:h2sKAj5YV0J9UWrkxPHRzANe
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a3:7d:bc:d4:fd:87:0b:b1:57:28:25:79:10:88:5a:b6:e9:cd:88:bb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Chains

Aug 8, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Serial Number

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 17, 2013 - Feb 16, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

547108

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\src\Xuanfen2_proj\trunk\Output\xcore.pdb

ws2_32

socket sendto bind send recv connect listen __WSAFDIsSet select setsockopt WSAStartup WSACleanup getpeername accept inet_ntoa inet_addr gethostname htons gethostbyname WSAGetLastError recvfrom ntohs ntohl ioctlsocket closesocket htonl

kernel32

DeleteCriticalSection TlsGetValue TlsSetValue TlsAlloc InitializeCriticalSection Sleep CloseHandle GetTickCount FreeLibrary GetProcAddress LoadLibraryA EnterCriticalSection LeaveCriticalSection InterlockedDecrement InterlockedIncrement GetCurrentProcessId TlsFree GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange InterlockedExchange

msvcr80

__clean_type_info_names_internal _except_handler4_common _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _encoded_null _malloc_crt _decode_pointer _onexit _lock _encode_pointer __dllonexit _unlock strcmp srand rand memmove isdigit strstr memcpy_s strncpy atoi ??_U@YAPAXI@Z ??_V@YAXPAX@Z strlen strcpy memcpy memset _beginthreadex memmove_s _CxxThrowException __CxxFrameHandler3 fgetc free calloc printf __iob_func sprintf fputc _time64 ??0exception@std@@QAE@ABV01@@Z _purecall ??0exception@std@@QAE@ABQBD@Z ??2@YAPAXI@Z ??3@YAXPAX@Z _invalid_parameter_noinfo ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@XZ

msvcp80

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ?setw@std@@YA?AU?$_Smanip@H@1@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ ??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?uncaught_exception@std@@YA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

iphlpapi

GetAdaptersInfo GetIfEntry

wininet

InternetGetConnectedState

Sharing

General

Malware Config

Signatures

File Explorer