de126ef0de8b4498f0297839f82d659ba585621b6175508c437e8f41a49e25c1

resource
de126ef0de8b4498f0297839f82d659ba585621b6175508c437e8f41a49e25c1
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/$SYSDIR/plugins/ipchanger.dll
unpack001/$SYSDIR/plugins/mx_163.dll

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 de126ef0de8b4498f0297839f82d659ba585621b6175508c437e8f41a49e25c1
MD5 9b5b91e24f21819934dc9a9551ff5c93
SHA1 17c913126039d93dcc3bd487cc6b2ac504a25f9a
SHA512 1ed156003e9fee9d1a3f3774220555adb0409293076694ab20d79efbd46dc5fdd25358c91231619b6e8023d5acdaf4c133fc2974dfe38e84ee7938648a36b209
SSDEEP 196608:fGzA+9CZKfpCZGhOqhI8HuAUZ567e1fzvLXvHfoJQKA6nw:f7+9dAIMqhI8fU367e1f/Hfs5A6nw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH c1c7505e1e6e929ebb6b9100e55b050a
SHA256 c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
MD5 ec9c99216ef11cdd85965e78bc797d2c
SHA1 1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA512 35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
SSDEEP 96:JwzdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuHUDQ:JTkDr/HA5v6G2IElFernNQZGdHs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH d6b0243dd90845123f35b66da1032c84
SHA256 51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257
MD5 88d3e48d1c1a051c702d47046ade7b4c
SHA1 8fc805a8b7900b6ba895d1b809a9f3ad4c730d23
SHA512 83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4221

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$SYSDIR/Channel.dat

SHA256 66af92bf73fffb190214fde65933fcbf013365a674cc320576909d939d0c1440
MD5 ee8f208b135d4940dbb80d0335e20a1f
SHA1 0ce9ef7406714a7c603817e04a57555ed5409d27
SHA512 1aeb83efae864db518d3b19e49ed044daff123ad284d29211ca83f8f406fbc4950fc36acc3d603ffc5782127a391b5fd9669c348a3083d406810341bbb8198c7
MD5 SHA1 SHA512

$SYSDIR/Ocular/AgentTask/AgentTaskList.dat

SHA256 111212ebcc8843644eaee86db5a8205ce19fecaec989b6fb291a210a4e62a63d
MD5 a6950eab90cf696da409bcccb90fb2bc
SHA1 58a3428499cd4c8003ae764b4787baa1f440a0f0
SHA512 f425eae2933060e34221538344d311139be20a5211ac04ca79e00af2bd171efd5855c7a39ebfa3a84d8073bd8c9b4b61dc46a2ed96c81d522508d536af86416f
MD5 SHA1 SHA512

$SYSDIR/Ocular/OAgent.ini

SHA256 936f278e413c337540af6c5193f86081f9eec361814f717940359f8a203b1fd1
MD5 1627f05f48d13a28998832a3a2ade38e
SHA1 441b037bcd420f4e1a664d62d580a17b9ec952e2
SHA512 1495ee9259d390b216661bbca929027553a7f6cea3a4a2d8d93ac593a99f03b93dbdf950072b2c1553d010c54bf8c02edcdbd33ba8f044f635cc39c872ad6515
SSDEEP 24:Q+VXtQlweV2FTu+qKNEl6BzoI7r7P+Zr1PDWE3RGd5mwydVEjyrT6MLRgGgzyd6l:r1tdZu+qDCz4U7HydVw2TQp2yTYw
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/Ocular/OPolicy.ini

SHA256 0576cdc9ecc91d995df154a6ebe456afa688ca91b4f6ee03e27f415ada41eb9d
MD5 ac4a9b673a44563a9866619ce983f897
SHA1 9735d2047947516e1a758fffcc550989cc5eec85
SHA512 dea7835913467ef8ab02efcb9cdb3425adf8ffd48226d0426bd70c8480046aeeae6261ff18870f02dd7a9173725f4e60c64436bf9181b12ef71078af5b0c5eeb
SSDEEP 96:rsYdnourDt7uVtT7puRDi5QLGAQ1cAqMYiVRFFqUcKp:wYdnourDt8zuAE6NDRFF/p
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/Ocular/msagentclass.dat

SHA256 63a523a65b2bead0b37ebe02fb023d6dc403b742f36f74e83f13c8b38a29da4d
MD5 a0d0c3831cf2615b8d6592f1595d62ff
SHA1 ecc3a74bd0e8269299fb92f9b288087c8ac051c5
SHA512 1e5bea81a72455e67b19708e7e39afa7a8965a450d2a8ca721d0987a70ec3ca8b958c9c37f634b023a330672a8cc3822222cfdc1e6b211a7b5323527830edc8a
MD5 SHA1 SHA512

$SYSDIR/Ocular/msmailboxcalss.dat

SHA256 21f56710a7667c48fd5993a2b42aeee519527bfd36075ba0a11dfc0bec583f0e
MD5 b2a694142b2b98f1c5b41f6d28d02ce6
SHA1 547ce4e42bbe81a358d6866a1a5b194ee2d5720e
SHA512 6cdb6417ba0ad61aa13fe9e27e33bbb4ea29da37969459a9ef5ed054c2822139dda1e7c2f00fba5d43683ddc7603546fa610e813c9f76dc34067d3cce7a14e9c
MD5 SHA1 SHA512

$SYSDIR/Ocular/msmailboxidentify.dat

SHA256 35c1ab113184120707b157d06e26ae834a48914ea0e313ea74efdebc7ba2e059
MD5 bf777b127ee66875e2b08174b00bbc07
SHA1 02ef38eb3fad07cc2e795e33dae9ad44cc1de976
SHA512 5f03fb5d7d8a3286452dc9d71e0f8369835c172c2179ca94fc81dddeeb9f17f4404aeb2ea3c483809111cbe3f8741ad2c513a239e303b09f46e0230ec926db07
MD5 SHA1 SHA512

$SYSDIR/Ocular/msmidtierserverclass3.dat

SHA256 01b4788cf9af339f50345c428bc0f850ad3902610df4ef31fff80b5e4b899947
MD5 802914edc8dec4d5414de5bb98601d40
SHA1 13fe97de7e7593781a472d95324303e34eab552b
SHA512 64486f3c23652c9a251c49a01f6c2794b5f27a0a2e10069bd4cd3172d8b7cee0c49bf98300152d8338facb025c4c771a85f3cd920f7375b6b7d7e27fd4f3adcf
MD5 SHA1 SHA512

$SYSDIR/Ocular/msodhash3.dat

SHA256 6f2f6e383f9f5a4eb0ca1a299ba61560df7df08ee16e90020c6c264a06e7cd58
MD5 0735e6fbd2cc6fb2d0b1b60396019cb7
SHA1 f2805c236fb12f3885e43552ce71a9d8e096c7c8
SHA512 787808b3bc8d03c8ff4b1baa6278726de3ff89f66ba64cf6ce15897dd460c7175b14a2f8e5c81a051d59149b0484eaae7706183ca207c62ad286cbf92bebf865
SSDEEP 48:O/BO1h/kK/OsME6y1/HitW2mrbmLuaZ7/oFwYTe:O/Bs2K/Oor/HitWdjJe
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/Ocular/msusersystemservercfgclass.dat

SHA256 c4b9f8c964f351f470cfb1734631489c055af13bb8b2df5cc477f2531b476d37
MD5 b4c5a731de7aafc9a8dece224e0db819
SHA1 190077d8d59260ec8362b8ef35c6b697dc8ed400
SHA512 120a7c2f964c2228c3546aa5e2a25862530e373812b99613b3d7ab763a267ba8dc49f108eeafc7b5246c6eb70b2099078345b8411e01e6450b47900e6981ef98
MD5 SHA1 SHA512

$SYSDIR/Ocular/msusersystemservercfgclass2.dat

SHA256 c4b9f8c964f351f470cfb1734631489c055af13bb8b2df5cc477f2531b476d37
MD5 b4c5a731de7aafc9a8dece224e0db819
SHA1 190077d8d59260ec8362b8ef35c6b697dc8ed400
SHA512 120a7c2f964c2228c3546aa5e2a25862530e373812b99613b3d7ab763a267ba8dc49f108eeafc7b5246c6eb70b2099078345b8411e01e6450b47900e6981ef98
MD5 SHA1 SHA512

$SYSDIR/Template/RedCell.htm

SHA256 11abb0ad47329248452319ef63839f69d6522a614fccf62fb6ff227577e6e206
MD5 64ad4cc25cd89081d2d6f286173f3f34
SHA1 19f2ff833a8b34861397db4d28de17540abf2429
SHA512 7c66c37f82ca5b06ca4bfe3b7beed7daa2a68772cb80caf0c036ef23b7b134678e866dfa304351873a0cc2672b048f9fde20ec404eabbe2f8ec06264c3911a04
MD5 SHA1 SHA512

$SYSDIR/Template/images/back01.gif

SHA256 c390e6548a3603ce769d25aaa2b0ecbec119be640721bb99b4f3958f303d0811
MD5 524c229587fbf2f98253e57f8d1dc0d5
SHA1 bf92d13ed7bcbbf26eac79b972c98e909540ebf2
SHA512 f4bea9de5b87e993e8440ac13092bd3f7c83e0d51b127b931731dcd17a1a9035a232c02c4c1ae3917822186ef03e237a52b38e9138e11bc32a80d5e4635ca8fc
MD5 SHA1 SHA512

$SYSDIR/Template/images/back_top01.gif

SHA256 cc5d7b57566f56bb9723d8b61399ae17c22deeb81b4e0fb5346c01ea87f6c148
MD5 e36331d79abd4149572addd1de77e5cd
SHA1 6ed0511c988749f0a8b33df9c6cd8a7ca9ee62e3
SHA512 b0b49d24fa19b1646745961e5cf10630afa699b5b2d3465f252786da58dceeb5845797d438c8d86e3402280c99a5163bf7a04a978c52a27f5259fdb0263f08fb
MD5 SHA1 SHA512

$SYSDIR/Template/normal.sml

SHA256 b3be1d238ace3a9d16a0f985a3a19609a28fabcab9f1bcdc2de3ad8bf01104bb
MD5 6d5041cf99f1abaf503d841bdd511909
SHA1 ee48d3762b9e49fd9162dbe19c012befa7a6d270
SHA512 d86ed7d7f8a1167e10f6e6e79818b90e8918f4b1cde75c755d5806e1f90a35d0e13133459190052e2326f44027c131df5c6b866118d8582fe508833b1f309f1e
MD5 SHA1 SHA512

$SYSDIR/bakrdgv3.sys

IMPHASH f71f315bc7c309824aca4e997caab766
SHA256 a3d817490804a951bac1c7b1ea6f48aed75baec7e3b4e31be4fbd1fe82860bb1
MD5 97ac3ef2e098c4cb7dd6ec1d14dc28f1
SHA1 3e78e87eefe45f8403e46d94713b6667aee6d9c9
SHA512 693e90da2581306a1f9bb117142429301c7dc28a8caf623c4dfc21f735c53c4502e2b58a5ebdbd8c568dfd3393d1687428f1934f4c28b4fc715eb8f856ac02cd
SSDEEP 24576:I1iQzjPLwVa0gzIkUeSr18gU9W36RO5TsHKGaXDx0hl:Iz5zISSrqW36I7FXDx0hl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

d7:66:68:59:80:47:68:65:e0:3e:89:ea:42:fc:84:11:01:19:4b:f4:55:e4:f2:0d:64:18:c2:b3:38:a6:3b:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

c5:48:a9:b7:10:ac:42:fc:19:b3:16:05:2d:d0:bf:ab:f9:4f:f2:75

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

133766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalAddAtomA GlobalGetAtomNameA LockResource LoadResource FindResourceA ResumeThread SetThreadPriority SuspendThread GetCurrentThread GetCPInfo GetOEMCP GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA RtlUnwind GetTimeZoneInformation GetSystemTime ExitProcess TerminateProcess GetStartupInfoA GetCommandLineA RaiseException GetACP HeapReAlloc HeapSize ExitThread FatalAppExitA LCMapStringA LCMapStringW UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree GetStringTypeA GetStringTypeW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetStdHandle GlobalFindAtomA CompareStringA CompareStringW SetEnvironmentVariableA SleepEx SetThreadLocale LoadLibraryExW GetWindowsDirectoryW OpenMutexA OpenFileMappingA GlobalDeleteAtom GetProcessVersion TlsGetValue LocalReAlloc TlsSetValue GlobalReAlloc TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcatA SetErrorMode GlobalFlags GlobalSize OutputDebugStringA DefineDosDeviceA GetDiskFreeSpaceExA SetVolumeLabelA QueryDosDeviceW GetLogicalDrives GetDriveTypeW GetDriveTypeA GetExitCodeThread BeginUpdateResourceA UpdateResourceA EndUpdateResourceA EnumResourceLanguagesA EnumResourceTypesA EnumResourceNamesA SizeofResource LoadLibraryExA CreateFileMappingA MapViewOfFile UnmapViewOfFile VirtualProtectEx WriteProcessMemory VirtualProtect QueryPerformanceCounter VirtualQueryEx InterlockedExchangeAdd InterlockedExchange InterlockedCompareExchange ReadProcessMemory GetThreadPriority GetPriorityClass SetPriorityClass TerminateThread LoadLibraryW MoveFileW GetEnvironmentVariableW GetTempPathW GetTempPathA GetSystemDirectoryW ExpandEnvironmentStringsW ExpandEnvironmentStringsA FormatMessageW FindResourceExA SetLastError WaitForMultipleObjects ReleaseMutex ReleaseSemaphore CreateSemaphoreA SystemTimeToFileTime LocalFileTimeToFileTime GetShortPathNameA lstrcmpiA GetThreadLocale GetStringTypeExA GetFullPathNameA lstrcpynA GetVolumeInformationA lstrcpyA SetEndOfFile UnlockFile LockFile DuplicateHandle FileTimeToLocalFileTime lstrlenW GlobalLock GlobalUnlock lstrlenA InterlockedDecrement InterlockedIncrement LeaveCriticalSection EnterCriticalSection AllocConsole GetStdHandle WriteConsoleA FreeConsole OutputDebugStringW SetFilePointer DeleteCriticalSection InitializeCriticalSection GetProfileStringA WideCharToMultiByte CreateProcessA GetWindowsDirectoryA GlobalAlloc GlobalFree FormatMessageA ResetEvent SetEvent WaitForSingleObject SetConsoleCtrlHandler CreateMutexA GetVersionExA CreateEventA PulseEvent GetVersion GetUserDefaultLangID GetSystemDefaultLangID FreeLibrary MultiByteToWideChar MulDiv GetExitCodeProcess GetProcessTimes FileTimeToSystemTime CopyFileW GetDiskFreeSpaceExW GetFileTime SetFileTime VirtualQuery CreateProcessW GetProcessHeap HeapAlloc HeapFree WriteFile CreateFileW GetFileSize GetComputerNameA GetComputerNameW FlushFileBuffers GetFileAttributesW CreateDirectoryW CreateDirectoryA GetFileAttributesExA GetFileAttributesExW GetVolumeInformationW QueryDosDeviceA DeviceIoControl ReadFile Sleep MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileExW DeleteFileW SetFileAttributesA lstrcmpA RemoveDirectoryA MoveFileExA DeleteFileA GetSystemInfo FindFirstFileA FindNextFileA LoadLibraryA LocalFree OpenProcess GetLastError GetCurrentProcess CreateThread GetSystemDirectoryA GetModuleHandleW GetFileInformationByHandle GetCurrentThreadId GetModuleHandleA GetProcAddress GetTickCount GetLocalTime GetCurrentProcessId FindFirstFileW lstrcmpW FindNextFileW FindClose CreateFileA CloseHandle CopyFileA GetFileAttributesA GetCurrentDirectoryW GetModuleFileNameW GetCurrentDirectoryA GetLocaleInfoW GetModuleFileNameA

user32

GetKeyState SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos RegisterWindowMessageA OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement MoveWindow SetWindowLongA IsDialogMessageA ScrollWindowEx IsDlgButtonChecked SetDlgItemTextA SetDlgItemInt TrackPopupMenu GetDlgItemTextA GetDlgItemInt GetDlgItem CheckRadioButton CheckDlgButton GetSysColor GetSysColorBrush LoadCursorA GrayStringA DrawTextA TabbedTextOutA OpenInputDesktop BeginPaint GetWindowDC ReleaseDC GetDC ScreenToClient UnhookWindowsHookEx GetLastActivePopup IsWindowEnabled EnableWindow GetScrollPos SetScrollPos wvsprintfA GetMenu GetClassInfoA WinHelpA SendDlgItemMessageA GetUserObjectInformationA SetFocus GetFocus GetProcessWindowStation FindWindowExA GetWindowThreadProcessId GetClassNameW GetForegroundWindow CloseWindowStation SetProcessWindowStation OpenWindowStationA MessageBoxA MessageBoxW SendMessageTimeoutA EnumDesktopWindows IsWindowVisible GetWindowLongA SetWindowPlacement GetUserObjectInformationW GetParent EnumWindows OpenDesktopA GetThreadDesktop SetThreadDesktop CloseDesktop GetCapture IsChild GetTopWindow SetScrollRange GetScrollRange ShowScrollBar SetScrollInfo GetScrollInfo ScrollWindow EndDeferWindowPos CopyRect BeginDeferWindowPos DeferWindowPos EqualRect AdjustWindowRectEx IsWindow SetActiveWindow MapWindowPoints UpdateWindow PostMessageA LoadIconA GetCursorPos ValidateRect GetActiveWindow GetMessageA GetNextDlgTabItem EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA LoadBitmapA GetMenuCheckMarkDimensions EnumChildWindows GetDesktopWindow GetWindowTextA GetWindowTextW PostQuitMessage DestroyMenu ShowOwnedPopups SetCursor DeleteMenu EndPaint SetWindowTextA ClientToScreen GetWindow GetDlgCtrlID GetWindowRect PtInRect GetClassNameA RemoveMenu GetMenuItemCount GetSubMenu GetMenuState GetMenuStringA AppendMenuA GetMenuItemID InsertMenuA LoadStringA MsgWaitForMultipleObjects GetSystemMetrics CharUpperA wsprintfA GetWindowTextLengthA OemToCharA CharToOemA PeekMessageA TranslateMessage DispatchMessageA RegisterClassA DefWindowProcA DestroyWindow CreateWindowExA GetClientRect SendMessageA AttachThreadInput ShowWindow SetWindowPos SetForegroundWindow FindWindowA

gdi32

ExtTextOutA Escape GetDCOrgEx GetObjectA PtVisible CreateDIBPatternBrushPt CreatePatternBrush CreateHatchBrush CreateSolidBrush ExtCreatePen CreatePen GetWindowExtEx GetViewportExtEx PlayMetaFile EnumMetaFile GetObjectType PlayMetaFileRecord ExtSelectClipRgn SelectClipPath CreateRectRgn GetClipRgn PolyBezierTo SetColorAdjustment PolylineTo PolyDraw SetArcDirection ArcTo TextOutA SetMapperFlags SetTextCharacterExtra SetTextJustification SetTextAlign LineTo MoveToEx CreateFontIndirectW GetDeviceCaps GetObjectW GetStockObject CopyMetaFileA CreateDCA DeleteObject DeleteDC StartDocA SaveDC RestoreDC SelectObject SelectPalette SetBkColor SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx GetCurrentPositionEx RectVisible GetBitmapBits BitBlt CreateCompatibleBitmap CreateCompatibleDC ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox SelectClipRgn ExcludeClipRect CreateBitmap OffsetClipRgn IntersectClipRect

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegisterEventSourceA DeregisterEventSource GetUserNameA RegSetKeySecurity RegCreateKeyW RegEnumValueA RegQueryInfoKeyA RegEnumKeyA RegConnectRegistryA RegCreateKeyExA RegSetValueA RegDeleteKeyA RegOpenKeyExA SetServiceStatus RegisterServiceCtrlHandlerA StartServiceA RegDeleteValueA OpenServiceA ControlService QueryServiceStatus DeleteService OpenSCManagerA CreateServiceA CloseServiceHandle StartServiceCtrlDispatcherA IsValidSid CopySid GetAclInformation GetLengthSid InitializeAcl GetAce AddAce AddAccessAllowedAce GetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupAccountNameW GetFileSecurityW SetFileSecurityW GetFileSecurityA AllocateAndInitializeSid EqualSid FreeSid SetFileSecurityA RegSetValueExA RegOpenKeyA GetUserNameW GetTokenInformation LookupAccountSidW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegQueryValueExA RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegSetValueExW RegCloseKey ReportEventA

shell32

SHGetFileInfoA SHGetPathFromIDListW SHGetSpecialFolderPathA DragAcceptFiles

comctl32

ord17

ole32

OleRegGetUserType WriteClassStg WriteFmtUserTypeStg SetConvertStg ReadFmtUserTypeStg CoTaskMemAlloc OleDuplicateData CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize CoInitializeEx ReadClassStg StringFromCLSID ReleaseStgMedium CoDisconnectObject CreateBindCtx CoTreatAsClass

oleaut32

SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElemsize SafeArrayAccessData SafeArrayUnaccessData SafeArrayAllocData SysReAllocStringLen SysAllocStringLen SysStringLen SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayDestroy SafeArrayUnlock SafeArrayLock SafeArrayPutElement SafeArrayPtrOfIndex SafeArrayGetElement SafeArrayAllocDescriptor SystemTimeToVariantTime SafeArrayCopy VarBstrFromDate VarDateFromStr VarBstrFromCy VarCyFromStr SysStringByteLen VariantChangeType SysAllocStringByteLen SysAllocString VariantCopy SafeArrayRedim VariantClear SafeArrayCreate SafeArrayGetDim

mpr

WNetGetConnectionW

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

rpcrt4

RpcStringFreeW UuidToStringW RpcStringFreeA UuidToStringA UuidFromStringW UuidCreate

$SYSDIR/bakstec3.sys

IMPHASH 0dfd18b47f2ad9bb705fc829b2b32c50
SHA256 cb72b724c5f57e83cc5bc215dd522c566e0ea695b9e3d167eed9be3f18d273ce
MD5 b9e0a7cbd7fdb4d179172dbdd453495a
SHA1 7f1b18a2bee7defa6db4900982fd3311aabed50d
SHA512 720985495b67e87f6ecf62268d7dc8fecdb7c06cf9606ce1a12ce4ea741dd3d46a759420e02ec54bc6e96e49d37a2e19ac307093b1228c01914c8e632a8d373c
SSDEEP 24576:mrmoCH/siu9xQBvJ4TyKyCdgjBXj0jHy3WBZ3cRDusH192mdoEtPg+61zpw94I25:mhxaM+7g+Kzq4I28/1eKle7mLXyn0Lw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

38:07:e2:8a:d5:c9:8d:4b:7e:4c:ea:f7:ba:96:9f:54:e3:95:b3:af:b1:f5:b6:9f:4c:93:2a:e7:91:a5:4d:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

10:a0:07:5d:9c:3b:02:a6:a7:50:0c:61:e1:6c:b6:eb:9a:c4:fb:9b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

256195

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetErrorMode lstrcatA TlsAlloc GlobalHandle TlsFree GlobalReAlloc TlsSetValue LocalReAlloc TlsGetValue GetProcessVersion GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA LockResource LoadResource FindResourceA SetEvent ResumeThread SetThreadPriority SuspendThread GetCurrentThread GetCPInfo GetOEMCP GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA RtlUnwind GetTimeZoneInformation GetSystemTime GetStartupInfoA GetCommandLineA ExitProcess RaiseException GetACP HeapReAlloc HeapSize ExitThread FatalAppExitA LCMapStringA LCMapStringW GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetFileType GlobalFlags GetStringTypeW SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetConsoleCtrlHandler SetStdHandle GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA SizeofResource BackupWrite BackupRead BackupSeek QueryPerformanceCounter VirtualQueryEx InterlockedExchangeAdd InterlockedExchange InterlockedCompareExchange ReadProcessMemory GetThreadPriority GetExitCodeThread TerminateThread ResetEvent MoveFileW GetEnvironmentVariableW GetTempPathW GetSystemDirectoryW CreateFileMappingA MapViewOfFile UnmapViewOfFile SetVolumeLabelA GetDiskFreeSpaceA FormatMessageW FindResourceExA EnumResourceTypesA EnumResourceLanguagesA EndUpdateResourceA UpdateResourceA BeginUpdateResourceA VirtualProtect DefineDosDeviceA GlobalFree GlobalSize GlobalAlloc SetLastError WaitForMultipleObjects CreateEventA ReleaseMutex CreateMutexA ReleaseSemaphore CreateSemaphoreA SystemTimeToFileTime LocalFileTimeToFileTime GetShortPathNameA lstrcmpiA GetThreadLocale GetStringTypeExA GetFullPathNameA lstrcpynA lstrcpyA SetEndOfFile UnlockFile LockFile DuplicateHandle FileTimeToLocalFileTime lstrlenW GlobalLock GlobalUnlock FormatMessageA lstrlenA InterlockedDecrement InterlockedIncrement LoadLibraryW GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA OpenMutexA GetVersionExA AllocConsole GetStdHandle WriteConsoleA FreeConsole OutputDebugStringW SetFilePointer GetProfileStringA WideCharToMultiByte WaitForSingleObject LocalAlloc GetTempPathA GetWindowsDirectoryA SetCurrentDirectoryA CreateProcessA LeaveCriticalSection EnterCriticalSection TerminateProcess SetPriorityClass GetPriorityClass GetDriveTypeA ExpandEnvironmentStringsW GetLogicalDrives ExpandEnvironmentStringsA DeleteCriticalSection EnumResourceNamesA InitializeCriticalSection GetVersion GetUserDefaultLangID GetSystemDefaultLangID MultiByteToWideChar MulDiv GetExitCodeProcess GetProcessTimes FileTimeToSystemTime GetWindowsDirectoryW OutputDebugStringA SetThreadLocale OpenFileMappingA SleepEx PulseEvent CopyFileW GetDiskFreeSpaceExW GetFileTime SetFileTime VirtualQuery CreateProcessW GetProcessHeap HeapAlloc HeapFree WriteFile GetComputerNameA GetComputerNameW FlushFileBuffers CreateDirectoryA GetFileAttributesExA GetFileAttributesExW GetVolumeInformationW QueryDosDeviceA DeviceIoControl Sleep MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileExW DeleteFileW SetFileAttributesA lstrcmpA RemoveDirectoryA DeleteFileA GetSystemInfo FindFirstFileA FindNextFileA LoadLibraryA LocalFree OpenProcess GetCurrentProcess CreateThread GetSystemDirectoryA GetModuleHandleW GetFileInformationByHandle GetCurrentThreadId GetModuleHandleA GetFileSize ReadFile GetLastError LoadLibraryExW LoadLibraryExA GetProcAddress FreeLibrary CreateFileW GetDriveTypeW QueryDosDeviceW GetTickCount GetFileAttributesW CreateDirectoryW GetLocalTime GetCurrentProcessId FindFirstFileW lstrcmpW FindNextFileW FindClose CreateFileA CloseHandle CopyFileA MoveFileExA GetFileAttributesA GetCurrentDirectoryW GetModuleFileNameW GetCurrentDirectoryA GetStringTypeA GetModuleFileNameA

user32

IsIconic GetWindowPlacement MoveWindow SetWindowLongA ScrollWindowEx IsDlgButtonChecked SetDlgItemTextA SetDlgItemInt SendDlgItemMessageA GetDlgItemTextA GetDlgItemInt CheckRadioButton CheckDlgButton GetSysColor GetSysColorBrush LoadCursorA GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ScreenToClient UnhookWindowsHookEx GetLastActivePopup IsWindowEnabled EnableWindow GetScrollPos SetScrollPos wvsprintfA SetFocus GetFocus SetWindowTextA ClientToScreen GetWindow SystemParametersInfoA GetWindowRect PtInRect RemoveMenu GetMenuItemCount GetSubMenu GetMenuState GetMenuStringA AppendMenuA GetMenuItemID InsertMenuA LoadStringA MsgWaitForMultipleObjects IntersectRect OffsetRect RegisterWindowMessageA GetMessagePos GetMessageTime DefWindowProcA GetSystemMetrics CharUpperA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CallNextHookEx wsprintfA GetWindowTextLengthA OemToCharA CharToOemA SetActiveWindow GetClassNameA GetDlgItem OpenDesktopW GetMessageA DispatchMessageA TranslateMessage CreateWindowExA SetWindowsHookExA DestroyWindow GetKeyState SetWindowPlacement TrackPopupMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture IsChild GetTopWindow SetScrollRange GetScrollRange ShowScrollBar SetScrollInfo GetScrollInfo ScrollWindow EndDeferWindowPos CopyRect BeginDeferWindowPos DeferWindowPos EqualRect AdjustWindowRectEx IsWindow PeekMessageA MapWindowPoints UpdateWindow PostMessageA LoadIconA GetCursorPos ValidateRect GetActiveWindow GetNextDlgTabItem EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA LoadBitmapA GetClientRect GetUserObjectInformationW CharToOemBuffA OemToCharBuffA SendMessageA AttachThreadInput ShowWindow SetWindowPos SetForegroundWindow FindWindowA GetWindowTextW GetMenuCheckMarkDimensions PostQuitMessage DestroyMenu ShowOwnedPopups SetCursor DeleteMenu GetDlgCtrlID GetWindowTextA GetDesktopWindow EnumChildWindows EnumWindows GetParent GetWindowLongA IsWindowVisible EnumDesktopWindows SendMessageTimeoutA MessageBoxW MessageBoxA OpenWindowStationA SetProcessWindowStation CloseWindowStation GetForegroundWindow GetClassNameW GetWindowThreadProcessId FindWindowExA GetProcessWindowStation GetUserObjectInformationA OpenInputDesktop OpenDesktopA GetThreadDesktop SetThreadDesktop CloseDesktop IsDialogMessageA

gdi32

GetDCOrgEx TextOutA CreateBitmap RectVisible PtVisible CreateDIBPatternBrushPt CreatePatternBrush CreateHatchBrush CreateSolidBrush ExtCreatePen CreatePen GetWindowExtEx GetViewportExtEx PlayMetaFile EnumMetaFile GetObjectType PlayMetaFileRecord ExtSelectClipRgn SelectClipPath CreateRectRgn GetClipRgn PolyBezierTo SetColorAdjustment PolylineTo PolyDraw SetArcDirection ArcTo GetCurrentPositionEx Escape SetTextCharacterExtra SetTextJustification SetTextAlign LineTo MoveToEx OffsetClipRgn IntersectClipRect ExcludeClipRect SelectClipRgn GetClipBox ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx CreateFontIndirectW GetDeviceCaps GetObjectW GetStockObject CopyMetaFileA CreateDCA DeleteObject DeleteDC StartDocA SaveDC RestoreDC SelectObject SelectPalette SetBkColor SetMapperFlags ExtTextOutA SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetTextColor SetMapMode SetViewportOrgEx GetObjectA SetViewportExtEx CreateCompatibleDC CreateCompatibleBitmap BitBlt GetBitmapBits OffsetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegConnectRegistryA RegCreateKeyW RegSetKeySecurity GetUserNameA DeregisterEventSource ReportEventA RegisterEventSourceA EnumServicesStatusA RegSetValueA QueryServiceStatus LockServiceDatabase UnlockServiceDatabase RegCreateKeyExA ControlService DeleteService CreateServiceA ChangeServiceConfig2A StartServiceA QueryServiceConfig2A OpenSCManagerA OpenServiceA QueryServiceConfigA ChangeServiceConfigA CloseServiceHandle RegQueryInfoKeyA RegEnumValueA RegDeleteKeyA RegDeleteValueA GetAclInformation GetLengthSid InitializeAcl GetAce AddAce AddAccessAllowedAce GetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupAccountNameW GetFileSecurityW SetFileSecurityW GetFileSecurityA AllocateAndInitializeSid EqualSid FreeSid SetFileSecurityA RegSetValueExA RegOpenKeyA GetUserNameW GetTokenInformation LookupAccountSidW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegSetValueExW RegCloseKey RegOpenKeyExA RegQueryValueExA RegEnumKeyA

shell32

SHGetSpecialFolderPathW DragAcceptFiles SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetPathFromIDListW SHGetSpecialFolderPathA

comctl32

ord17

ole32

ReadClassStg OleRegGetUserType WriteClassStg WriteFmtUserTypeStg SetConvertStg CreateBindCtx CoTaskMemAlloc OleDuplicateData CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize StringFromCLSID CoTreatAsClass ReleaseStgMedium CoDisconnectObject ReadFmtUserTypeStg CoInitializeEx

oleaut32

SysFreeString SetErrorInfo SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound CreateErrorInfo SystemTimeToVariantTime GetErrorInfo SafeArrayCopy SysReAllocStringLen SysAllocStringLen SysStringLen SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayDestroy SafeArrayUnlock SafeArrayLock SafeArrayPutElement SafeArrayPtrOfIndex SafeArrayGetElement SafeArrayAllocDescriptor SafeArrayAllocData VariantInit VarBstrFromDate VarDateFromStr VarBstrFromCy VarCyFromStr SysStringByteLen VariantChangeType SysAllocStringByteLen SysAllocString VariantCopy SafeArrayRedim VariantClear SafeArrayCreate SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetLBound

mpr

WNetGetConnectionW WNetGetConnectionA

setupapi

SetupInstallFileA

ws2_32

ntohl inet_addr inet_ntoa WSAStartup gethostbyname htonl

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

rpcrt4

UuidToStringW UuidCreate UuidFromStringW RpcStringFreeW UuidToStringA RpcStringFreeA

$SYSDIR/config/systemprofile/AppData/Roaming/Tencent/TenioDL/1501/cache/download.db

SHA256 3987db76eed82490a5b500887d595c0f47a0beb710337adf0f457e1d453c5f43
MD5 ca7686077a57410b00c76a8ce03cfcd2
SHA1 8efd4e46c5a256652ed123aea333bc565ecd6e07
SHA512 c36d2c79d498dcd87dc1682c55dd5081d8683f439c13c3d92914dc1a4cd2b0de99d51cc48223121b7e507a424534aa8c5cc032067779123173c370129cfd2421
SSDEEP 48:vF+eRL6JqrchvvYL6J5nNXDiIl95Ay7kUPT8PEfEz:9rlKqrcJvoK5NdlbAy7xb8cfEz
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/dgpver.dat

SHA256 feb808d996ab548116ec9b319a1b8782131f0a03d83d94999fc704167ae8a904
MD5 9ee7fbe7fe8262fe206b47b0c03f05e3
SHA1 230c57d831f0481a205be88df0cea5d8d4d8ea89
SHA512 0e466797965c2ba3ccf45b6f00c452a8a7d8fee38059616802b8f76e165df849f23ac9cf5e6a3f77bb32d19e5e2766d5c440df8f4c61a2117552bda53d39f462
MD5 SHA1 SHA512

$SYSDIR/knewuplive.ini

SHA256 98234d2aa385f85452bc21d5ae1cb8fb8edd409fe15738f0e4921724499b4494
MD5 0cf575abe7962eea8fd1c9441a326993
SHA1 e495ee695787b664124acc5b5cffbc0f5ab17c41
SHA512 e5328cb4440d7b8dd4bbc701b22c4c06dc31f7ee28f9bb39a79130e492539a790fdee85b1b723b35f121728a8e140684541062b6080f93628a485b959ca9d0c6
MD5 SHA1 SHA512

$SYSDIR/kpdfconverter.kid

SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
MD5 7215ee9c7d9dc229d2921a40e899ec5f
SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
MD5 SHA1 SHA512

$SYSDIR/kpdfconverter1611.kid

SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
MD5 7215ee9c7d9dc229d2921a40e899ec5f
SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
MD5 SHA1 SHA512

$SYSDIR/kquickpop/notifyquickpop.dat

SHA256 9df505fdbfea9bc0e9b7611d4e10ecf1fdd14b4476bc16080465193ba9b1f45a
MD5 f5d8aca6f5ec4f5a715c8a1329c04fe8
SHA1 ad9bf333e0c4736377ded836acedc1e43fc16401
SHA512 e74b5711883866c2ba68477d2c80347bed9f433c07a7e261cae19304b04015563934380c05d02605c1d7ac035baf2ca446c04e2bbf039f499bf2584e8d7e9e57
SSDEEP 96:gwOSRwTaOV50RpooHOgVGJeIxdjOXhoV8L2:gwbqTa850RpooHJ0JeMNEhoV8K
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/kquickpop/pop_index.dat

SHA256 f00630114ac95d7dad8aa4d31b6e92f6a7ea15ddb8bc72178c01733751cdb295
MD5 492f905772550cae63a6f1fcf75aef7e
SHA1 3a13711e35f4492c4ebaa6e0e78e8c52c2fec34c
SHA512 3d1ffefb4652bc42ec6556ee339581bff017a6411992ac504b8d674eae23f391a1f06181e9e20be6d9f2923fbefdc2a2a67b4d0c69f9e4834a3800196242bbf9
SSDEEP 192:DV94V4qU+9Tt49FCPF09eUY+Xqo+btPsVxY32rJYq+1PAJbCXPHAvQY2aCe2V4Ef:DnC4qUDHy3QJ4bIJxYPNPg4Y25V4EP00
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/kquickpop/poplist.dat

SHA256 85a5276074c518cfa3c4b252079d45410a45f6b39ebd5a252fb35ab9b27b8096
MD5 ba46ca5f522a4c1a2aa11fc8e91d705e
SHA1 c90d93de7fcc44975c6aab07d1e2d6f8ace1ae1b
SHA512 f551c186e62933073322a5bc74f742620fae9c61ce33359cc0244c1b4137c625ef4361608d6be158d85e6a91fe8b8187ecd6520ba7ed0a550a69d5f8fe4b49cd
MD5 SHA1 SHA512

$SYSDIR/kquickpop/tr_win7_lb_inst2/8bf9a530f02f773ac2e7bc201b2f2a2d.png

SHA256 14323bedc0d78442e5ea0e3e70c2bf4a530372dc4d8d1edf0c95330ca8063a1c
MD5 abf52791dad95472c64eec73e1417951
SHA1 5ef658c2d9c84b7364149f2292d6d9ae9c455ff1
SHA512 5b4515cef759c3756743fc2df0cd4c7e51f7245163b3bec6a1b398247c3400cebcb744c15acddd33b0b286b208e167b45fa54c52a366ba5f09e41f76e5be07de
MD5 SHA1 SHA512

$SYSDIR/kquickpop/tr_win7_lb_inst2/c470ecc74594eef470e906b7905462d2.png

SHA256 472a3e1f564b29dba656f32b99210e2797d87688a2d8777933749e5d7c508418
MD5 dabf3b087788a2fed5be66539942db11
SHA1 60ff2c7913ab8958c16693f0dae078571c3e33c3
SHA512 4fe8f046a554d475abab0480d7a8c0140c00901c8587beb9a69090d64cca09b0dd73e2c95ae3f31c5f8fc52cdb43bb9c24ad44593a286e02388c29ca33284f8f
SSDEEP 768:g1uELuWzpnJlQghb7VrBFyAhpMwGPBjzuIoVA1L613:g1uELuWtJlQgVVj29B+IoV4K
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/kquickpop/tr_win7_lb_inst2/index.html

SHA256 9f10e4a5759ecacceefb53a7660d8be53c14ec72deb3cc51c4928af3b5d6cee5
MD5 7fd31b85a6c1706ad27cab36e4af73a2
SHA1 aa7fcc4bb092c733e814f12068f1213f80f1dad0
SHA512 03a590c30e45c2cfeef2f3adf7a8ed1f3f48baed64df5589745dee08685641fe9e79594e32d5714b999738d3a58ff997f79a0b426045e8b527103b893d07d343
SSDEEP 96:dd8QJTwpLy5gVUo2pXZ/MWo1HK6X6e6jsCzXCS77D1G60kupNMfB2ROW6t8VIJuM:dzwpcMWoTKRvn6HNMfqOff
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/kquickpop/tr_win7_lb_inst2/method.dat

SHA256 1ac70aa9b44d0b775416c738fd7cfb9a2e526ba1e55b8386e78d629bed3552f6
MD5 7bf0cafc7f54f77d222c4944fe6f5430
SHA1 f00272feae55fbe3d6b95c9355863a5a83968628
SHA512 470d81076efca597e5fa038c1216ebc11eca93b52509888ac5fcc5971074948d09e603cb25d2dbc4fc507aeddf26f087c2e015c43da187cf5d70c3da99d444d3
MD5 SHA1 SHA512

$SYSDIR/kquickpop/up3rd_rcmdlbinst/53b01d52f361d97d8aff79d088972d7e.png

SHA256 b683573e5d4fe2e74751bc3baa5a2f7b550650709ca7de8085d04a011ceb98bb
MD5 f009203ce07506208dd76478792c026f
SHA1 731a334e86078f7c6f0f9bd5167589f82fce5155
SHA512 e01e9c99d84dd3ff1f1e60717f47e6c26722a8b9d1359c059ffb3348ec43dd9622a7d652fdcd25c0030f79ded4eade5e00746b4e578aa82da83cf5a5ec5ef807
SSDEEP 768:jdp4Hi/iYUb8adTQD20Al8ra2GqWLaFvQQE:JaHRBdTQygrTrFDE
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/kquickpop/up3rd_rcmdlbinst/a0bca0d33c131ece674edd6e6138d6a1.png

SHA256 2327e4c119a3176c213e10fa3af4230b78437be10f0917603cbbf66b88ed2ee1
MD5 a0bca0d33c131ece674edd6e6138d6a1
SHA1 93b888953e599ae7779c6a5831141eb6fd20ee5e
SHA512 e0e204a20e637d49a613cf0bd1b60fa93e61b963dab6e42703ab8addf316be78f13b992922037298081fd9a7f257d55454a523e43e47c356593b8c277b82098e
MD5 SHA1 SHA512

$SYSDIR/kquickpop/up3rd_rcmdlbinst/index.html

SHA256 a83b4476d7edf737b42928be6b1ecae1ade9e02166b6be8e8e1d5e1425dc6a2d
MD5 8d02d3e454207b2028cff5dcf07a4ee5
SHA1 0658f10923d2c759fa70eb1769bf2655c9528262
SHA512 fdff4a79fdaa166ce96d1a1f3752ad9108b1de3be8e39feb305b4af3fdd15ee77278f1d1304e7f7fae492f599250f19ee563c375c4f08fb9cf80fc3ad04016d5
SSDEEP 96:dm8QmPApL96xSaVwWV/M2uAcGf/MWo1HK6X6e6jsCzXCS77D1G60kupNMfB2ROWT:d9ApNZ6MWoTKRvn6HNMfqOfU
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/kquickpop/up3rd_rcmdlbinst/method.dat

SHA256 23987851c0fabb5e10df531540b6925e0ddbb12da555a4039eb7e5d6d6556cd3
MD5 9375cdfa0ba58a49d628a535222c10e9
SHA1 7d987560a76e4869e2f6d272de2a92d5382fe557
SHA512 333506c7592bddb0b8970ae42f31f6ca35b6014a86b82f7ceb29dfedf7994f160cff1854e7e02da5f10b278e7be070760680badcde6a4810a0b749ad449eaf3b
SSDEEP 96:QDpZcmIRFD6lGBsWGKhCDDcxc5dDpVC74L1EeABVePItjHvJGJsuqf:QDgTRV6l0GKSDcxcHnmBEP0LJE6
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/ksysdoct/ksduicfg.dat

SHA256 3c14502df620f56365bcf6253fa8f932c5087b348dd950323d40d90e63f388bf
MD5 f12975b984ce9b051b733736034cd835
SHA1 6c508c85cb6a32ec2e0fb9238600bf7b8f94e6bd
SHA512 712f566dbc5a87659c605dc4b2aef3f80f38f705ba6e9c361fa2c3f466177b4c06af3b8c52d9fed684065e658ab9943e52c82190aa9f5bf2762151ed56a61581
SSDEEP 12288:Hxv8zIAZtJDpMJUtVWC6rB3yhPjwnR6mtPzKfp5r7Sum:HNOXJDpMeaCVhyR6EPipNXm
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/lang/chs.lg

SHA256 f9f33c2ba8466fd513667b0f8b94f76676143108e26cfa2cd44292fa4622ff56
MD5 885613eda57e9829c70ad57881e75d9c
SHA1 bb48ba75a2dbd0d72ab18bda25a0ef511c8f6dd3
SHA512 f00c62699ccf87ed747b1d7b9ad6b5f541b0890b789ffb549e9211ed23c83d6315324077fb77556ef9168fb2f90931d1e1fcce44d38d9c8b3a6eac10a5b74c79
SSDEEP 768:PGrZW1Q+OavWdaDFjrY48JPZb3UA3rTp7VyqL0IIUysuj/M4q:PGrZW1Q+OauC9iNUAp7b0Xsujy
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/lang/cht.lg

SHA256 d7d9f161efd496c62774b1012f95f79be8a75d8bd673c671b488322f86172a13
MD5 acd94fb06714c73b887ed92fb4c3cae9
SHA1 b45f205724834831c8ec945f109816b220356ced
SHA512 f667932f78abab111cd45fb9242db0fae81dd357cd2b1219d712358c5426f26acff8d3c0d2b1781b2f954d975a7ed7173f9bacfce26ffae1f65a47b8b6e4360d
SSDEEP 768:+17YW1bj/K84VPyzKFyC6YL+x477/joY9Fe0vrNx9WoDy:+mW/EQ+FyfW+x4/bv9FeMxwKy
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/lang/en.lg

SHA256 fe7ee3aacbe0056686ab6839757d8234ebee26a00969c5aa0f06ad18487edc30
MD5 857435991c4deeaef50c8518b222ff70
SHA1 05edf581ed6d8ce2f334f60cacae6f9b0fd31299
SHA512 697ac0353e0333800a50166340e4d57d53d60f19b5fffc06c7ef2d868271535b94aa90060d212c578c833f8dca5253ce343a9507cdc547bc67cd0272302db648
SSDEEP 768:MVxfzvxZ+hP8m7WW6Vjs+QjaUdKxLw8QHqqdGmCV/URgbeO08D:ifzKPra9cdK9rqpnO08D
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/lang/lang.ini

SHA256 fdfc431738d11177a3aab26fe6f51184dd83cba4e0ad66e07df600685909be2c
MD5 d777d60864e0c54d93874e16ae9b5a46
SHA1 f9b57e92d06b2a8049d2e38aa4e66a643b8a6d09
SHA512 55b21227d7b36b149c602770d7b509f2b09a8b85ba9d393eb99decc1e145b1bccf042913688f2dc4167b5f2560b87b15c3a252d7810ef2444b4208453e4b2290
MD5 SHA1 SHA512

$SYSDIR/lscripts/base/date.l

SHA256 acec1a305e2dd662d52f647659bbc0c7aa1a8d481f81aea98af3192b19bbf9e6
MD5 194657e5151f09f794cf76ee69f731d4
SHA1 201422d33fa0819cde8774f5cd87cce656c81ae6
SHA512 7d77a8b295d68c750a2a8ba883b3dd6f0d6433a3d82de35e2d5c973a45c0cf08d59fb925bab3d6c8ec058878fba50703a9a5bff05f80fd554e1998a832b57d2d
SSDEEP 192:sMMQeNriPUfouENjEyL3k7qYFkfQRjLQ+HM68fVtBC:sJfdMUfZ2jEM3gFWioXs
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/lscripts/base/io.l

SHA256 01172d111c05db3cc491a1e830593ab7d0a6e6f0ff778473aaab3831e0adbde5
MD5 953594331872bb1fdab1e40f3c1d82a4
SHA1 1d188c0e8391e1c603f306c4f4a014b3dc00a830
SHA512 4466aaaea190a26e9d3f1d6c269485be4d0b0a6d8f9bb7f8501d6a3164240b57c471ccc2ccfc4e01d6f138e19016607a901c5cce0a39507ecb4ece14c5ed20aa
MD5 SHA1 SHA512

$SYSDIR/lscripts/base/lsqlite3.l

SHA256 a7cd890da732c38b8e14ac00202053d404e1647055fd98123f1db1e2a6e4e3f9
MD5 6b2c8fef221ecf1d71fed21403d55bae
SHA1 66e375804f81816e16957ab797e9ed31cc09f407
SHA512 73dc019e7c343ad54f9e39e81376514b310e3aa87c4f92617502e54c572a765390a185cd01de917cae6a53674311429e6a75d05d8c61fff9db2142fba1fc1b94
MD5 SHA1 SHA512

$SYSDIR/lscripts/base/path.l

SHA256 6f7d5fc7e62afc8fed7a3a186e21b8520925f1e361e488f1061348c9b4f09a34
MD5 1729b102e250787e07d24a323f9895e4
SHA1 ab20900258b30f6ed56b469bde8b4d3d286ac5e7
SHA512 971435a8d35a6d40f1ea193c6100e94da56e5bf415bde44440f389afaea457471d8c3b96c817797186b7af751f12be75502022a27c5ea1ff685626cc52a5485f
MD5 SHA1 SHA512

$SYSDIR/lscripts/base/string.l

SHA256 22db35946634ef3b3b960b909cc9b29e1d81055f54dc1df8e030988b1a08833b
MD5 6b7bbafeb9d0ffa850bf8c8fb40640f0
SHA1 6ff0983d161c21c252a710dedf81dd82a3e38c31
SHA512 101027e1b175591332708e29d2f442416c14649db77802e2acbf328c5c58f48e0db2c2fb8ae08fa4fb9b0f195db3039f78a1e7afa47a2030a628193999bdc194
MD5 SHA1 SHA512

$SYSDIR/lscripts/base/table.l

SHA256 3f3b821a2689041fa9419dad52c06d7d6db35620380ed0dd1af671c1dbe8fc33
MD5 ea149ee1774670a045404fb77d21b83c
SHA1 a979259c7c8b843a6caeefbdbdb1ea179bc96fcb
SHA512 e0492be5289cb0ea359f2456a17c5ef7819e86fd4944a4b01b679c0450677a1540ca7993f2b093b1851397f9a3188b71a56ac9c8bf56b3fb6172861263642066
MD5 SHA1 SHA512

$SYSDIR/lscripts/base/xmlSimple.l

SHA256 ebb2f8dc7fb582c7b2e4165aa4eed56e7922864c0db28cae5e3b0f9f29383f1f
MD5 0e76773b483c2d1fdd839705a823558a
SHA1 05a7f84b0325b51e030bbeff175b3a20c13b7479
SHA512 2edf14b37aad1733fa340137bbc5ce9baab0e22aefdcedf4aab3b512ebd072ffff7f50c96c02c5d4fe4d7654a425bc360e46774affaddcb2923d8390a19762ab
MD5 SHA1 SHA512

$SYSDIR/lscripts/biz.l

SHA256 b5f72d2bfd6610eb088af85d0473a6bd55c6d210809051a5475aa5ca16ad34bd
MD5 14ecc8a069e7ac98e76128ca9da68c59
SHA1 78c3b1db43f7dcd886514b793d3c57b98c10e7e9
SHA512 4a34740fb03378fe3f91592eb0cc7be2feb17eac368b52eb0fbfe859b59d833b854b6ff9cfdec072aa44d64e6641c737c7b665a0c981c37a6a29a18189758468
MD5 SHA1 SHA512

$SYSDIR/lscripts/check_fix_inf.l

SHA256 a1ac2e6f950715975d068f03d6eede4f8fe31f93dc749452e1d84626638f04e5
MD5 d91110ecb7eff83492622d9e484bfbb5
SHA1 be5a63da42132d069eb5557646d372c29bd1ce14
SHA512 399b09ae726457d55ebca427f09d4c449c438dd5a87be936e7eff1ad9843b6c4b7c4c5124b7cf7a6e1aa8f0993a1ccfcd5670d827eb4bf62488c42a79ca5bc84
MD5 SHA1 SHA512

$SYSDIR/lscripts/cjson/util.l

SHA256 50ab62b03481d50ece834ace68a60279b2d0d7db35f6511b8adc82975358e0ec
MD5 c82c1fffef2d0db6a89cb3bf2154aece
SHA1 b376b310c8289b45fb1b5d104a34fd7ea3b13de2
SHA512 acd60ed4bd509d2cdd686ed283a769bf8422d6a0d63f545e4f3aed34aee8336afd429fddea0055425c13d9cc4334d10bd34dbfeed4d2bb26491db2bb851ef5bc
MD5 SHA1 SHA512

$SYSDIR/lscripts/dgpop.l

SHA256 7f70fee6e39c6f4347d184ce081fffdcf336e701577b3beba7ff92dbadc9e0a1
MD5 ccd920aaf99136dfb0af44b3b91eda57
SHA1 db2d4547fcec0ebfef5dbf6a40e3e96c7d1b4c34
SHA512 29418991dc77a07f0b77a4f44deb3a496f4ee6a7ceca7399434f69f015083611ba4d61b162e290499ac8e2440fe18cc3a764a55d67fb2ed96e409e5a1533a97b
MD5 SHA1 SHA512

$SYSDIR/lscripts/double11.l

SHA256 3b8a8561b2ea92dad888df647234924271b65e00b7bc553f2d8f8bfe670aa42a
MD5 27af28e031c6832b9f7bad9d21ab1d1b
SHA1 f2f5c5c2be2d6b30c3cc03549ec9a88cc9e24646
SHA512 3850c265e64972b4f284fed7fec7de98fbe83d86199a75320eeb2a7c2a7f7a56d9cb8813c86054df05e69ed403ccfd19a6cee9c54253cf9cd2124affd59caf69
MD5 SHA1 SHA512

$SYSDIR/lscripts/honorwall.l

SHA256 b61377a658ecb585b98d55add6b68a2157f903e78f0d8f9696a2254bf94ffe23
MD5 94bad6451e00dadc0f8cf21981890429
SHA1 5abca03960ee3b719a7d7a353d13c7195ea76788
SHA512 f2a990983d4a59bf031f480db8a5ebaa5e59c71addfc70fea7a04cc6573ec03d0750750ddcd9c52c9c81e31c2e6bc514bdfba2df4c43806fe46fd67f51d8c228
MD5 SHA1 SHA512

$SYSDIR/lscripts/infoflow.l

SHA256 1b48ed9dbf13e6375208134f24197b55b6bc328da675f741da062cbce20ca5b2
MD5 591f2190d3a8676621acd564d0ff0991
SHA1 234a39bfadf3501fbae2a031f4b82c567f95a563
SHA512 8e0cde92e9ff24c88c77e26014c3f219c2036e60a65b31a3cd8bfe60b64e695c2f05cd317727bcdfa645a1a473f89d455ca6322c6f70e74c004dfee8af0145f5
SSDEEP 96:DYr7X0U7nyh7MBjr+Vo41FTwXARqjl9MwRkIYouZmIx2qS+659sVdrjFTU:Da7X0UrO7MoV9bTqARCMweIYouZNMRay
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/lscripts/khealthctrl.l

SHA256 741aea017aa6c9cc38aa9d133bdddf4f63f1bcedaae975654b189687913d8244
MD5 89af91506e6d12c2a30ad0ae4d5acee7
SHA1 771cacd528dedc80208461760b7aaa628cf098e7
SHA512 b8343027283002747df0c207ff2ded12f60b235f6d733ab28874747568bd03a7bd4e90035cf1a8aa9ba0f377d8396643446f314dad0831cfaca36db95da3875b
MD5 SHA1 SHA512

$SYSDIR/lscripts/lsqlite3.l

SHA256 b01d0290c160194760ce4079349e3cda4a570a46b1d14cabc0316c45bcd9029e
MD5 315d327f510b65dda3465b74d97fdd47
SHA1 9355f1f6a536f6aa6f967be1c1ad7d08428062b9
SHA512 3e3221ce7394e0bc9b7f4bf69d296423f7d13bad25cdafa0bef8464a0bd0a6eefe10210ce1394b5d5cfb938e79300c380ba1bca53e8ff28bc859663c04965a46
MD5 SHA1 SHA512

$SYSDIR/lscripts/setupapi_log_report.l

SHA256 54c2c00b1a42aa2a730716c869870ae967f3e7eb0a0ff2b41e962bc312454375
MD5 9a1bd06964027bf542124dc137d705ae
SHA1 2451f9304561b2b9e2ad3a99447ce912a1c6a098
SHA512 6e0caf2f5efa678209ddbb4a1823d5d04db9cd880c88ba0e511e5ec7c201961b13eb635fc39fbc575405a02ad84a9be247f761aa65de7b6ad9c971b8a896111e
SSDEEP 96:w+paWIjfpFO8/p3VpMyqApIuqBKdDBYbu2Qj7mw6u4+:zLI1FO8/p3VpMDAPHdwLQuD+
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/lscripts/setupapilog_scan.l

SHA256 e29aa16d1bc3aa5e5f158b0605871b59503a238acb481c71703c79acd74bcaa2
MD5 9d737c9ec0a246f092d6e2f2b319e389
SHA1 319e079dc0ce0c1ee717d08a9964ee9f0363a549
SHA512 b930c79adfbea8f31f3c1e9ecde267c0e9ec3f3ce7baac854f3f987dd255cf0130824a9128acb68005f894a6bc33542498d2029c0d54aaaa503a3f5f0e3bffd5
SSDEEP 96:z5uYUYLtE/RS5nOnlKJIxgFWT16s2Qz36vRSHCrpf3UvZFn+Pg7dLv+MLJrg:jbLtH54T16sFWSHCt/UhF+Qrfg
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/106.PNG

SHA256 27542b3091d9fbad370a374e5bb4d1131f7845e839cb2da1783307cfe19720c4
MD5 2f73a8cb9fce84ac9bd157ab94d7ba89
SHA1 26fc7c1979cb08ea6e9b0b5ab708579c9bf4002e
SHA512 7ff4f9f21e7e813415ec5373bcfe326ac3f09b1dffd8f4ac803bda62088f81e72cf9a8b63e12268cda2b2875f72b9bc80cd7667bd469c186249ee0e47651dc48
SSDEEP 384:MXgD3mD0+txSnorEShCEqGotx9ArTNThCZFj7JV9:M4MOorESku1ThKvr9
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/106_content.jpg

SHA256 84dff84ee9105a2bb7487e8dcf2900c7cc0ed2c5a6cbb00bb5dc8ead8dd6f0cb
MD5 965ded066468527c173b9ac70e92bf9f
SHA1 a1e8272d10e67233fc3d1296df280aef4dd78e9f
SHA512 e51064d20e49b8234ecde9d06b5b50633668be86c7a5640e6338192f6a7f7ba0047d307ec558f573226dc5032f4d99a347c3f7dd4c7eed75228a201cf616a805
SSDEEP 3072:q4Hl2sf2iQKLMmR/trhO000000/8S7BPv2UHxQdwPwNh9PZDKZ2ECUXV2+pZ0C:f28/pThO000000EMvXSwoNT1dXYfZ1
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/112.PNG

SHA256 2f08457bcbf646c06582d950f0e764f53055162901214ab3099035f3a3e62833
MD5 b72f6cd625c220cf04163c2c70d685e7
SHA1 c6a3dca0dc8aabd17db94ffc0014c3a0aa24174a
SHA512 559b167a4d2d1a3a357cb9d32784581c4ef3d6532ca6b8a456b28567b4ef9c38e838bc8bbfde622514af959312eecbc7d5dcec9c132199266b0e608972b7a8ea
SSDEEP 192:0XRdb6gZmt1T9c9WlL4gxl+MOTQQAOzl67AbOudhOhQpjUETOKG1:0XDVZmXThMxxscLG31
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/112_content.jpg

SHA256 2453b605562f65ab9e029247edbba4c3a4c226f757ee5268970c53b68dfeec37
MD5 04326023d696c23cb10e6a015f03b452
SHA1 a587e322daf43dfb5ee16784a7387267ed738ada
SHA512 cf896bfd73da53de4c066e22a12492cf8436b647e990b6f52b41ad18be1f22e8e5b5a5ef3f66bfd4d601291b9a3a18934e03c1e6530e706cd508b9ead6fb94fe
SSDEEP 1536:Qbo98IPhNoq5qBih7im4Q1IyQRBUwxT7VvTmP1HA/U:QePhMO2/Q1InQwRJwg/U
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/122.png

SHA256 bb74f6333792e4ff9737e7b191826a6c713c4f084e6b409a8f2be1f7766beb5c
MD5 32bfe9cfacafe28b58e54b5b40f7e121
SHA1 4109986fdb8c87aab328ba59091ce0994e091cbe
SHA512 67f9bf12945356d70dc665a733c1b64d6fce3ae0d3ba8df7b0bf653ff413b282447b65e50c57ed6b768c40c56ed860d44ab54b4881cb236e2492e8036454f6aa
SSDEEP 768:Tk83gNQ+drE1fte78rQGt5avn1C/nEN0eIz:Y88Q+rE187EgI/ESeIz
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/122_content.jpg

SHA256 9ea93a7bb69ea824222a3172b5c74abdc0d3956aa39f1ffe3e5b663bd38b2d20
MD5 d3878f45d45ebbec6db62e4a54f4ff3d
SHA1 3b5f271555228550ef8c751c334c8540ec77738d
SHA512 6a2e72b336f1542b9228e9e2ea589a8600ac42b07c4ffda31a2a0a27d25ff5a325a6a249214bff48fbf6a2767db49365ab5d19c71565ab4c134cd2ad1fbbec29
SSDEEP 1536:mawHJs5fOoFhqE+dd+WE6dIDEZVR2rWS1xjSybqM+EVE0JkemZu/0Aori:me5f53Pl6dCERWWS1cyf+uE0JyZusi
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/154.PNG

SHA256 7421cab002b12de167789f39ec61f7436f9c14fe5bbc9a70ef35b42bbeb49a04
MD5 eb88fb9ffbe2913f0e20f338a6236ab1
SHA1 7a64f97358658f45eb114c5518f18b78268bfe92
SHA512 4593bff90e27db530e0c83f1f465b968943138d3e4c89cb4a5bf6794a4a56641e4ed07c07e6c1f40fa9ac72da46d6cfbb9d8ede4e1cf7ff21dee39e3bfbafb91
SSDEEP 192:ZBy72Hq93XTsv+q0DGh0aJZVn/BS04J3Vvr4fx+OigI:27z93Y2Ryp004J3VQ+3
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/154_content.jpg

SHA256 1ba785d18acf72511e6fb0ff069c0db8d25e676f23f5e97af96088178fc5fe37
MD5 caa073628cf1725d2d334d5804ab05aa
SHA1 90db952c25344e050cb77626b3df235973da33f4
SHA512 f214eea424bf8db78f6806ad412aeb6583debd66e479f1849d78f11089c4d025891ad714c731a11f2c61af5cc10aff81e70c771781ec24d8e4046cf8e96f7a7d
SSDEEP 3072:FkeZ+UHpMPOj3FvuomiQxhWauEsqX9ux77XQ/wnUC:Fkw+upuOXmiQxhpqqNux77A/wUC
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/160.PNG

SHA256 81c9a4204b79dab155b55d0b4fa006d7def8b08fb8964b9abbb404e656e66b84
MD5 d09974ed4c204d8931fef179c1914475
SHA1 07aebead398684a33c7b6844653f0c82b8b86e29
SHA512 cf6fcf8cbd2eac2166b77748d31e4f77ade2d9ec8f05bef1030400c28bcbd755ce5032c2c34f5ff1d20643c9c154e2f11c7803b0328157e1a21beb8ff78dd2da
SSDEEP 384:8sHOlL/rr/ohQFV1DUwG8TrwOVDZ07GQlrj/:8sHWr3/ohQP1YwTwOtuqyj/
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/160_content.jpg

SHA256 509a4e14e291fdf9e11f1063740a6c4e4f9ca4c8543498d96fe6971b52fa18de
MD5 3df0c943a69bdfd1542b7f4ada427c3c
SHA1 d29a9200b9c3df5df36ce2929fae97bc4f503df3
SHA512 c643d66f63780c89e01e7f6bfd1ba2fa75d3fe703b9f97b06d50a9af8eaf73414f8bfb1a489b4a9363c82f20cf2f27247e84df9f0d744c6602d03b6e7141cdf8
SSDEEP 1536:lI+s0NurmfawK8MkBAnH5L8Kgxb7t/TohG42EOxq97mffffp0oBw5Dhv6QvRfm1P:i+scPC+85sxb7t7M2EOUumhv6ShMX
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/170.png

SHA256 64a55e379a66165a647fe1f256b24e4d0495d3ce8c2ccbfc5ea26d425ac74ae2
MD5 7ac84ca5ec8d5d0a996c91dc0b37bbeb
SHA1 6ff04f35b6d5d57ac316a444e31c3fa98ce2f1e4
SHA512 90f1fca6b305b2d3b6e693170757106f5fd9fceffd375fd6b77cca4657fe9c131d97efa8934422159b93ecd316f7a3a7e34958ffa9a9a19f4e0f90181d681699
SSDEEP 192:KAfGY2Yit5MJlPO7PqK4MkMsq6bZqhNYD9IYNKzsd7Wmhkb5HLuRB:KAebBXMJlmeK4MkM7sB9IYIzsd7ol+
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/170_content.jpg

SHA256 d0e6330281e32677f9e876721ba9e15e7453cf8390101dbf1d2654ead6ae1c24
MD5 f486b9bf7b46fbea773e31cb3bd87346
SHA1 88126fff32360dad1ac197094ba0c1d6beaf458e
SHA512 3356e115fa490d431218a3f0c7ff87685fbdfc8461ab1fd327c3295f646391dd931eddc3f75161a58d79fb87976cd41f45ee4729358943586e5172e0e8979cf7
SSDEEP 1536:qXPNbgMyjbnk9cpK8LXCgxaMbo20zRSTyhzmEuCatMVZ1tyuWOiIpYEXG2:U3O2/gxaco2yYkuJuBtyuRR
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/194.png

SHA256 f38a1c0e28a5a419b6bd460f332263ec518405c365b13da0416070bcc4a2d5dc
MD5 79b8f8417fb94c1be23cd95be3796c9b
SHA1 0f413d72a6950782b6dd5171dd3acddb92863337
SHA512 935b04e20455bae704100ade008ef57e5e5785fd6390c5346cff3a8debff293fb207cd9559f76c2e9ed4e9a06d88486b0030896e4812558f093e8d51b0cb8d80
SSDEEP 96:vk7oac6wX84DoI3fy8UGs2fj3QKf4L5mpcqJxrqZ0kFLo55/Sl5/G/LVAbIc+OaS:cEwo1MIvF7+mfJ80kxo01GTVb/OD64Qs
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/194_content.jpg

SHA256 7f21cf7b50b934c9f5c88f1403d1f74fb9b1927da5a53a7f4d85318ad8cc9b8b
MD5 a706726f8c1539e13da1e9fe363f63fc
SHA1 f90451409cc7f178b8c2fc3378db556e2ff5250a
SHA512 98bb3ab03d1b47dd358c68e1f5983870304e4f77ea3867c912e1eea6ab269f9e30561539b745b5b728bceda09cb2980a109bc65fabca53ce9b87266c230d701a
SSDEEP 3072:d0LSCD9AMc4PlTIYAKcXQQQQ4L507dgmNdHHXv47dyNBjR:d8kMc4PlTrJcXQQQQy507dRNdn/47dgd
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/202.PNG

SHA256 1a371a1bf4bca2b541d7b0a816095f8af9478fbf14d8d39c917ced55b9876883
MD5 b10cc419c1d29b555f16b7f555cc8025
SHA1 f58d27cf35737fa071f48f88e875281b9c19111c
SHA512 a553369ff4ae99de3d3088058d444479b1f62becbdd34c823d8a77c1ed26fd6e68c162f5a1272015c79152eacc513a86d5e2cd700f136a479996059485f72e01
SSDEEP 192:SZayIh4kwgfiQ6LtzX/38LE6UDbX8dFX1lm:S8n5liV0oHvwXXm
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/202_content.jpg

SHA256 5ea1bbf69adcb156b55eb4f5ac4ba9708fe2079d6d9bd750f5d2443297a00879
MD5 e8853761f8b141d8e3b1e7d3fc26ea7b
SHA1 ec2bfb8112c683bec299f26f8ee475bc9de6da99
SHA512 0094ce319386ab68556ef2a21aaa3b09d9d4c978fcbace6fe69c0027f7453d649ef7408f849421c9c62b5533dbca5b7efb496a66e03eed86ce623124f1cb2297
SSDEEP 3072:KZjiNyuVf15ZXXCFZsNdmdWHMVwaDWs/dRRn9Kl+T63rrnBCBv31dCORRRO:27uxZH1myMTdRRn9K4eb9wFdRRk
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/230.png

SHA256 d5123de37c8cd824dff5cc447b781c1f3699732834acbde3257b2a0c5911f5a5
MD5 3606a0f595b657d8f4d011cc1ef61ede
SHA1 52fb87fc4890257fb54a2949629a290c83e7b255
SHA512 cd0f9eec72351603d337045dd78b3c1b021234cfd2aa11c285e58ebd81fd021f481ae5f16756d2b896ab47b23f41a56f3b201f1be9506e73b013ed4fd0afce33
SSDEEP 192:FQ/hd59GyRMHRMY8e6M+d8P0Fv3knhsLvzR8BKprC88KdP:FUhd59GyuqY3f+OmvUnhoiB78l9
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/230_content.jpg

SHA256 6adfcfe7d9783c76798b898fabeb775b4c59b82d22d7baf6356ea8f7c4717db1
MD5 aa0e99bfb8bacba3605170de89b80f8e
SHA1 84e5e3990ea5f3bc115a056f42da57d3bf56c5ea
SHA512 160642e8117d14fe493aeef8be1d63b0cffe5272e0dbde330b4d4eedf3b6c93a9d6f997c4a452f05e79ed58fd7ee447d80346a678a88e6d98ffba7f3fe08a8dd
SSDEEP 768:DheiVF0PBo/MKqiDZ95MQJNawI3SgjQopvAAtpzx2ICDmj+hkCC23cA0Bfq4OECq:DheU0iEUZ95MjwIZsuAThkF23cA0Bypq
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/239.PNG

SHA256 72558a4e8a12d8a4a866a5281690d10918484a77f80d5b7235a9075c237a8c54
MD5 bf80a9635f8657adc9c391e78db3cf38
SHA1 dcdb4680c31111d68a925f214a1dbde768a87602
SHA512 94d320d15966442b2b383a53b426d18706561911484995820b427742fd5a8bc376c672834b623ddb60f17d17fdb0adb2723eaa8282ff35f6b56cce51837c9154
SSDEEP 96:WCKHh10lqdMgsUADAslIHPzdAjZluFdW/vOcp1As6G3DRb0B3Xui:EDeUsfIHbdulsWO+P3l0dei
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/239_content.jpg

SHA256 d99f6f5c819977b86b2234ac55f4dde4926250376efc71b4947e36137606cea0
MD5 03c86cb07e84763f04cb69ec94640026
SHA1 25363cf26c35f8c95123591e479a0d1544ccf791
SHA512 841a3615e40b7d6a6e187562aff279590ed331d629f04c0c5450ce2f41add3c118fcd9d10fa4a0605aa334c89ed5a941f015e1250b6163bc41f09f8180fe76e9
SSDEEP 3072:OWA+rOVJVQs/nA/trX5/uyoaNbOKs3s7IjbVwEQQdX:LA+rKV7noV/x/NbbsHjuPQh
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/246.PNG

SHA256 3d6b160252b4878fec382f3ca7f57084f9a887a38c3a48d7b80c17678fc22b63
MD5 c81322032370b21c8f5c9715eb9bda34
SHA1 81be4cb09fa1103b0521094c8704f3076c19525d
SHA512 8b4f25d0291166feceb52d3b5bade9b3c9379f5582e9e7ff1c7b924fdad449849323efdd40724b49672fd7c991a224e837b386d32b9e5d8cfa53d9c637d12bd7
SSDEEP 96:Xflxh/9a0TlZZXCK+QlP9WieJPHW7I2rd4byog8orj3:ND9b/ZSfj2Cgb
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/246_content.jpg

SHA256 0a559fe4c1d765f5d63c3fcc9a8c7d825694a97af18209b3170743c9c07b0136
MD5 e215a80324ee13c03507a07f23efceec
SHA1 c5b9770a0c34e486234e4f2bc5c52d1191dcfaf0
SHA512 9a71afb91f154d03fcd697fd221a3ea57bf659b4b07d95a8de6c6a1aefa649a7f0d048280eaab1f838a26b6503896863a6c3c5919850f502feb02be1757af2a7
SSDEEP 1536:BnsfUvTOQPBt3wzfgPQWqLiduf+h+0ouaJcxhj6iK6O504:BssvaQPBtuIPQWUy0+h+02cxhj6i9C1
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/256.png

SHA256 39f1b60ba729ae2af16e709c29b46ba09bff8ef1b52cc87d3bc0af4b9e2312ba
MD5 e684d27739ba93372a2dc37d14720ec3
SHA1 22d423d6f1249eb82cb0a86c784557544ebeb3b8
SHA512 f5fa3c1abbd5324055540f85403bbe88ea1f23ffae9e6f92ad768081634fbe63cb163ffcf51bcf5f47fb7b1cd27f3e737a9f4860004c572caf4fa43ab83fb4c5
SSDEEP 384:/8XUwf9L/6cPbJVTAzmqoCCroibCuc7vr:/8X7L/rVNAzmVciCu2vr
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/256_content.jpg

SHA256 22e14eb17b5647801e10b11a262b3b470467a4792330adb2fe97ce5ff1a7a073
MD5 0b01c290096f80449993989070f6f040
SHA1 ebe58f289b16ef562d09aed2715af092b15e7b4b
SHA512 4afea4e7e4773a731bff9adba30407e2076a4c2cc68bd49a7d0b0b42c2cd544abd202c8f94679530073aace130d059ba228894e6f4f2bd611965447e912de8ac
SSDEEP 3072:RKjsy3/5NM0TmcYfF6L7axjSGELxW8PRG9s1:+dNpZGELijoL4S
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/262.png

SHA256 ee7e2044a99f2bf90992e9b68e2548dbbd4a9cfc73a8164cdcb8571750175778
MD5 1d659024b7dfc685cf23f446b9cebae7
SHA1 edb80242f9de1e376dff7d1837206bdbb264eb9a
SHA512 5a391168bfdb02057098e04e2c3ed0609e3e279496433438160cee22c20cc329773eb2c5c3e482f550ae3e383f965f9028bf049e08d89979b4e71a6ae4f131bc
SSDEEP 384:PXH9jL5T7pPCfasu/wUVCCQt+nRc59nLfq0MfFw6/Ex1TrQiLeg7J:J5TFJsuZVCzm6jOZ+6oRTa8
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/262_content.jpg

SHA256 c54ddf721c23aa7dea1c7021f5b4686833c8e446577973a95963f37311fda559
MD5 1504127b4fc07de9218663d23caa4001
SHA1 e1b8e430dda859ea344691b23a45feb2e83b73ea
SHA512 165aaf38f9e06bbd5b33b55ced6115d20a1cb844fba007f931c9dac0ac7301e7f6e2bcfcd2e014e4182b7507004f11f07858542f38b0a84136ebde6877bb5363
SSDEEP 3072:dhvkwaDQEfJosFkmDKleamKHQP76+xWrE:dWwaDnJLFFDWea076hrE
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/263.png

SHA256 070dbd76c779f8c3920cab3e81ab0601e019f9fdb84591fc609529878917c788
MD5 5aef9e3d635a71146df8e4dda8bc3033
SHA1 f0a7165a04ea975dcf12afabe06d612227a51810
SHA512 40068de1defdfa517ee919d874550f36d3a0a5b9189e5a41a6da0c9d906b81357ed5a7f4a11e0432190fc8eb23f512dfcba55815482fc8c891abdde613fa6309
SSDEEP 96:nAjA0F/E5FQ9gF2GK6q0j4PcO906w9KJbs1TqX45F2g6bwu:nCAu/E5GGK6q0kPcO6Z9OIIad2wu
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/263_content.jpg

SHA256 980874c2b47ceef36c681d0be9805dbf4b6c77480c11dfe7e71e52102edb3dd4
MD5 1c850bc299862e24a7e178c36697d79a
SHA1 bdc210555c746362ea2e1520afd0f4fdec926176
SHA512 29bdd0b4a4f502b6b658b09e5785c9fc7133ca034728f001af210b8036df136b903ba430e4dfe0cb2a8b65d5bcd191c18d1eb8a62f20ea1df2a125963702e048
SSDEEP 3072:hx8difKYxPBe+sVAbDMoPIkoI1zMp3NLkKyi6DohTOGQp6vMMV:0ifjpe+sy5P/1wpdAGFSWMU
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/264.png

SHA256 8a5cf6b791c2f437f8ff4486ddd52a84b3282d5f019399e5079c7ffea6cd28a0
MD5 beee7af07e33333cd09aa8818135ad24
SHA1 18413e7b31b29d243bc4e3c695124145e3517f81
SHA512 c2d5aa97de609f4c89c814c88e9d9a07d78df9d58ca6ec443c70eadb1f6390b020dccd73f4a24c4601cbc143ad799911d61fdd4728c8bb3b53cb75e396e56983
SSDEEP 768:qp9HYdPUbSepgLbj8KZY7W4MKVS/tCazxnq2EY:I94ubSepej8YY7WTRCazxq2N
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/264_content.jpg

SHA256 5b097d5503297ef1278625117c143142543d684896b41057a8c43d8ed70bb836
MD5 c234672c6b9426f68269a24ba2a00ff1
SHA1 76404bf92739e1bb7a0c6937da255b7be80862d6
SHA512 3a561c549434d3feaff5260818c110773f385656e2428fabc1b7d84eefc85f402a146ae65cf24c913e1eb18239b3b654de35c7619211b20f2bf18fbe3fcd210c
SSDEEP 3072:2lm0zrbBcg2v4bGrufNOnYT5MornPSh5cRPV8bf:2M6Bczv46KKYT5MeRPVY
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/270.png

SHA256 c429773134fbe3c08fbe2fbc1f819c80521b7ebcf22b73ccd387fc27eb86efd8
MD5 5cf69a0c849a645d7f3b286764f3efff
SHA1 5a605b14931aa71824c59b1b555002b7359fa525
SHA512 a325d2712865ae1614e79b87250899e97df8abd41f76b3a0100dbed2b9d8a1b2cc496237d3996dc88866a9142d7b01b8bd99531805f589bd0c1576b5f1404a21
SSDEEP 384:t4Mozsm8Mos2RV2Ru2Ectyk2lhJhc/tDYSRcr1r0v:/xm8MolwRu2xyk2jGDfRIk
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/270_content.jpg

SHA256 c7c3f397d1525b9ed12824a2377751199a2a281b45a78f0295bed6dd9bbe262b
MD5 bb4234c082b23fa7d0bde0bb80cde0c0
SHA1 35e868fa8699bc012008726c9e86cc46a9500ee7
SHA512 3282287564630769c73a6d79b14dec93b696521b66bad3c752b711102948a21562698194af6ebf464dfe1ea1b8348e09fffd648607f33ff26a577744c2dceb73
SSDEEP 3072:fC48yS1nqB44L8rbAeGIvT0NeSargly01FN5CornLkC:quInO44IrbAeGIv5SSIbN3rLkC
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/276.PNG

SHA256 2e7dfc188d3b79973d0ee3c70ed8c39091059f1b3e8c79491fb1d02adb3a567c
MD5 24ce486ca3d027d82e4cdb5d60d3d55b
SHA1 c42b77867a2b1d4325e0c63374497ac5a0332e6d
SHA512 53e3271b74feb8b893d8cf2ad0d55868c262677d792d79dfad315c45c8f4cbd5cbbe62547e2fea71a18d0d9a9647326dc11f92a31ab0c91b94890ee6c8821fbe
SSDEEP 384:RUOv8JJtHFNuobl33FZZyMlTf96EAX7DbyZtM58vHXic:FvGRPuohFZZy6YEiOjMq3ic
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/276_content.jpg

SHA256 45187ec68d11f57b4416df2cbd8407451f309885d885864a3d811fff86975cdb
MD5 ca139aa43b77ca4f61a306f80b318e19
SHA1 59b5f34368776267cf154330b2d4db4bac84aba1
SHA512 0289f170b7f520ba4e27298fda9bb994d0a1731919dfa07f2e50956906bbdab5c8284ed4c14ef71a9ee28b097197c5608a6f153ee539b85fe005357854b3ac3b
SSDEEP 1536:tllXTU+tzdkhIx/fKEPtK7Hr+Snm1E+AYW7h1M2e1Gd0JcRX7uUAg69scVwlWK99:dXTBtzdYy/ffsHrxmxAYWDM2AGd7B33f
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/288.PNG

SHA256 f08999bf7309939e6695a3bb0b9c7515b62132b5659c7766e2ac0508efd3b08f
MD5 1fd24202dc17896967bf3a29d0bad368
SHA1 f7a520cc514f8ca756845d16da041e2581f3cfe5
SHA512 2b2dd223643a34b2fae813d0142b9a4ea74876e01bc0aa9d0f9f0cd68aa6c5d688164403ff0d6bacf39314eb1a63266a55149d190944022c4e936f394413f575
SSDEEP 384:TFDvckJnZBQczxa0odf6tmmsjCCdmASDoyFIaCweQph/Ud:Fr8QPthsjbdmXDfIa9p1Ud
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/288_content.jpg

SHA256 047427bf813214edc5e1fb508afe913cae762159716b2292a007bccee0142335
MD5 e54d4a4b243b596020769c519a0dc31e
SHA1 d453a29c44670222fe6fe75f063214ad395fd6d6
SHA512 e65d74ddb46ef079507e8ea36e9c832b5f23d24eb0d84d3a7f33c4b1d3ff86b6f4971ecde6b63d4f066a393c6abf4a06dc2e80d6fd3aa0c56d5f4293edcd5ba6
SSDEEP 3072:VZDYPWbjEM+n1If758SuTawkHD3tJeEtJektcr1XRsFko:bn8018gwkjDeEt/cpRsCo
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/289.png

SHA256 11346fb10606a8378dcc4dbfb6246736504b5e638b86427ec8eea1046d74d255
MD5 293c43ad6fd188817cc569f91221589d
SHA1 ecbc4776cf902b9dbf7dcec9d09118c2a569eedb
SHA512 8d4d5e4f1989d4be73148cd4ca9e0eb105a0914d04d8762fb1e53db7896686c23724036bb167aef79ddfdb7454b1fc3b559dad30c0bbd837d63c16590c124885
SSDEEP 192:VVPNx9OrtXmL3MVVngIe0sv5FfWh9ONsIZUFczwLDTIOn:VZn0XmL3i9eHv3K9ONpaazw7H
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/289_content.jpg

SHA256 fd77e181cc3f1289148d8a13fe7770783f377f17e2d90eaf1cbb0ddc81ae9d04
MD5 c743ea3b2d60195718df8dbd8f852c68
SHA1 6724420db7d511a645c030e8fa5d29e01b3abaae
SHA512 fd8f3b013a5eb3bc2267231aa9647de67f0e48acb16fba82551dd3f0e124c6337ac17c9fdeba2c4753262948a9f30b53084b8bd881f9e27cd09befc9fa5c2055
SSDEEP 3072:zKDlGTZSw6Ej8P3NYVym8ubotBYV9qG/bF:uJEA8jImNbotBYV9qmF
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/302.PNG

SHA256 1538b8672bd843b4a79e90a8dabca952436d3d027ee18157db9caa5af8a6c1ec
MD5 96b38c6b2ce8d6b00c6fbd349d2a1261
SHA1 4634168e4895f09da74a70a01b9e7903ce90b7c2
SHA512 9c7fb6a4d27211891feef1de1388e8757792e172e62b0b60c6d277b5eb88f9f9d0601783b60bfe03a8e89f4096dc404672a47c8b2df8917a2c4abef2a32478ba
SSDEEP 192:z7mN89nghSYsuncZ4skSEeGBha92lvQ+bRE0z0TMJVilSUkh7BxrPWxnbq/N4dLe:z7my1gUYsuncyskSEphq2tZbRE0bj1N7
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/302_content.jpg

SHA256 bef116fa2a0f5dd4542ab560cae29110a034e09c5848b1fc9ddede12eb4bc857
MD5 f43d31019c40e1c7ba5358946485db59
SHA1 2ccdd64fdc9c4e30094c3e5fcfe31447d37706eb
SHA512 ba89eb3d54c7142b8d0e6d6050eae6c94d85c66a0679620a5422c817795764aea9012eded19bcf56399b2d7cf2746930a50d53a044b2b81f99ef44fbdfd000c2
SSDEEP 6144:KhjV+nsJNGPcIzK5rzi3hPH5G9n1LxIbzS99999VRfy:KhZrJNzIzKp6GHIbu99999a
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/309.PNG

SHA256 bb5066af8cde6bf03248cb7e939643d023b9ce8021c5c9c00f063667b23e1da1
MD5 86e55257b72487f1f7f9e46b1fe9a4e1
SHA1 4fe5f5f46df63e83dafc77b2c4a4279d481af025
SHA512 892c496d9d783ec4010fc3d5463bbc7f1a18256c5f3123daea46eb5c1204ada0773b1c692e6214b27c356cb35a1055ed09a740ab464e4aaebe74ce046c999ac5
SSDEEP 384:L2wwq0QVfB5Xig5Cuk37vn0R56H3AX0Cv3raLR:L2wwq0WBpeukz0IwPv3raLR
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/309_content.jpg

SHA256 354ee56fe9cef585f59baf20671fdc6c1dac3816e1d9d6adab9daff432df3f1d
MD5 340dd551b01d49132bb5c82f978cc093
SHA1 c63c66c554dd9f82ff7456106fe56fc815894d19
SHA512 1d2dc20792911de9b2616f97bedd4aae362e1e46de11efa63ccbae78ff9e768db110c02a7199837d1ae17bccaceb7f79c0cc6d57311a2bd23a4d8ad32d1a3f60
SSDEEP 3072:nv60moBKqLCibMqgQf69S/KttJjO4hoggUFOnSw:v60mYKqLfGJPJjO4hoggUc
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/310.png

SHA256 b3d524a6af167da94e04b35e0244a6ec45d2c7483eac294cf93770a04ead4552
MD5 84712c33b052759d467c8a086d8516e8
SHA1 d5e402ee83d34057bae3afa6f467d5003f839cf9
SHA512 171023e6fc149fe218ed0e080d28c682b7cc8a9f1076d2ee05a6b7a9a5c2ec74130b409bfa418b403b691bf2c8b401234048edc68e6ec9ddc95da1bec547ea13
SSDEEP 768:OFZz8UO9wV3RYX5u4aWGLgZBi86FaCnIBH5dqOYVwd:OFZobCCJ+hE88PcVi
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/310_content.jpg

SHA256 04e42301255cb2708fc794320f6115acbeb85cb5468758dc08ea61180c8f61ed
MD5 f05e85e109bc1d720633b675f35c52de
SHA1 7ade43ddb6b060e479a04aa88c69d3773fc33643
SHA512 cd049c5a0777ee350bb19f731188cc148aa194a595c14aa555b40ac2cb577b9f30c89f5e991ea866323cccf7a4850eaf09d63b670cccc8f24e40592e04ecfd59
SSDEEP 1536:ku8Dx1oo+qKA/EGxj8TE04rFg9Iv2ftNMReJf6tDikF/QHFxn981br:ku++qKA/Ewjnhv2wv+x9813
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/317.png

SHA256 cbab67027f3a1acc937005044d0e73a26fea7861afca0977124544c38e22ac83
MD5 7ed35652a270062e4c3e6f5cfe6b65b6
SHA1 ce980e5a47c16f7a02ded5af240923c46d38160f
SHA512 eb8d842d04c6c1b1ed6e5a7f60afc0814113cd4d52a9389021cdb33ea91e17d9956b0ca230fc45ee35871bf94ebc95cde1a7befc50c7b57e76072c3b5bf3d0e6
MD5 SHA1 SHA512

$SYSDIR/netrepair_article/317_content.jpg

SHA256 83c776a4927ff50f33144eab24965514463b82d78fd6daa0c6f128dd8621f333
MD5 4c87655368886067d85df0f20becdb85
SHA1 0b5ac11caf93fcb7033e525f1fdc758e7c0bc925
SHA512 fcd05476f6da1e1e38902f93737ba32405a9f39b7eb1f6f9b0b9b61beafb2fac5a41d5e67b73e5e29af2b5f9647dfb9414b458909f4c361214d533d462299258
SSDEEP 3072:s/fhakaEfCesO3D2JDpFK5I+S5TE0/5yg:sXwNxO3D2JDpFK5lS5TzRyg
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/333.png

SHA256 5562ea72ebf082e6634b5e284ffa1efa2a2c03c53df77633f0f19350ca8b9566
MD5 4d4ff3b12d1518590a327bd510e7d2d5
SHA1 9e52320caee8419c0bad69cdc19ac2504373568e
SHA512 fa1e053c8c17fd7221934c41e4d01bdfeee9b9fc552a52e042b7fa790a8cec030e1920c819ad97faeb1cdb6d9315678f36a82342bd541f7bf311998b900b45eb
SSDEEP 192:VZ+xbcetHT9u691l/x9ly/BGhyMPIfFFbU3GSh3Ya4mITdUXa9Oq:VOVtHxD9l6EY9Fha3Jqt
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/333_content.jpg

SHA256 e195caea075086cf43ad1d939363810d7d3e116aa8d2d6150f15f96c82bb38c3
MD5 bb21bfbcf03949750d99076121a3f1d7
SHA1 54d49176c43d99380efdeb6401c3597581ac5351
SHA512 5fd7f6e69c9df0dac290517679994fc0b093607a8c9e6fbdccb98cbc818dc7ae963f36eabd63b296dfcf1b87554d7451587d021cb29c30322813bd84870d90fa
SSDEEP 1536:w6zCJIhXP91xaOAy4YE9/FmXaPA95NjZ6UWxv8GGipm6Q9NKQ:zzD1l2oqYeUoGip9YNKQ
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/335.png

SHA256 ed107ad78c1896eded4d05c864db8899a4ff5f79153f96a56dca4170a80da9ff
MD5 8ac25ce54031cd19782e6c339fabdff4
SHA1 6650a8caf94872996466c0fd360670bfb25654dc
SHA512 6e92ef84e7f58553b5666f8bf1a7b737059b50c48f5ce07302aa183402fa2baef9a386f2dc603e16c0469361b794805888dc1da354ee9ba09aff07e45ee95d44
SSDEEP 96:TN9wk6rhxMt9P3HHcdYAd43dQHaGRPRi92FNU2BsYxyKZRkxNUsRam0lK39:x9wkghEP3HK63obRPPY2BsYxyoexWsRt
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/netrepair_article/335_content.jpg

SHA256 ff06d0af586e05f190fff1d8ad5b582d3a0c176a4b6c65e9e4f2a1a4405eafbb
MD5 dc63b733d62b9a3f0ff3f22d78f55c60
SHA1 20da600213e7d7ff1cda2dc7381755fc5dc590d2
SHA512 577986bf6483109a56bafda54882ac901d3fa21681e0e9a17b03015abeb69856d9865927998082988d903a09f4e15d774099b188311ccf69e56394828afb7e61
SSDEEP 6144:uxzV6XWVwGcF11Sgy5kBAvt/uackB/P2+AaX:equwVF11dyEM/u/kBR
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/css/help2dCode.css

SHA256 d9a9b3ce55795509b81f12c5de0b4d632c84b1f8cdb7f7dec1171583de0bc2f8
MD5 3f14cb850cf36a94db94fbcbe229c002
SHA1 f71f2297d011f32a354349195af9f697ee443844
SHA512 248a54dea950f7dc3491e057e32c299c399cab6811db7d501f089de381e3716fa56fa08398ba4137db680d78861756ccf66606011c613ca05adc8a557d4aec85
MD5 SHA1 SHA512

$SYSDIR/nicdrvhelp/help2dCode.htm

SHA256 9e0afb09b8ac7967e987d3fccdfeceb1b5891c02fdbff2b2ff802a1168b9d83b
MD5 a324b1ce746a21c4386fb1f0e6ef45c2
SHA1 2e38240421033df0811d2798dfd9161cc40b82e1
SHA512 28cd12eca9e570a340e8299995205356c4f8202d4d96b7dfb19d629c9d1db15f6e3a0a3592a28d5a76556b2730ed7d18b8a423992bd0f4a0e83076261f2bd88a
MD5 SHA1 SHA512

polyglot

$SYSDIR/nicdrvhelp/images/box_r_bg.png

SHA256 287f90231d85c8f8bf478e37fc1e1c40b3718a0d8a6aef5b0f743bfe4b8e2be1
MD5 3dbab70f5dad982f915f2269f8d844c7
SHA1 560f89e373a7ea98421deb9f2d013a1aa8e61298
SHA512 932a77afa384dfe3e684b9fd89d6975b7a66474564a5ea7213c42dd19d6c94a68f45634da3cb8f5d40c9d58b148606939a1ad9c92462ca743701c1502d71de82
MD5 SHA1 SHA512

$SYSDIR/nicdrvhelp/images/box_r_img.png

SHA256 b511724fa5cf551efd2ca85e0cadc41dec34b0201ebc8cd962531e094e78bcb5
MD5 8d8d5be76217c2b7b338ce1245a6b910
SHA1 6633ab1a58de01ee8b612fe416f5446817e18162
SHA512 25c9c3789f22a59d2b9c03996bda8713e6945f4405a7c70a8d9e33bd701da662c3f5ec500bf2eb4a5bcf1f05749c5ddda0b5d1f2b5b66c0603e7c041662523e0
MD5 SHA1 SHA512

$SYSDIR/nicdrvhelp/images/image002.jpg

SHA256 eaf36795e3a73c84a2664c1abd83c87fd1cfb348a60739bc1642e75083c9ccdd
MD5 8a57afc52c504567a5ffe709db38911f
SHA1 b9b7bc0a0aa4f602613446140c5fc2aae4d6fd84
SHA512 bc9b4014ac16e031079cbff53fa2164a46fb79674c757b68d9c86b67c94c642b82216a4bacd31445cf499aad7de11e2b259ac849b27d3b581d15692278d97bb2
SSDEEP 3072:YpeXRYaj0lzWIZrkyWIscX9T/oP8jupHcSgm+FFroqQc4n:Yp+Y0cW2rR5oPMmHkMqr4n
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image004.jpg

SHA256 44246af85492dc2f43593504f7cf2292abf374f6744b8f3fdd9caaa118f67982
MD5 6777529311e640c61008c3f14aad77bb
SHA1 ab8e14ffd655370cf18b8231c8d4ea76fc6e14ff
SHA512 0c92cf9554bf2872e6376ee5c96a58a3a348e250c8950657d258a8afc2edb8ecb8c10cabdfa8643f5d14880fc8ad0ab956c666b3886dade953dab6599ff6e2c3
SSDEEP 768:eyVbpREQQRiENhDj47FTsppwuBruIlXCUp4A46y3/xkpp8A2RNdQDA9C0X1vg1X6:eyVdR1ENhctsHwuBTt+53mpp8nQMw0Xz
MD5 SHA1 SHA512 SSDEEP

Extracted URLs

qr http://www.baidu.com/baidu?word=PCI

$SYSDIR/nicdrvhelp/images/image006.jpg

SHA256 c4df5eecce24da81fd64f6fc800b709b723345d14921a7c932c26237d43ac1f7
MD5 9e09f90b75285a4ed9656ed399617638
SHA1 8eb0d942b8138ef91cb8aea97aeaca8c60945e17
SHA512 4b1bd2c3cb4c18440ffaf6a5af2ac9b897a45bc47f24cff4610cb5117e5dbe9e73c7ddc5d7e3f6470076550c62d2252374361c20960191ac5f067e12ed475be8
SSDEEP 384:72mswunFzdm5KfnmPBTaTKR/ZsMYLmYI0E3/zstex7FIQQLy8L9XBq8Bb:72mswundEKOa9qvzseRr4L9XBq8p
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image008.jpg

SHA256 7682968f1243bb38083f87eecaaf41c2c8d254d30c28f8db7fbd8b8bf0ef9098
MD5 06ccd8a33ca34f3505d31b46c2ef317e
SHA1 25f5c1d1af20c1c1295006583dd4df802be3614a
SHA512 b9d798b9f9bd9cc112d49b84368b54ff51a9b7b22082627ecc3a7f63c8722cd0ce8c6639069993cb8594409c5a4a5227befd2e4a7dd93f151f2316d42f256627
SSDEEP 192:jiBL4LD/a9uZpNSWqIPz1ZFtWUuq5IZNMJ2hjoc0b0wiQMD/Tg:jeL4LDdZjzr2S2hjRHtQYc
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image010.jpg

SHA256 49e21fe2d1448f4a5ac05085e2306a7170ca36bba59247dff530d0a902fbdff8
MD5 9a3648be3eb90e0e765c60967081c21f
SHA1 bad397fbc91d9b99996fcaff8c83d2732dec55f2
SHA512 560ee0cd8c91d509970688fe30e7ce0f3cab8875d3103a75b40a48d7c32329323f8169e7bef46cf6200f4e57a75e0ae4b0fcad8cbfe17b3c1569f6042fed9ffe
SSDEEP 384:D27N1B6KEOfiJ41o2+xudtxFns0Sq1tiHcSb7vKVvsnh3S5mLyDvQntZ/qJYYPmK:D2xjvfiJULxF+8FSb7vRGEUvuCcK
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image012.jpg

SHA256 d5e57ae4f1db69b260c83d8ccab6ccc32e0243372d8091f602665aa811a2bf42
MD5 d840549d05ce909fd30e31392c1d91a7
SHA1 2dce6e80a6c7784dc036ebe38f8ccb58190e903d
SHA512 5b89e6a72dfa88a01a95e93c58dd06fc7e2f6093fedb9f918a3abd422d2c8f88d08c6f703a74f6c385e6c66edb21295c66c88f467aef517e57b776cacc24a47f
SSDEEP 384:eIsFxqx5xoXEAKhHmEKs9PFudt7vnAiVQtWQ+qxuUuOWkElbvkgC1DQA9d0E:eJxqx5xoUAKhpKs99It7vAUdhOWkElLo
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image014.jpg

SHA256 21c0fb2028a6c943ec7b5e5473e296949053027b4508fb20a63fdf0f42d4cb66
MD5 73a50638b6094b4496058f6e0bf05767
SHA1 dc1c3686347fd4b8024fac27bb258bfc0bb0166d
SHA512 046ea34662b765fed3224cf3c6593567756bcfe470928c2fc962b781b051093e98f73de45e45817219323fd9760394d9603d38b67ab070a01e45e7f19c4b02eb
SSDEEP 192:/4Rbbbbbb5nM7OyMbEOpI4QIhuyZYuUQh6ZHykFPj7TI4dFue5ohfhKa1iwNaZ5m:/eMXYSOco6DBfue5ika3Ucuid555l
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image016.jpg

SHA256 aa42b7170619e6adacac68f6fe4ffcb9176079f523fbc43710823528c3e4c83f
MD5 6bedfc228e6ab3af140b81c259f04bf3
SHA1 d8636658c53603fb78ccfbc14367b8bfb8ff93a1
SHA512 cc4f8ec089496d8e2a9cdc98625ee6e592f01f188c133becac12281a0d4803eacfaae751a4020e592514d4f3164fbfd3a32b4950e24770f3d93e21940d391809
SSDEEP 768:rJ2Y1O3gAtJvITy594BxT8bsD09KJ3Xp//J/YoVhGUP:rJ2pgov594fAb+J3Xp//JJVYUP
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image0161.jpg

SHA256 180b8b97b59a5e225f78d7ea7e89831b424bf405398ec40280e4177648699632
MD5 ec4154bca8a9a1479a819464edc5c72a
SHA1 44bdc7c3b8e64d92815888c8987def3f899e6224
SHA512 2d396c5d781c0a352ff44f86b3bfa95ada672dff5269fd5588fc2091a6db539b24c854d941ed6790528ff5ac4ea6a93721d0913089723855e261c03ff53e0534
SSDEEP 768:NJ2Y1O3gAtJvITy594BxT8bsD09KJ3Xp//J/YoVhGUP:NJ2pgov594fAb+J3Xp//JJVYUP
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image018.jpg

SHA256 e9521d556071a24afeebf6564e183cdd04b82e61de04272099d1ca97dd6390f8
MD5 bcdda04244c2dd50405d55cac3d4b5e9
SHA1 1dd3578870e3b83672cd90f015da04ae64fdd83f
SHA512 f3f8b1ef315d96b5c8ccc5c4710476d06176f43e1f128e8bbd72072944ca644da4a0e8736a00ca5179a3a780644cc8348198ab4b6b0c274825ea417b4390721a
SSDEEP 768:gImngKxSxvjGor4WZzMul/F6f63Gk+vj1+L6LOixecODyUHS:g1jwxvjGKrCEIB1Fey
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image0181.jpg

SHA256 961cba80a94d28d22a39951d3beddd5b69e7ef209a1a8148ba918f4e11c01493
MD5 617ca6a25ecf856835e3e39be421ac1b
SHA1 8c98deac0e1cff650175e80a5cfa212f2cc1666f
SHA512 c9f7832b5146a4e8757e920f5a9f68412aeef97096ad6acb99c137f2c98e639dc676de098739df42cee3dd11463d6a4bd1a823a20ce250964b4900d7331ff50b
SSDEEP 768:7G73lrGZwpZ75kZS4zjypwXA9mcGwDOPGPjPIcAoO4Rr1Wb9qgo2q:7G73oZ275eNygA7G5GPjPIcwoz
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image020.jpg

SHA256 a720a1cdeabb6a92f51358ec91d72ebecc095112b11c07b9468cb45843ce0e9d
MD5 908d92dafcee0cc6aeaece136766e710
SHA1 6fb2c21f32583cb89cea0d5fc267e52d4dcdc343
SHA512 6eddc3773d637ad39b096c2b0098a16978a4db9e18e917113dbe52e1e0a59a2e07a438516bfed69d0c51040d0cccc638feb5bbba521757f8fd80e0adcc5cfd52
SSDEEP 384:srLDJQefIYQMMffZXSrX+Fi/g5PWRER2y:sZefhXSrVgNWRER2y
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image0201.jpg

SHA256 b646ad039dd83e416e9feef4185e5250cd58500a2efc07aa9c1f4a63b6427b47
MD5 2827f72021ab20d5575122302571c710
SHA1 b8570e3fa45f0607e92beef84b342d424b8599c5
SHA512 b4b24bd1936d8cd3e276280f49c69794d2a631f525cd09583656b91a30aa1dce0e59101cf95ebfe8825fe4732cdc957bcbad035ddc2fab1c3e9f4e9f0e46b112
SSDEEP 384:RAQrHuxjZEYL7c0BN7YChmoJlNFRgO2QxPVG7c++n6IG1gMMMy:RA2MEYL7r37vhbln6O2QxP9JG1gMMMy
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image022.gif

SHA256 99e6ffa313e89b3435e4663e9a31b97771efa413cc2d046a0d10e33e10b4c57e
MD5 25eec3f8ffa79fb69156cf859d342071
SHA1 762c2214f8e46cd0615aa30a4f3e20364b5f02eb
SHA512 96a969baae2fe7aa7687d4075f2da0e24de78d5557b9b2bfc4cf0b32b48515254d0aef4a7b35fe513c8978a58b8e4b0ad050cb467faa0e46a4fed1a1aecd5050
SSDEEP 1536:asPsPfCTLLcxEiIdQ0mOsOkePZe94b7ReFJFYUC8g5Ovxyr:vk3KXp6FOsOkeheqoFr/MOvxE
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/image022.jpg

SHA256 6a1ece2f9248658ebc27c55935e4975ba383cbdafa7b4cb75c9fdcfb1d53d09e
MD5 d080dfaf90f877601347ef7a1844b282
SHA1 dc9e9e9c6331e5b66be834e90b39f2e9591bcb7a
SHA512 d10a7d5db2f5f708fe230213736bca21f28894e7c97cf5e1f7dbfeb62d12b3cd36c4046e89702ed0031f734b735ed9df4c4b735514e711bfef72d4531b1fea4e
SSDEEP 1536:CqF4xvZym4eI9NnncaWQy5w+Xz5IBYIvQXlRAd9:GjXAND+jEVvQXlRAz
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/images/rollingBar41.png

SHA256 f7000e2d660e6ba626af7d2509e96d61b471b880b0566c97ce634c0160645a87
MD5 46815e9ab2764d2f29f209e75f763051
SHA1 a5ed90adb7957fba710afce81763e3af03291f91
SHA512 1af6cdfc6bb4224b3de5079e9a154eb866009a7b69c33072b7253b947db94d8328e92485ce04fad5c985b0c77e3a7ff340ae8f2159b2a9787302db8d1c694359
MD5 SHA1 SHA512

$SYSDIR/nicdrvhelp/images/rollingBar_bg41.png

SHA256 10a8617e3501b5bab1400bd653c050e5ae6af5d78c9ac61f2facb563d26bb12a
MD5 e24f9c3c788ba561341cda45f5b3170f
SHA1 e883de2fc023ab00e0b4d85f02295c53b936898f
SHA512 eb384342e1116df44212cb445d8fa2f895617a65ab20c03c8d05e715f77dae6b3cf40279a419123a9c22c1512f240e73886b511c70563c55b98e5625a2c37c94
MD5 SHA1 SHA512

$SYSDIR/nicdrvhelp/images/rollingBarbom_bg41.png

SHA256 8dd58cc37900c8a12710085fb60cf1b1f678f4afbf7c35b092f8d81692461b30
MD5 907602306b4360f03e051ebeacdd9fe5
SHA1 233c89c141a3350615e5cb09329f9b8bb29cd4ec
SHA512 16e5286a5e2f1ba3f9d4306be90b44b68505a08d1d382b47bca33169c45593728ff4fa3462426c55b80f745a55e2a35100adad3ba82fa48b71108d466344b3cc
MD5 SHA1 SHA512

$SYSDIR/nicdrvhelp/js/jquery-1.7.1.min.js

SHA256 1615cb6617724e404c81c0775841c2e31c860a0657b594a0f30179663c6fbff1
MD5 6f6dbd2d7859a7f4316ae3749c552278
SHA1 266a76ad6d1c60a91ca3dd1262fd0f858ea1a770
SHA512 64fd00c649a2c8e786f7df6f9c937d2f594b860aa9ece1baeb33b1eda0c5bdae98dfad8ec2b67d63861a32e7be9ec82142b1315b331f32076e3b10ec69416d88
SSDEEP 1536:25RKUpVgklsdbuLP/l+0fGzA8gmtajgx/c9Rzzi4yff8qeLvHHEjam7rSYmBn9gn:2e8FbGzA8y+x8Ri1Z3
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/nicdrvhelp/js/jquery.tinyscrollbar.js

SHA256 ef36174f9c2474a6bf1785b271ed5050c68089e16d4273bd7cf3ae7862ab63aa
MD5 8ca9d4a99c324bef8742b8908f284d85
SHA1 28978c9db95265f727d82f8d4bfeb9efb07fccc7
SHA512 d02af83d0264a333f1b7a6a7cf61b6138bc33d2d984c45d9dddb34e005e638a491c20b0c4df3635168df040324c5ff1079b6f4f1d82fff7b9e93370d7b755ec3
SSDEEP 96:bQ8i8NMM2lEl3gPy4dHatWWGPRGR0cCKqmKmmzA:di8UlEl3UVHathhlKk
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/officetemplate.kid

SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
MD5 7215ee9c7d9dc229d2921a40e899ec5f
SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
MD5 SHA1 SHA512

$SYSDIR/plugins/example-source.zip

SHA256 7bdee0c943de548e43e380d03d7f1a80e627ad71092c66629c83cc6488aa9494
MD5 3290b211c5f3cf6b31e769009500b512
SHA1 d80011096282fb335752030a601d8e1445c4cb2a
SHA512 29543ec819d31da0927731cdcedf5a87c51597dbf5ed951d2e0661ce3dbfc3e3daa35b856a34bb805a340b12e00aadd9e071846f0964bf14283169f33172f815
SSDEEP 192:uBtQLwCl5n9VH4vtzh2CZ+vaNfAE1tjXag4dyqWpmjMwziBaXn:M+LXIv1JAv2fpr0BW0jMHa3
MD5 SHA1 SHA512 SSDEEP

SDK/plugin.cpp

SHA256 b0588783e348aab0de1db3833e37287ef5f3e5b347c90e80fd6fff1b3057262a
MD5 a5a6faffb21f7fc2e253e4d31f810467
SHA1 13b53eb7c4cc437eb9b279f9f507db56c3dd1a14
SHA512 880451e16ab4bd9f183a831e93c3edba7ee674f2a9080d134362d6c13be012afa011fca7c06e06614f66401e76d489c1d980016b6807d2e8b6c5425ec078c885
MD5 SHA1 SHA512

SDK/plugin.h

SHA256 ed502fece235a0bc83e3c39faaf2b88d8ed2c144c4b8095c266a5169a11c28d5
MD5 98d303824a702bb20b47bfc5f807aeb6
SHA1 2153a291cd772e68014c3d76785b309bd8c60c82
SHA512 623f8ca77a27756003024fb7b5553526faf75a311b54987b9292880a8568ee8e83d4bb152f72da91c82f7f192067af2961a573957f216dc099fdf67476e40cac
MD5 SHA1 SHA512

SDK/supmail.tlb

SHA256 a06ffec56152242701fe9aecf6872d2f599b0c09b4eb643d3828caf2441b1398
MD5 4fa5466fad0f498e72038486376de410
SHA1 b811a3469d94892d18896d8f0399a67552e4ccc2
SHA512 ded3ea5ed4e6c12e48e9510eb766955c315a98f659049ae5cf5117773cb643d52195b02c54e3914e01e62eb2fec66cb893c1b0436070c76011ea33448ecb0e1a
MD5 SHA1 SHA512

example/example.sln

SHA256 ae4460ce149a1dce2654167773d5c56319b5f9b6b09c134bee73f1647dbf9cfe
MD5 457dfa6424c2b9d7511a2f6c32609259
SHA1 094324522676f1ac051f4e471098b52abe145165
SHA512 aede1bd16d63c5f9912f23874b3a6aedbcba843fd13a5c54d8bbdda9f7102c2c2d5e2ad02bc1a8e07b6421d467664eeebdeb2dd3ad079015dc68a4b912883ff6
MD5 SHA1 SHA512

example/example/dllmain.cpp

SHA256 4733956c69b80779087136fe503ef964f2d95ac19c416f9271d277f9feff7d7f
MD5 2e65c185fd47754bea6e201144592331
SHA1 64612af0507e33ddd3bf26661b15321f61270ab1
SHA512 ed9d6717c11ebc576ee358ed2990070268acc00a9060eca0fb6cb5348a6e9205b6fec52231f35b1fe185c57ff4b1927be1dc3e028f65a892aa53fa6f992a914a
MD5 SHA1 SHA512

example/example/example.cpp

SHA256 e484016211e70b81bb2b491a1d634d7d93d6ccc414abb9de6c4c824b6a1f12a1
MD5 dcd48149a4bee56d40565e83c95a8c80
SHA1 610867a1f859ac0d5be87b007d38df7da230382d
SHA512 2988c9fcf3a3c962b391e6c1d6c20fc1329a947eb3e194845f6b78cf9f077a18e2c7aeff4cda23e4a53d48b9a6350de55eb1922a9702ba02c1cfe3cfe6196923
MD5 SHA1 SHA512

example/example/example.def

SHA256 9d026a46097e9f4f1ba1bac2b4fad4b9e05f985b5db5e51f173ce4938ea52a41
MD5 e80147269650a0c11e91cce0cd00054c
SHA1 20ccd653680f6a2592365715d03eaa245bba5aef
SHA512 b9e4b7ac6a1cb194981b4c9b3218d42919988f7bffdac0e03e3f21575053a8a7d3fcf0a90e1c2445785d0d8c733e74ca45d058a7b66888bdeee4dbc98e0a3341
MD5 SHA1 SHA512

example/example/example.vcxproj

SHA256 61f361b088f446984489e60674aa4a5777979dca567a641012eb98de5b9e82c8
MD5 1758c5fe10f8c3968d7d892a41e97382
SHA1 ca1cf0cae9a4f9835efc87d52524d8b5ebcfed13
SHA512 18b5ea14d66fe4a2461e728f97ac1dc3c3fb2625925f4b2eb62c30722697bee4d973f9bb724ba19de46dd2987c92eaaaa460002001ee25d5537a80f94df4a30d
SSDEEP 96:xY0/zcpV6tfNkN7fR7TN7WRT2YyaLbyaLMyaL6yaLDmPsOB9UA6zXA6O7VAsj9UN:xx/zcK4NVIwbcC9Cgm
MD5 SHA1 SHA512 SSDEEP

example/example/example.vcxproj.user

SHA256 c06a75b13f855a94d46616796e024c52b499f8f92cf00ccb571ddbc6ff574676
MD5 244d056f5e959be6d9a2f7e94686f1c8
SHA1 3ba38385380485d9ff25eb142eca0a01d8ce2fab
SHA512 8d5c4c9e54c85c90224f7610fef69d9c7e8d0db6be369181ebed13e2be9c86b651a438f1978f99c3ef432a8cb6bc5b8df26c476e7e5b32511d0d31cd49b55f20
MD5 SHA1 SHA512

example/example/plugin.cpp

SHA256 dbde129885d4d778ce194a9a32e51066cbf4ceb29188f32f2e60cf12817645db
MD5 7e5c5902a8da431970247ef852911205
SHA1 6ac940409bc462736ae073ebb1c0b82b46acaeed
SHA512 fb3fe0f6cc76bfe19ba352fa0efd8c5699616a3f15f5f456fef0dd2440efcfce5d6a29656fc208f20c435f44d0a64a10cb729592e9b0ac65ffced293da04c1ff
MD5 SHA1 SHA512

example/example/stdafx.cpp

SHA256 795fe0c43899da4a61cc1cf24891fae95ad0424e75607dc07d17f735df017e6e
MD5 8233420b9c9da6244bd62d13273d3d38
SHA1 575822d632b5475de3a1fc05746e4b0712444e3a
SHA512 7c98b408601078421a05e3fc3782b0a816c3de02de1fc8edb05f43b3f71d963493285a43a18689ddff3ddd14f70d3536e80155745e10b2894e56fe0e7d0510b8
MD5 SHA1 SHA512

example/example/stdafx.h

SHA256 8d49a4f97b5eb5e6bfa1b3599abacfb96a9a54aaecc9356a1d6ed9aab8607ec1
MD5 8cc1eefccdf63b03c2ba85c624e28532
SHA1 f86e666a003bb7b0a4ddcaa5cdc7eeef18d0d9df
SHA512 c42abf246b3990325534859a93d5429b2ac8e185293fecd139813d555853b84d5a989f5363e6dd6b8164a343592262f5a1a8e21f3fec22d04e82c37c59a57568
MD5 SHA1 SHA512

example/example/targetver.h

SHA256 6380d54c82813708ce52e3b849417015db9e56ae158198d0a4c7f6d238b5aabd
MD5 88de99acc24c0f38b4ae3399f70e67a3
SHA1 480ebd7ea022416eeb83cce39cacddcac9e103a5
SHA512 19777d81c162094e948380fc4dd00ba286a88d37d6c6dafdb0e69ad95958218097182b8844e2aee3f1a91668d0b18296a84c94b26e48d0bb31dfacce0a120e18
MD5 SHA1 SHA512

$SYSDIR/plugins/example.dll

IMPHASH eb0147b53793f5f2815033cc0a9da907
SHA256 1906404604997145087644bd19b900f486f3c15d1010d3e78cb07f21c58bc4b8
MD5 649209a69c6503649b62d9564d9f36bb
SHA1 baf28021dff23a2a5e85aa7c2a9b78c062b0ab57
SHA512 5a199cf093781bcb74266b021cae9935228941c215184a4092c5b857fc847d3a718b932a6b07e270b8825e891a9134d4dd082baf549ba5964591d20c470670b5
SSDEEP 1536:lljB1RpnNQPo2PfzIw27wxPFCIrjgAthdAXGYzcPx7/9Pxi:lRB1Rpnkcw28WIfgATdAXGoMxbRxi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Digest

2d:fe:81:9f:1d:cb:20:af:66:09:27:9e:35:88:30:7f:20:b6:75:0b:be:38:9e:e6:76:51:08:4e:18:e3:1e:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=天津市河北区维乐科技服务中心,OU=天津市河北区维乐科技服务中心,O=天津市河北区维乐科技服务中心,L=天津市,ST=天津市,C=CN

Chains

Jun 2, 2023

CN=天津市河北区维乐科技服务中心,OU=天津市河北区维乐科技服务中心,O=天津市河北区维乐科技服务中心,L=天津市,ST=天津市,C=CN

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Digest

c4:ca:a4:87:36:2a:7a:84:8f:e1:fe:4c:52:f0:6e:42:2f:2a:64:98

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=天津市河北区维乐科技服务中心,OU=天津市河北区维乐科技服务中心,O=天津市河北区维乐科技服务中心,L=天津市,ST=天津市,C=CN

Chains

Jun 2, 2023

CN=天津市河北区维乐科技服务中心,OU=天津市河北区维乐科技服务中心,O=天津市河北区维乐科技服务中心,L=天津市,ST=天津市,C=CN

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Serial Number

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 17, 2018 - May 18, 2027

Subject

CN=天津市河北区维乐科技服务中心,OU=天津市河北区维乐科技服务中心,O=天津市河北区维乐科技服务中心,L=天津市,ST=天津市,C=CN

Serial Number

3f:38:3d:07:b4:58:ec:04:e0:19:15:66:10:91:76:0c

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 15, 2021 - Mar 14, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Serial Number

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 17, 2018 - May 18, 2027

Subject

CN=天津市河北区维乐科技服务中心,OU=天津市河北区维乐科技服务中心,O=天津市河北区维乐科技服务中心,L=天津市,ST=天津市,C=CN

Serial Number

3f:38:3d:07:b4:58:ec:04:e0:19:15:66:10:91:76:0c

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 15, 2021 - Mar 14, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

2

Major OS version

5

Entry point

6484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

$SYSDIR/plugins/ipchanger.dll

IMPHASH b2e0270042574684db93297d807b9296
SHA256 b8976ff285acc5c84f4c79eaa898432e96f1b152e4b314f84cb4501bc9e1b054
MD5 c45eb9645293d77cedec43c18cc0f4ee
SHA1 e9110062a87f50dab61fa764da698048f6c3160d
SHA512 7301e0ede37fd6e3e8e45f9ac2cbf39fba76050a09ebfc3201b798fe377f11a16c367ca03af01199436270aced740efb747a91c9497cb9baf0aac1cc28ec5720
SSDEEP 6144:iz3ZfxqAbkAE4A2T6kz1qsJktRnxny4ePB5:mtAAbkr4Ar6XKtRo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

94704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

FlsSetValue GetCommandLineA HeapAlloc HeapFree RtlLookupFunctionEntry RtlUnwindEx ExitProcess RaiseException RtlPcToFileHeader HeapReAlloc HeapSize HeapQueryInformation TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext EncodePointer DecodePointer FlsGetValue FlsFree FlsAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA GetCurrentProcess FlushFileBuffers SetFilePointer WriteFile GlobalFlags WritePrivateProfileStringW SetErrorMode TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue GlobalHandle GlobalReAlloc TlsAlloc InitializeCriticalSection EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc FormatMessageW LocalFree MulDiv GlobalFindAtomW GetVersionExW LoadLibraryW CompareStringW LoadLibraryA GetVersionExA lstrlenW GlobalUnlock GlobalFree FreeResource lstrlenA GetCurrentProcessId GlobalAddAtomW CloseHandle GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryExW WideCharToMultiByte MultiByteToWideChar GlobalLock lstrcmpW GlobalAlloc FreeLibrary GetModuleHandleW GetProcAddress GetPrivateProfileIntW FindResourceW LoadResource LockResource SizeofResource GetModuleFileNameW GetTickCount FormatMessageA GetLastError Sleep FreeEnvironmentStringsA SetLastError

user32

SetWindowLongPtrW UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow UpdateWindow GetClientRect GetSubMenu GetMenuItemID GetMenuItemCount CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect PtInRect GetMenu SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetSystemMetrics SetWindowPos SetFocus GetDlgCtrlID SetWindowTextW IsDialogMessageW SetDlgItemTextW SendDlgItemMessageW GetWindow GetDesktopWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetDlgItem GetNextDlgTabItem EndDialog GetWindowLongW GetLastActivePopup IsWindowEnabled MessageBoxW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus SetCapture SendMessageW ReleaseCapture ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem PostMessageW PostQuitMessage EnableWindow GetWindowThreadProcessId GetParent GetClassNameW FindWindowW GetWindowTextW FindWindowExW DestroyMenu LoadCursorW GetSysColorBrush EndPaint BeginPaint ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW UnregisterClassW RegisterWindowMessageW LoadIconW SendDlgItemMessageA WinHelpW GetCapture GetClassLongPtrW SetPropW GetPropW RemovePropW GetForegroundWindow GetTopWindow ShowWindow GetWindowLongPtrW

gdi32

DeleteObject PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx SetMapMode DeleteDC GetStockObject SetBkColor RestoreDC SaveDC GetDeviceCaps ScaleWindowExtEx CreateBitmap SetTextColor GetClipBox GetObjectW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey

shlwapi

PathFindExtensionW PathRemoveExtensionW PathFindFileNameW

oleaut32

VariantInit SysAllocString VariantClear SysStringLen SysFreeString VariantChangeType

oleacc

LresultFromObject CreateStdAccessibleObject

$SYSDIR/plugins/mx_163.dll

IMPHASH 0dae0dc424b80035a5325d2dc68a8bc4
SHA256 5e292af961082f635f6c133b8431ff9b1aa690cc264a421a07b6f5d8705d0b5b
MD5 02218aefb6730a385267ac643077c8be
SHA1 a1af0d794135cfa5001d3fbf1fb45bf8a69cf027
SHA512 bc7aabb16b1e7b7fa3b9ccc3ae8f13eb4e491cc809b7f77d92c87e8853669c6ef8a9b8a5422626c412ea101d29717d71c0b65cf3a5f564295b276cecc18e59e9
SSDEEP 768:cPKwzF0VYEVLeFIeliQzmF25JEvM7zkunA6EbbZpvH5xZ13xX83piS9jc:NwzF0bUVC25JEvMXkOA6ObHvZxspiS9c
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

5836

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

$SYSDIR/popup/deskshorthint/50000.xml

SHA256 ab1e32f2140529a1b3923b098c0d2caddbf7002b1c8391f5a7c9034bb57bf2a7
MD5 c2d60163b52972a5387b276d595bb284
SHA1 5a59029543dbe1d2f19e8f572ee209a87fe0c4ee
SHA512 d693db6fbe21081c4c33e2c6931200e12dc8a1a198d447154855cfe205e209be70a31439e1c3c0fae7ec75fdbc7d3cc7971eab30cd639fd1a19d68019a67fc07
MD5 SHA1 SHA512

$SYSDIR/popup/deskshorthint/5009.png

SHA256 cecec9d953db6a99a0cc4c0b40d44b92335ea4b4e8b8b843dbee76718902a67b
MD5 101eb3697508932010d6706d2e542446
SHA1 73c78a2f473b5aafe6561459468bcb1aeb0a751a
SHA512 d2729dae0152cc625988d0ca003683ff8619d7550a49f1af6cf3a2a84d0a33503d050ed79fc85bf52edd828b4d8b95395e44d881e9fed56dd3364cb0621e9e3d
MD5 SHA1 SHA512

$SYSDIR/popup/deskshorthint/5010.png

SHA256 9f79f8ebdd1e3bd34b1e62ddf1b9b0924235b80c715774f1ea33f839563b8913
MD5 8c023a8909ec0c86394515a2fcde8925
SHA1 a9c9cdb7c908d3f7a5b53fe9b650853395fab351
SHA512 9a54f5e624cfce0cb6fd64bdfeda745d789b4ba7a7e784f48981716493bf9a3677e813866c9a85289d36b5e87330612a18f14a27d30537b1ddc817bfda10f359
MD5 SHA1 SHA512

$SYSDIR/popup/deskshorthint/btn.png

SHA256 7a46b3fb222fa4cf514a0928b62544b06b47742e3e5bf19689ab224da7b4a9b4
MD5 1f366b2c85d10838fdfcbbc772e05728
SHA1 fca7f056f294623f3381705f5efc29646aa69d1a
SHA512 3656029c08b7c370470d21756f6be32a581355c4cb69f8e70a86385cf1f5e468f5e431a0f51dbf3b6ac5d6d5e235155c3a67414050a80c4ffad3236c341a05b6
SSDEEP 96:xSMllcHitlIxv9vk7C1+I4wWHLihk/xfp8cgeqGjAZ+25NbI3e6xNN:xSHIIHUCD4waf8P6M+25e3e8
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/popup/deskshorthint/cfg.ini

SHA256 4a3aac244015b34d7107b65b705323a6e7123f46d39a466badfb5f5eb597da4f
MD5 ec293c82661f203a8c6fffe4569f46db
SHA1 2960ba21bf5d9c11b89d59d36f98f4e6a3f726e0
SHA512 7a2517c678e97dacec1b2b993c7b709d8dd112942f6db39700f8eba3bf3d21a802a82963bf99dc4a5c7dce17d2d62c8ade96b579cd9f3ce508bb22ff90ca388a
MD5 SHA1 SHA512

$SYSDIR/popup/deskshorthint/index.html

SHA256 57b6f3606cccf3afae031ff16462068eee61a38e92edd28b03d9ef8e29c55d86
MD5 080d7cecd5819c66a85a3f7eb012dfea
SHA1 f2bbed4586a42f7d7a050a18f749404bbacc6347
SHA512 c36af3b42836a5b093671a5721ff43c875235f96b17f13f421a95f90c50e1b6213de2c10ac025ec0fbdcf91290d5aed1d0ece73966594f6dcb7aa049ac32f8e5
SSDEEP 192:rSxW9m6vXTXAWH6cXVCOuOnHNTDO6/J9d:rSxGmzUHNTH7
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/popup/deskshorthint/kcmpp.dat

SHA256 a6f4254c4094be4543a7400e0f4e572d134e30e698bf406e48d2dc36cea3b91b
MD5 cda4eb72a9b71a02844f6fb1f24dca03
SHA1 7668cd5b00670bff8f85a88e9ffa5af760636efc
SHA512 8970e36a7bcf9238e79007993787561b726a6b042f087af57229becd0d8b722f669987892ef602ab2919d819bc4a35431c69da6ef3b83a2695cc118fddba0ad3
MD5 SHA1 SHA512

$SYSDIR/popup/deskshorthint/shortcut.xml

SHA256 f380f5204e332c77acc1d602b54187fa04c870e32803c346fc0326a4d5741ffb
MD5 a3d162a321207a79c97fd8ac4128cf28
SHA1 a975f4fdf9a220eb20765d564af95e65b8df6970
SHA512 edc767e9a7f85b22a4baa6bada71f011b3e04090458e029cf32f7df1e08c080cef9917ecde9449a87aeda64c2a01a83bc966ec61b7956d0f2f87ad3ec3144b5c
MD5 SHA1 SHA512

$SYSDIR/popup/deskshorthint/tips.png

SHA256 c0abe61a4dba73764984014f3703e87e21aad6a6ef30bd43f6fca7b009449ae8
MD5 5413a09063524c326d0063fef190d674
SHA1 4af5774492276c5edeab6638d334f274468557d3
SHA512 baac79dbbfa44484beaa77315d273f2f6d003700928688e3935dca349d2bc9169e6e5d2646813e2e1a6bad0e06d7ae6861c298382163ae1b53dfba24370c5683
SSDEEP 96:k3ScqCoOGpI/DC7k0S9d60fkkEPtVNN0T8sCBzNlFMoJe3FxMk/S4ijAQXs4ihZw:k3lGBpIulSz613NNS8sCFNlFvJeVicGN
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/rarnew.dat

SHA256 4301ec2e9592e7a22262d1c046954545033b73be322b33a8117d201556c4254b
MD5 c69d0b5902a959577c02e9dcdda77de0
SHA1 6233724f8b3ac18649dc248d1c778e2bca78a7f2
SHA512 2e8945172ef567d4ae84d6317efce63502a6d9496caa48b8dc09cf12d1ceec3e89d033d6d9fceeba82f403107d15341bcdb72b4a6f60ba3e6df4d2a2cb6e48cd
MD5 SHA1 SHA512

$SYSDIR/return/使用说明.txt

SHA256 012ceb02047df07f690fac19d306df2934a036278e77732ed25a1aee69e99e96
MD5 123adb8bfea3cc5aa42245774799dd05
SHA1 e158cee9bdf7dac783b68dcce6c5d0ce24ef8c97
SHA512 44edd5e5b4d7214cd81a8fde5d7c821f6bb5d9d6500b31d8e87e71a78f1e8cd2669c8b56b94c5de15a88e47c66ae41d23ad43ac66f960a61e270c97da45f8d88
MD5 SHA1 SHA512

$SYSDIR/temp/error.log

SHA256 08e65e7de19fb98e0e590105494bb332c0d9c5ca8c7788f34b434efcd3824288
MD5 e1f307384a185fba442b72d2b9a6d2f1
SHA1 601ba24bc10ab48462e1699cf9aa830d17a95db7
SHA512 94d4b42be19b3fe6121644e48176bdd0958357c5637cd7b204a080266eec30917a6aa93118ee7ac4e820f545194e2a08aedb3d67d9e8881133449802ddaddd7f
SSDEEP 48:ca0Da0Da0Da0Da0Da0Da0Da0Daoa3a3a3a3a3ahahahahahahamamamamamamah9:EZZZZZZZ4666664fffffZnnnnn4
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/temp/ivdemail.txt

SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

$SYSDIR/temp/smtpcout.txt

SHA256 e5ab2e9f20e44f1b320552db9461e9053dc8826c4f13622529e1fe90c4db3923
MD5 3c3ce46cba4a5a0fe68aeed972e2ebac
SHA1 738a3823aa9f7c6c414c4bd5031388698bc697b8
SHA512 1ed9e33c01dc38b980d7b7bf8e65d7d4fa27fa0f2cb67ab0b7b057e5cf58dbb35a02f16d4def45f27403dd966aa39c838daeb3ebff575731dd3e554ada78eaee
SSDEEP 768:udlaus2XUJI0tHX4BMBDBI76ywtvNg9xIofICKcyM2gyJMoWHc11Icd:udl/SIg34ituaNWeoA9cHTyJMoWHcPJd
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/uplive.svr

SHA256 47fda5d1b50dc6433fdd1a03dd675217e68b11c054e22730ee8d8ceb7e71b409
MD5 5e24b7fb5782c4284e144aaf31014d55
SHA1 cc6016f0e5320842a101eac8fcfc3aa556591b06
SHA512 376fa8ec37b4d407b30387bdb32ee669d4a4ea48148169618ab97f9bac0a7efb174b0116c8cce7304505d40e9ef2a375b7740cc4c5d20ce904c5de105937a39e
MD5 SHA1 SHA512

$SYSDIR/uvcon.cfg

SHA256 bfef6dda690882a584563db70fb8d42fdc025c22abf4af4b974b316ed760cc69
MD5 c9cfc92108b39132b5d3070962a32343
SHA1 62850e81fecb8891e376cdf672e74728cf478d8f
SHA512 f252732cc27a3fe28dbcf96fb7fc4e857dcfe9d6797c941364582faefd2695286e88572a2095bb67ca7037b9d8c2fae005960473aaf9bc364b4328e52500c4ba
MD5 SHA1 SHA512

$SYSDIR/winoav3.dll

IMPHASH 032a268786866f8c08cfe9ace8b10aa8
SHA256 0e0efb65f52f8ae90f1227aafddb1bd23803229497fc82c5c458c8d6eb83a609
MD5 3ae42cb8a028c5be3f57575342bbb56d
SHA1 2939396b9069d4b46febc047b13ce2c30de7e886
SHA512 f4e5c0ff991fc907049171f8bc0ac763462e081b411547a3b24f7d57b51a73fb2c3d0a8daf5cccb0ddd8970ed5c81baf3a2c8e5b22eb3ccdc672a1e1aa01ae24
SSDEEP 196608:SPDuLJR9PL40/Rau8ik8lqRls5lzrZVlV03gHn4rj/L:vt8MYRlsDppf4rDL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

3b:c2:be:1f:17:ed:de:44:7b:d4:48:b0:98:18:d7:10:2e:c3:93:ac:2f:96:4c:3c:30:13:eb:a2:7f:ce:b8:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Dec 7, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

81:b8:95:86:ff:b2:35:35:6e:51:8b:b5:66:7b:f6:44:fe:19:77:8e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Dec 7, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

6663467

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

ioctlsocket getservbyport gethostbyaddr getservbyname select __WSAFDIsSet recv send getsockopt recvfrom sendto socket setsockopt shutdown closesocket ntohs WSACloseEvent WSACreateEvent WSAGetLastError inet_ntoa gethostname gethostbyname inet_addr WSACleanup WSAStartup ntohl getsockname getpeername listen connect WSAIoctl htons bind accept WSASetLastError htonl WSACancelBlockingCall

version

GetFileVersionInfoSizeA VerLanguageNameA VerLanguageNameW GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

netapi32

Netbios NetLocalGroupEnum NetApiBufferFree NetLocalGroupGetMembers NetUserEnum

rpcrt4

UuidFromStringA RpcStringFreeW UuidToStringW UuidCreate UuidFromStringW RpcStringFreeA UuidToStringA

kernel32

HeapFree HeapAlloc GetProcessHeap VirtualQuery FileTimeToSystemTime GetProcessTimes MulDiv lstrlenA DefineDosDeviceW LockResource LoadResource SizeofResource FindResourceExA EnumResourceLanguagesA GetSystemDefaultLangID GetUserDefaultLangID IsBadReadPtr lstrlenW GetPrivateProfileStringA GetShortPathNameW GetPrivateProfileIntW WritePrivateProfileStringW SetSystemPowerState CreateEventW ExpandEnvironmentStringsW GetPriorityClass FormatMessageW GetWindowsDirectoryW GetPrivateProfileIntA GetSystemDirectoryW lstrcpyA GetLongPathNameW CompareFileTime FindCloseChangeNotification FindFirstChangeNotificationA FindNextChangeNotification FileTimeToDosDateTime FileTimeToLocalFileTime LocalFileTimeToFileTime GetCurrentDirectoryA OutputDebugStringW FreeConsole WriteConsoleA GetStdHandle AllocConsole LockFile UnlockFile FindResourceA CreateSemaphoreA ReleaseSemaphore GlobalUnlock GlobalLock lstrcmpiA GlobalDeleteAtom ResumeThread SetThreadPriority SuspendThread lstrcpynA SystemTimeToFileTime GetFullPathNameA GetStringTypeExA GetThreadLocale GetShortPathNameA GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA TlsAlloc GlobalHandle TlsFree GlobalReAlloc TlsSetValue LocalReAlloc TlsGetValue GlobalSize GlobalFlags GetProcessVersion GetCPInfo GetOEMCP RtlUnwind RaiseException HeapReAlloc ExitProcess ExitThread SetStdHandle HeapSize FatalAppExitA LCMapStringA LCMapStringW GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr CompareStringA CompareStringW IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID GetStringTypeA GetStringTypeW SetHandleCount GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings FlushFileBuffers UnhandledExceptionFilter IsBadCodePtr SetConsoleCtrlHandler SetEnvironmentVariableA GetFileAttributesExA GetSystemInfo CreateThread GetModuleHandleW GetFileInformationByHandle SetEndOfFile RemoveDirectoryW SetFileTime GetFileType GetLogicalDriveStringsW GetVolumeInformationW OpenFileMappingA CreateFileMappingA MapViewOfFile UnmapViewOfFile ReleaseMutex EnumResourceNamesA FormatMessageA FindNextFileA MoveFileW GetDiskFreeSpaceA DefineDosDeviceA GetDiskFreeSpaceExA GlobalAlloc GlobalFree LocalAlloc GetSystemPowerStatus GetLogicalDriveStringsA OutputDebugStringA CreateMutexW OpenMutexW GetExitCodeProcess SetLastError SetFileAttributesW MoveFileExW SetPriorityClass GetFileAttributesExW OpenEventW GetFileTime CreateDirectoryW GetLocaleInfoW GetVersion QueryPerformanceCounter PeekNamedPipe TerminateThread FlushConsoleInputBuffer ReadConsoleInputA SetConsoleMode GetConsoleMode SetVolumeLabelA VirtualProtectEx WriteProcessMemory BackupWrite BackupRead BackupSeek VirtualProtect BeginUpdateResourceA UpdateResourceA EndUpdateResourceA EnumResourceTypesA GetThreadContext VirtualQueryEx InterlockedExchangeAdd ReadProcessMemory GetThreadPriority GetExitCodeThread QueryDosDeviceW GetModuleFileNameW GetCurrentDirectoryW SetCurrentDirectoryW LoadLibraryExW ReadFile InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventA CloseHandle SetEvent GetTickCount WaitForMultipleObjects DeviceIoControl CreateFileA GetProcAddress LoadLibraryA GetVersionExA MultiByteToWideChar FreeLibrary GetSystemDirectoryA LoadLibraryExA lstrcatA Sleep ResetEvent WaitForSingleObject GetCurrentProcessId GetLastError GetModuleHandleA DuplicateHandle GetCurrentProcess OpenProcess LocalFree WritePrivateProfileStringA GetPrivateProfileSectionA TerminateProcess GetCurrentThreadId GetCurrentThread SetUnhandledExceptionFilter SetErrorMode FreeLibraryAndExitThread OpenMutexA GetCommandLineA GetModuleFileNameA GetDriveTypeW QueryDosDeviceA CreateDirectoryA DeleteFileA SetFileAttributesA GetWindowsDirectoryA GetLogicalDrives MoveFileExA MoveFileA GetFileAttributesA ExpandEnvironmentStringsA CreateMutexA DeleteFileW GetPrivateProfileSectionNamesA WriteFile CopyFileA InterlockedIncrement FindClose FindNextFileW FindFirstFileW InterlockedDecrement SetThreadLocale SetNamedPipeHandleState WaitNamedPipeA ConnectNamedPipe CreateNamedPipeA GetOverlappedResult CancelIo CreateIoCompletionPort DisconnectNamedPipe PostQueuedCompletionStatus GetQueuedCompletionStatus OpenSemaphoreA SleepEx PulseEvent GetTempPathA GetTempPathW GetEnvironmentVariableW PeekConsoleInputA GetNumberOfConsoleInputEvents SetSystemTime GetTimeZoneInformation SetTimeZoneInformation GetProfileIntA GetDiskFreeSpaceExW CreateFileW WideCharToMultiByte CreateProcessW lstrcmpA GetFileAttributesW SetCurrentDirectoryA GetFileSize SetFilePointer GetACP GetComputerNameW SetProcessShutdownParameters OpenEventA CreateProcessA CopyFileW GetVolumeInformationA RemoveDirectoryA GetProfileStringA WriteProfileStringA InterlockedCompareExchange lstrcmpW LoadLibraryW GetComputerNameA DosDateTimeToFileTime GlobalMemoryStatus GetThreadSelectorEntry InterlockedExchange GetDriveTypeA GetSystemTime GetLocalTime FindFirstFileA GetEnvironmentStringsW

user32

EndPaint BeginPaint GetWindowDC ClientToScreen UnregisterClassA LoadIconA UpdateWindow SendDlgItemMessageA MapWindowPoints GetSysColor SetFocus AdjustWindowRectEx ScreenToClient EqualRect DeferWindowPos BeginDeferWindowPos CopyRect EndDeferWindowPos ScrollWindow GetScrollInfo SetScrollInfo ShowScrollBar GetScrollRange GetScrollPos SetScrollPos GetTopWindow IsChild GetCapture WinHelpA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID TrackPopupMenu SetWindowPlacement GetDlgCtrlID SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect CharUpperA LoadStringA GetMenuCheckMarkDimensions LoadBitmapA GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem TabbedTextOutA GetNextDlgTabItem GetActiveWindow GetKeyState CallNextHookEx ValidateRect GetCursorPos SetWindowsHookExA GetLastActivePopup IsWindowEnabled EnableWindow ShowOwnedPopups PostQuitMessage GetWindowTextLengthA OemToCharA CharToOemA IsWindow SetDlgItemTextA DefWindowProcA MsgWaitForMultipleObjects GetDlgItemTextA RegisterClassA SetWindowLongA DestroyWindow CloseWindow RegisterWindowMessageA SetActiveWindow GetClassNameA GetDlgItem SetRect IsRectEmpty UnionRect ExitWindowsEx CreateDesktopA CreateDesktopW wsprintfW wsprintfA CreateWindowExA GetClientRect SendMessageA DrawTextA GrayStringA InsertMenuA AppendMenuA GetMenuStringA RemoveMenu PtInRect SetWindowTextA wvsprintfA DeleteMenu CheckDlgButton CheckRadioButton EnumWindowStationsA EnumDesktopsA AttachThreadInput ShowWindow SetWindowPos SetForegroundWindow OemToCharBuffA CharToOemBuffA OpenDesktopW GetUserObjectInformationW GetWindowTextA GetDesktopWindow IsDlgButtonChecked ScrollWindowEx IsDialogMessageA MoveWindow GetSysColorBrush DestroyMenu GetFocus GetDlgItemInt EnumChildWindows EnumWindows GetParent GetWindowLongA GetWindowTextW IsWindowVisible EnumDesktopWindows MessageBoxW MessageBoxA OpenWindowStationA SetProcessWindowStation CloseWindowStation GetForegroundWindow GetClassNameW GetProcessWindowStation GetUserObjectInformationA OpenInputDesktop OpenDesktopA GetThreadDesktop SetThreadDesktop CloseDesktop LoadImageA GetClassLongA CopyIcon GetIconInfo DestroyIcon GetDC ReleaseDC LoadCursorA SetCursor SendMessageTimeoutA EnumDisplaySettingsA GetSystemMetrics PostThreadMessageA PostMessageA FindWindowA PeekMessageA GetMessageA TranslateMessage DispatchMessageA FindWindowExA GetWindowThreadProcessId GetClassInfoExA SetDlgItemInt GetClassInfoA GetWindow SetScrollRange

gdi32

SelectClipPath SetDIBColorTable BitBlt SetStretchBltMode StretchBlt GdiFlush GetStockObject GetPaletteEntries GetDeviceCaps CreateCompatibleDC CreateCompatibleBitmap SelectObject SetPixel DeleteObject DeleteDC ExtSelectClipRgn PlayMetaFileRecord GetObjectType EnumMetaFile PlayMetaFile GetViewportExtEx GetWindowExtEx CreatePen ExtCreatePen CreateSolidBrush CreateHatchBrush CreatePatternBrush CreateDIBPatternBrushPt PtVisible RectVisible TextOutA ExtTextOutA Escape CopyMetaFileA CreateDCA SetDIBits GetDIBits GetObjectA CreateFontIndirectW GetObjectW CombineRgn CreateRectRgnIndirect GetBitmapBits CreateRectRgn GetRegionData CreateBitmap GetDCOrgEx GetClipBox SetTextColor SetBkColor StartDocA SaveDC RestoreDC SelectPalette SetBkMode SetPolyFillMode SetROP2 SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx SelectClipRgn ExcludeClipRect IntersectClipRect OffsetClipRgn MoveToEx LineTo SetTextAlign SetTextJustification SetTextCharacterExtra SetMapperFlags GetCurrentPositionEx ArcTo SetArcDirection PolyDraw PolylineTo SetColorAdjustment PolyBezierTo GetClipRgn CreateDIBSection

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterW FindClosePrinterChangeNotification FreePrinterNotifyInfo GetPrinterW FindFirstPrinterChangeNotification DocumentPropertiesA EnumPortsA GetJobA AddPrinterA DeletePrinter OpenPrinterA EnumJobsA GetPrinterA ClosePrinter FindNextPrinterChangeNotification EnumPrintersA

advapi32

OpenEventLogA RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegNotifyChangeKeyValue RegCreateKeyW RegEnumKeyA RegConnectRegistryA ReportEventA RegisterEventSourceA FreeSid EqualSid RegSetValueA RegSetKeySecurity LookupAccountNameA RegFlushKey RegUnLoadKeyA RegLoadKeyA GetUserNameA EnumServicesStatusA EnumDependentServicesA RegLoadKeyW RegUnLoadKeyW RegDeleteValueW RegDeleteKeyW RegEnumValueW RegEnumKeyW RegConnectRegistryW RegQueryInfoKeyA RegEnumValueA RegDeleteKeyA RegDeleteValueA InitiateSystemShutdownA GetAclInformation GetLengthSid InitializeAcl GetAce AddAce AddAccessAllowedAce GetSecurityDescriptorDacl LookupAccountNameW GetFileSecurityW SetFileSecurityW GetFileSecurityA RegSetValueExA RegCreateKeyA RegCloseKey GetOldestEventLogRecord GetNumberOfEventLogRecords ReadEventLogA CloseEventLog LookupAccountSidW LookupAccountSidA QueryServiceStatus RegQueryInfoKeyW RegQueryValueA RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegSetValueExW ControlService StartServiceA DeleteService LockServiceDatabase CreateServiceA UnlockServiceDatabase LookupPrivilegeValueA AdjustTokenPrivileges SetFileSecurityA RegCreateKeyExA GetUserNameW InitializeSecurityDescriptor SetSecurityDescriptorDacl RegOpenKeyA RegisterEventSourceW ReportEventW DeregisterEventSource OpenSCManagerA OpenServiceA QueryServiceConfigA ChangeServiceConfigA CloseServiceHandle OpenProcessToken DuplicateTokenEx GetTokenInformation AllocateAndInitializeSid

shell32

SHGetPathFromIDListW DragAcceptFiles StrStrIW SHChangeNotify SHGetSpecialFolderLocation SHGetSpecialFolderPathW SHGetSpecialFolderPathA SHFileOperationW SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA

comctl32

ord17

ole32

CoTreatAsClass ReadClassStg ReadFmtUserTypeStg OleRegGetUserType WriteClassStg WriteFmtUserTypeStg SetConvertStg CreateBindCtx CoTaskMemAlloc OleDuplicateData ReleaseStgMedium CLSIDFromProgID StringFromCLSID CoSetProxyBlanket CoTaskMemFree CoCreateGuid CLSIDFromString CoInitializeEx CoInitialize CoCreateInstance CoUninitialize CoDisconnectObject OleRun

oleaut32

SafeArrayCreateVector GetErrorInfo SetErrorInfo CreateErrorInfo VariantInit SysFreeString SystemTimeToVariantTime VariantChangeType VariantClear VariantCopy SysAllocString SafeArrayUnaccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayGetElemsize SafeArrayGetDim SafeArrayCreate SafeArrayRedim SysAllocStringByteLen SysStringByteLen VarBstrFromCy VarDateFromStr VarBstrFromDate SafeArrayCopy SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayGetElement SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayLock SafeArrayUnlock SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor SysStringLen SysAllocStringLen SysReAllocStringLen VarCyFromStr

setupapi

SetupInstallFileA

crypt32

CertFindCertificateInStore CertAddEncodedCertificateToStore CertCloseStore CertFreeCertificateContext CertOpenStore

mpr

WNetGetConnectionW WNetGetConnectionA

shlwapi

PathFileExistsA

wldap32

ord41 ord27 ord301 ord33 ord79 ord35 ord32 ord200 ord45 ord22 ord213 ord145 ord50 ord26 ord46 ord30

$SYSDIR/winrdlv3.exe

IMPHASH a30990f8c49e6bd780231fa7e7e4a8a3
SHA256 453e2290939078c070e46896b2d991f31d295bbc1c63059b10f3c24cad7c4822
MD5 0cbeb75d3090054817ea4df0773afe35
SHA1 58c543a84dc18e21d86ad2c011d8ac726867fb78
SHA512 f3ab9f393da18df2cfc22020627e72ae9e7c7b47db088aaf0fa773028c96d0e7e3d4127082b59296eecfc9c60d389a43c78ba0a4348b0f6ceb76cc8978ba649c
SSDEEP 768:aYNaVzGJ6dKwFGeThZF1oGPh4xFn2MpDGNxvTp23+zjo1:aEaVzGvwFGefoGyjcM0o1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

c9:04:85:a8:fc:df:a1:3b:0b:91:d6:3a:7e:86:e5:df:ed:35:f3:42:eb:17:da:17:b4:bc:51:9c:6f:84:d1:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Chains

Feb 2, 2021

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

f0:e8:ec:59:b9:e2:ee:75:e0:77:a7:75:d7:36:ed:41:74:21:af:7a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Chains

Feb 2, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Serial Number

08:1d:a4:67:70:c6:63:34:9e:8f:76:db:40:4a:47:9d

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 10, 2019 - Oct 20, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Serial Number

0f:1c:75:cb:3c:66:4f:c8:86:57:ed:11:ec:a5:71:01

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 10, 2019 - Oct 20, 2022

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

0

Major OS version

4

Entry point

4844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$SYSDIR/winwdgv3.dll

IMPHASH d3b49be17ba0983dccb13aeb18656ade
SHA256 326abf1af467670de571252bfd8118b9ea0b8a3babc10df092fffc2da3e11671
MD5 0aed8f70a00060f8005efa8d1c668b98
SHA1 c75fe3d1a2476da55f526d366f73bedbfd56f32a
SHA512 738f9cbd6f693647d8b091d7192db8963e2c4ecb179ce1b5c7a81f56045674694faed7fdf88af5d7e144149d86df167d9adf6460e3905024faf526c08f7dc787
SSDEEP 24576:ZlX1wCmSn/ggkRk9XJ4QkOHE5/H8ZZsjLAAhHoMapx1XyM05g8wWT3Q80I:HRZR5vkIE5P88hAFXyM05IWk8D
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

a1:05:7a:2e:18:8a:2a:9d:95:d7:29:e2:fd:1b:85:55:8c:ca:36:6e:80:4c:6c:ab:2b:02:70:4b:8e:bb:1c:40

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

f0:06:8d:72:8b:ea:e6:5b:53:a2:83:19:07:12:a9:03:fe:2d:4d:7e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

204276

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

setupapi

SetupInstallFileA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

kernel32

CreateSemaphoreA ReleaseSemaphore ReleaseMutex SetLastError ResumeThread SetThreadPriority SuspendThread TlsAlloc GlobalFree GlobalHandle TlsFree GlobalReAlloc GlobalAlloc TlsSetValue LocalReAlloc TlsGetValue lstrcatA GlobalSize GlobalFlags GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA LockResource LoadResource FindResourceA GetProcessVersion GetCPInfo GetOEMCP GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA RtlUnwind GetTimeZoneInformation GetCommandLineA RaiseException GetACP ExitThread HeapSize HeapReAlloc ExitProcess FatalAppExitA LCMapStringA LCMapStringW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree GetStringTypeA GetStringTypeW VirtualAlloc IsBadWritePtr UnhandledExceptionFilter IsBadReadPtr IsBadCodePtr IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetConsoleCtrlHandler SetStdHandle GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA SleepEx SetThreadLocale GetWindowsDirectoryW GetModuleFileNameA GetComputerNameW FlushFileBuffers CreateDirectoryA GetFileAttributesExA GetFileAttributesExW GetVolumeInformationW QueryDosDeviceA DeviceIoControl MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileExW WaitForSingleObject SystemTimeToFileTime LocalFileTimeToFileTime GetShortPathNameA SetCurrentDirectoryA OpenFileMappingA OutputDebugStringA DefineDosDeviceA GetDriveTypeW SetVolumeLabelA GetDiskFreeSpaceA OpenSemaphoreA OpenEventA GetQueuedCompletionStatus PostQueuedCompletionStatus DisconnectNamedPipe CreateIoCompletionPort CancelIo GetOverlappedResult CreateNamedPipeA ConnectNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetThreadContext GetExitCodeThread ResetEvent VirtualProtectEx WriteProcessMemory VirtualProtect CreateFileMappingA MapViewOfFile UnmapViewOfFile BeginUpdateResourceA UpdateResourceA EndUpdateResourceA EnumResourceLanguagesA EnumResourceTypesA EnumResourceNamesA SizeofResource QueryPerformanceCounter InterlockedExchangeAdd InterlockedExchange InterlockedCompareExchange ReadProcessMemory GetThreadPriority TerminateThread LoadLibraryW MoveFileW GetEnvironmentVariableW GetTempPathW GetTempPathA GetSystemDirectoryW FormatMessageW FindResourceExA GetCurrentDirectoryA GetModuleFileNameW GetCurrentDirectoryW GetLastError Sleep GetThreadLocale GetStringTypeExA GetFullPathNameA lstrcpynA lstrcpyA SetEndOfFile UnlockFile LockFile DuplicateHandle FileTimeToLocalFileTime lstrlenW GlobalLock GlobalUnlock FormatMessageA lstrlenA InterlockedDecrement InterlockedIncrement VirtualQueryEx GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA AllocConsole GetStdHandle WriteConsoleA FreeConsole OutputDebugStringW GetProfileStringA WideCharToMultiByte LeaveCriticalSection EnterCriticalSection SetPriorityClass GetPriorityClass GetDriveTypeA ExpandEnvironmentStringsW QueryDosDeviceW GetLogicalDrives DeleteCriticalSection InitializeCriticalSection OpenMutexA CreateProcessA LocalAlloc lstrcmpiA DeleteFileW SetFileAttributesA lstrcmpA RemoveDirectoryA MoveFileExA DeleteFileA GetSystemInfo FindFirstFileA FindNextFileA LoadLibraryA LocalFree OpenProcess GetCurrentProcess CreateThread GetSystemDirectoryA GetModuleHandleW GetFileInformationByHandle GetCurrentThreadId GetModuleHandleA CreateFileW GetFileSize ReadFile LoadLibraryExW LoadLibraryExA GetProcAddress FreeLibrary GetTickCount GetFileAttributesW CreateDirectoryW GetLocalTime GetCurrentProcessId FindFirstFileW lstrcmpW FindNextFileW FindClose CreateFileA CloseHandle CopyFileA GetFileAttributesA ExpandEnvironmentStringsA CreateMutexA CreateEventA WaitForMultipleObjects SetEvent GetWindowsDirectoryA GetSystemTime SetFilePointer CompareFileTime SetErrorMode SetUnhandledExceptionFilter GetCurrentThread TerminateProcess GetVersion GetUserDefaultLangID GetSystemDefaultLangID MultiByteToWideChar MulDiv GetExitCodeProcess GetProcessTimes FileTimeToSystemTime CopyFileW GetDiskFreeSpaceExW GetFileTime SetFileTime VirtualQuery CreateProcessW GetProcessHeap HeapAlloc HeapFree WriteFile GetComputerNameA PulseEvent

user32

OpenInputDesktop DeleteMenu SetCursor ShowOwnedPopups DestroyMenu PostQuitMessage GetSysColorBrush LoadCursorA MoveWindow IsDialogMessageA ScrollWindowEx IsDlgButtonChecked SetDlgItemTextA SetDlgItemInt GetDlgItemTextA GetDlgItemInt CheckRadioButton CheckDlgButton LoadIconA OpenDesktopA UpdateWindow SendDlgItemMessageA MapWindowPoints GetSysColor SetActiveWindow IsWindow AdjustWindowRectEx EqualRect DeferWindowPos BeginDeferWindowPos CopyRect EndDeferWindowPos ScrollWindow GetScrollInfo SetScrollInfo ShowScrollBar GetScrollRange SetScrollRange GetTopWindow IsChild GetThreadDesktop SetThreadDesktop CloseDesktop PostMessageA EnableMenuItem GetCapture WinHelpA GetUserObjectInformationA GetProcessWindowStation FindWindowExA GetWindowThreadProcessId GetClassNameW GetForegroundWindow CloseWindowStation SetProcessWindowStation OpenWindowStationA MessageBoxA MessageBoxW SendMessageTimeoutA EnumDesktopWindows IsWindowVisible GetWindowLongA CharToOemBuffA OemToCharBuffA GetUserObjectInformationW GetClassInfoA RegisterClassA GetMenu TrackPopupMenu SetWindowPlacement DestroyWindow GetClassLongA SetPropA GetPropA CallWindowProcA RemovePropA DefWindowProcA GetMessageTime GetMessagePos SetWindowLongA RegisterWindowMessageA OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetMenuCheckMarkDimensions LoadBitmapA ModifyMenuA SetMenuItemBitmaps CheckMenuItem GetDlgItem GetNextDlgTabItem GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ScreenToClient GetLastActivePopup IsWindowEnabled EnableWindow GetScrollPos SetScrollPos wvsprintfA SetFocus GetFocus SetWindowTextA ClientToScreen GetWindow GetDlgCtrlID GetWindowRect PtInRect GetClassNameA RemoveMenu GetMenuItemCount GetSubMenu GetMenuState GetMenuStringA AppendMenuA GetMenuItemID InsertMenuA LoadStringA UnregisterClassA UnhookWindowsHookEx GetActiveWindow GetKeyState CallNextHookEx ValidateRect GetCursorPos SetWindowsHookExA GetSystemMetrics CharUpperA wsprintfA GetWindowTextLengthA OemToCharA CharToOemA PeekMessageA MsgWaitForMultipleObjects GetMessageA TranslateMessage DispatchMessageA CreateWindowExA GetClientRect SendMessageA AttachThreadInput ShowWindow SetWindowPos SetForegroundWindow FindWindowA GetWindowTextW GetWindowTextA GetDesktopWindow EnumChildWindows EnumWindows GetParent

gdi32

GetClipBox ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetTextColor SetStretchBltMode SetROP2 SetPolyFillMode SelectClipRgn SetBkColor SelectPalette SelectObject RestoreDC SaveDC StartDocA DeleteDC DeleteObject CreateDCA CopyMetaFileA GetStockObject GetObjectW GetDeviceCaps CreateFontIndirectW SetBkMode BitBlt IntersectClipRect OffsetClipRgn MoveToEx LineTo SetTextAlign SetTextJustification SetTextCharacterExtra SetMapperFlags GetCurrentPositionEx ArcTo SetArcDirection PolyDraw PolylineTo SetColorAdjustment PolyBezierTo GetClipRgn CreateRectRgn SelectClipPath ExtSelectClipRgn PlayMetaFileRecord GetObjectType EnumMetaFile PlayMetaFile GetViewportExtEx GetWindowExtEx CreatePen ExtCreatePen CreateSolidBrush CreateHatchBrush CreatePatternBrush CreateDIBPatternBrushPt PtVisible RectVisible TextOutA ExtTextOutA Escape CreateBitmap GetDCOrgEx GetObjectA GetBitmapBits ExcludeClipRect CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

LockServiceDatabase RegOpenKeyW RegSetValueExW RegOpenKeyA RegQueryValueExA RegCloseKey RegQueryValueExW RegCreateKeyExW RegCreateKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken LookupAccountSidW GetTokenInformation GetUserNameW RegSetValueExA SetFileSecurityA FreeSid EqualSid AllocateAndInitializeSid GetFileSecurityA SetFileSecurityW GetFileSecurityW LookupAccountNameW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorDacl AddAccessAllowedAce AddAce GetAce InitializeAcl GetLengthSid GetAclInformation QueryServiceConfig2A ChangeServiceConfigA QueryServiceConfigA ChangeServiceConfig2A CreateServiceA CloseServiceHandle DeleteService ControlService OpenServiceA OpenSCManagerA StartServiceA RegDeleteValueA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegQueryInfoKeyA RegCreateKeyExA RegSetValueA RegConnectRegistryA RegEnumKeyA RegCreateKeyW RegOpenKeyExW UnlockServiceDatabase QueryServiceStatus EnumServicesStatusA RegSetKeySecurity GetUserNameA DeregisterEventSource ReportEventA RegisterEventSourceA

shell32

SHGetFileInfoA SHGetPathFromIDListW SHGetSpecialFolderPathA DragAcceptFiles

comctl32

ord17

ole32

SetConvertStg CreateBindCtx CoTaskMemAlloc OleDuplicateData WriteFmtUserTypeStg CoInitialize CoCreateInstance CoUninitialize WriteClassStg CoInitializeEx OleRegGetUserType ReadFmtUserTypeStg ReadClassStg StringFromCLSID CoTreatAsClass ReleaseStgMedium CoDisconnectObject CoTaskMemFree

oleaut32

SafeArrayGetLBound CreateErrorInfo SafeArrayGetElemsize SafeArrayGetDim SafeArrayCreate VariantClear SafeArrayRedim VariantCopy SysAllocString SysAllocStringByteLen VariantChangeType SysStringByteLen VarCyFromStr VarBstrFromCy VarDateFromStr SafeArrayGetUBound SafeArrayCopy SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayGetElement SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayLock SafeArrayUnlock SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor SysStringLen SysAllocStringLen SysReAllocStringLen SafeArrayAccessData SafeArrayUnaccessData VarBstrFromDate SetErrorInfo GetErrorInfo VariantInit SysFreeString SystemTimeToVariantTime

mpr

WNetGetConnectionA WNetGetConnectionW

rpcrt4

UuidCreate RpcStringFreeA UuidToStringW RpcStringFreeW UuidFromStringW UuidToStringA

$SYSDIR/winwdgv364.dll

IMPHASH 987b90646e048e77dc47c1b719a85106
SHA256 799d176813c3d0f5a01fd482576aeab6a63e5024f3392e7974f5e437c3d7e3a0
MD5 889482a07ba13fc6e194a63d275a850a
SHA1 16a164fded3352abb63722a5c74750cdc438f99a
SHA512 e5cb9cf49120ed20b07faceefccef24da4335f28f49d9ae7bfafccbc9a239c4039e9ce5f5d13b49d0be475b3913311d08b7d70a1a2df0c974d4c5a5f7bec507a
SSDEEP 24576:YunZ2BYJf0ZF1H+V7o+9Ql7Dm2E6WJ6pFgGJifEozVlFQQr11tO+F2lE4i1d8g1O:FmAf0BH+Vs+9CG2E6WJ6pOGJYFzV7QQO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Digest

06:fd:9d:e7:f4:a9:fd:0a:12:23:4b:79:c2:38:b9:5d:fe:71:d8:31:78:84:a8:a8:d2:e0:19:3e:10:a0:f6:1a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

e8:f5:10:4e:62:44:77:da:a4:b7:c4:0c:bf:1c:fe:63:d2:06:c0:66

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

2

Major OS version

5

Entry point

293076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\WorkshopAgent\DevelopProj\Code\PreRelease\V4\PreRelease\Bin\Release\WinWdgv364.pdb

setupapi

SetupInstallFileA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

kernel32

MoveFileA FreeLibrary GetUserDefaultLangID GetVersion GetSystemDefaultLangID WideCharToMultiByte GetProfileStringA SetFilePointer OutputDebugStringW FreeConsole WriteConsoleA GetStdHandle AllocConsole LoadLibraryExA LoadLibraryExW OpenMutexA CompareFileTime GetSystemTime GetWindowsDirectoryA CreateEventA CreateMutexA SetEvent LocalAlloc CreateProcessA lstrcmpiA TerminateProcess WaitForMultipleObjects MultiByteToWideChar MulDiv GetExitCodeProcess GetProcessTimes FileTimeToSystemTime CopyFileW GetDiskFreeSpaceExW GetFileTime SetFileTime VirtualQuery CreateProcessW GetProcessHeap HeapAlloc HeapFree WriteFile CreateFileW GetFileSize GetComputerNameA GetComputerNameW FlushFileBuffers CreateDirectoryA GetFileAttributesExA GetFileAttributesExW GetVolumeInformationW OutputDebugStringA QueryDosDeviceW GetDriveTypeA DefineDosDeviceA GetDiskFreeSpaceExA SetVolumeLabelA GetVolumeInformationA GetLogicalDrives GetDriveTypeW VirtualProtectEx WriteProcessMemory ReadProcessMemory VirtualProtect CreateFileMappingA MapViewOfFile UnmapViewOfFile SizeofResource QueryDosDeviceA DeviceIoControl ReadFile SetFileAttributesW lstrcmpW RemoveDirectoryW DeleteFileW MoveFileExW SetFileAttributesA lstrcmpA RemoveDirectoryA DeleteFileA MoveFileExA GetSystemInfo FindFirstFileW FindNextFileW FindFirstFileA FindNextFileA FindClose LoadLibraryA LocalFree OpenProcess GetCurrentProcess CreateThread GetSystemDirectoryA GetModuleHandleW GetFileInformationByHandle GetModuleHandleA GetProcAddress GetCurrentThreadId GetTickCount GetFileAttributesW IsBadReadPtr CreateDirectoryW GetLocalTime GetCurrentProcessId CreateFileA CloseHandle CopyFileA GetFileAttributesA ExpandEnvironmentStringsA Sleep GetLastError GetModuleFileNameA GetCurrentDirectoryW GetModuleFileNameW GetCurrentDirectoryA GetThreadPriority OpenFileMappingA SetEndOfFile GetPriorityClass LockResource BeginUpdateResourceA UpdateResourceA EndUpdateResourceA EnumResourceLanguagesA EnumResourceNamesA EnumResourceTypesA SetPriorityClass VirtualQueryEx SetEnvironmentVariableA CompareStringW LoadResource FindResourceExA lstrlenA lstrlenW GetVersionExA FormatMessageA GetACP FormatMessageW WaitForSingleObject InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SleepEx CreateSemaphoreA ReleaseSemaphore ReleaseMutex PulseEvent ResetEvent SuspendThread TerminateThread ResumeThread SetThreadPriority GetExitCodeThread FileTimeToLocalFileTime SetLastError GetSystemDirectoryW MoveFileW GetTempPathA GetTempPathW GetEnvironmentVariableA GetEnvironmentVariableW ExpandEnvironmentStringsW RtlLookupFunctionEntry RtlUnwindEx EncodePointer DecodePointer GetSystemTimeAsFileTime FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader GetDateFormatA GetTimeFormatA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCPInfo GetOEMCP IsValidCodePage FlsGetValue FlsFree GetCurrentThread FlsAlloc LCMapStringW HeapSize ExitProcess GetLocaleInfoW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetStringTypeW GetTimeZoneInformation GetConsoleCP GetConsoleMode FatalAppExitA HeapReAlloc SetConsoleCtrlHandler LoadLibraryW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleW FreeResource

user32

GetThreadDesktop OpenDesktopA SetThreadDesktop CloseDesktop AttachThreadInput MsgWaitForMultipleObjects PeekMessageA GetMessageA TranslateMessage DispatchMessageA GetDesktopWindow EnumChildWindows EnumWindows GetWindowLongA EnumDesktopWindows GetClassNameW FindWindowExA IsWindowVisible CreateWindowExA GetClientRect SendMessageA wsprintfA GetSystemMetrics GetUserObjectInformationW GetForegroundWindow OpenInputDesktop ShowWindow GetWindowLongPtrA SetWindowPos SetForegroundWindow FindWindowA GetWindowThreadProcessId GetWindowTextW GetWindowTextA GetParent SendMessageTimeoutA MessageBoxW MessageBoxA OpenWindowStationA SetProcessWindowStation CloseWindowStation GetProcessWindowStation GetUserObjectInformationA

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt GetBitmapBits DeleteObject DeleteDC CreateFontIndirectW GetDeviceCaps GetObjectW GetStockObject CreateDCW

advapi32

AddAce StartServiceA OpenSCManagerA OpenServiceA RegisterEventSourceW ControlService DeleteService CloseServiceHandle CreateServiceA ChangeServiceConfig2A QueryServiceConfigA ChangeServiceConfigA QueryServiceConfig2A RegCreateKeyExA InitializeSecurityDescriptor GetAclInformation GetLengthSid InitializeAcl GetAce AddAccessAllowedAce SetSecurityDescriptorDacl GetSecurityDescriptorDacl LookupAccountNameW GetUserNameW GetFileSecurityW SetFileSecurityW GetFileSecurityA AllocateAndInitializeSid EqualSid FreeSid SetFileSecurityA RegSetValueExA GetTokenInformation LookupAccountSidW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegSetValueExW RegOpenKeyA RegQueryValueExA RegCloseKey DeregisterEventSource GetUserNameA RegSetKeySecurity EnumServicesStatusA QueryServiceStatus UnlockServiceDatabase LockServiceDatabase RegCreateKeyW RegEnumValueA RegDeleteValueA RegQueryInfoKeyA RegEnumKeyA RegDeleteKeyA RegConnectRegistryA RegOpenKeyExA ReportEventW

shell32

SHGetPathFromIDListW

ole32

CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

SystemTimeToVariantTime DosDateTimeToVariantTime

mpr

WNetGetConnectionW

$SYSDIR/zipnew.dat

SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
MD5 SHA1 SHA512

$WINDIR/LInstSvr.exe

IMPHASH fdf8dcacf739f59d4d1abde00542f59c
SHA256 c8bd29c490368ebfc56dc5c951e24af613f7e5b68a8493240f5ec1afd9d4a9b1
MD5 fb741fceeb80a76f7f0005a1ac60604a
SHA1 a6a8d97365634b266f0b5a001038a5a86b9ed2d6
SHA512 8e43d1a8448828e9ea5fcac792b95dcb63640ea200cb2d2dff4902c4ceb6e79a405e0739d293c7cc14bb6ee025089fb9e954ba38e6707b92ac9fe251918bd780
SSDEEP 6144:XuY705FoAqekD/QTVm0nM9m8uXZxXt2GCYA0t28H9/:12qDYZmsl8uXZxX+f0s85
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

fc:85:ef:8f:09:06:39:b3:78:d3:7b:3c:1d:64:f6:bf:49:ad:b0:69:57:50:48:92:44:60:69:53:16:bd:d8:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Chains

Feb 1, 2021

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

06:30:98:5e:19:f1:b3:8b:0f:22:22:53:79:99:96:ff:53:34:df:7c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Chains

Feb 1, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Serial Number

08:1d:a4:67:70:c6:63:34:9e:8f:76:db:40:4a:47:9d

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 10, 2019 - Oct 20, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Serial Number

0f:1c:75:cb:3c:66:4f:c8:86:57:ed:11:ec:a5:71:01

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 10, 2019 - Oct 20, 2022

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

0

Major OS version

4

Entry point

16111

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReadFile GetSystemInfo LoadLibraryW GetSystemDirectoryW lstrlenW InterlockedDecrement lstrlenA InterlockedIncrement FormatMessageA LoadResource FindResourceExW LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA LoadLibraryA GetOEMCP GetACP GetCPInfo FlushFileBuffers SetFilePointer MultiByteToWideChar HeapReAlloc VirtualAlloc IsBadCodePtr IsBadWritePtr IsBadReadPtr RaiseException HeapSize lstrcmpA SetLastError lstrcpynW InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LocalAlloc TlsAlloc GlobalUnlock GlobalHandle TlsFree GlobalLock GlobalReAlloc TlsSetValue LocalReAlloc TlsGetValue lstrcpyW ResumeThread SetThreadPriority GetCurrentThreadId SuspendThread GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW lstrcatW LockResource FindResourceW FreeLibrary GetProcessVersion MulDiv lstrcmpiW lstrcmpW GlobalFlags GetCurrentThread lstrcmpiA GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetCurrentDirectoryW SetErrorMode DuplicateHandle CreateFileW LockFile UnlockFile SetEndOfFile MoveFileW DeleteFileW FindClose FindFirstFileW GetVolumeInformationW GetFullPathNameW GetStringTypeExW GetThreadLocale GetShortPathNameW GetFileAttributesW GetFileSize GetFileTime LocalFileTimeToFileTime SystemTimeToFileTime SetFileTime SetFileAttributesW FileTimeToSystemTime FileTimeToLocalFileTime CreateThread ExitThread GetTimeZoneInformation GetSystemTime GetLocalTime FatalAppExitA IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA OutputDebugStringW SetUnhandledExceptionFilter WriteFile VirtualFree HeapCreate HeapDestroy GetVersionExA GetEnvironmentVariableA GetEnvironmentStringsW GetEnvironmentStrings WideCharToMultiByte FreeEnvironmentStringsW FreeEnvironmentStringsA GetModuleFileNameA UnhandledExceptionFilter SetHandleCount HeapAlloc HeapFree GetVersion GetCommandLineA GetStartupInfoA GetModuleHandleA GetFileType SetStdHandle GetCurrentProcess TerminateProcess ExitProcess RtlUnwind OpenFileMappingW CreateFileMappingW MapViewOfFile UnmapViewOfFile AllocConsole GetStdHandle GlobalAlloc FormatMessageW LocalFree ResetEvent SetEvent SetConsoleCtrlHandler GetModuleHandleW GetProcAddress CreateMutexW GetCommandLineW GlobalFree GetVersionExW CreateEventW GetModuleFileNameW Sleep CreateProcessW GetLastError WaitForSingleObject CloseHandle

user32

SetScrollPos GetScrollPos SetScrollRange GetScrollRange ShowScrollBar SetScrollInfo GetScrollInfo ScrollWindow EndDeferWindowPos CopyRect BeginDeferWindowPos GetClientRect DeferWindowPos EqualRect ScreenToClient AdjustWindowRectEx SetFocus IsWindow SetActiveWindow GetSysColor MapWindowPoints SendDlgItemMessageA SendDlgItemMessageW UpdateWindow PostMessageW LoadIconW CheckDlgButton CheckRadioButton GetDlgItemInt GetDlgItemTextW SetDlgItemInt SetDlgItemTextW IsDlgButtonChecked ScrollWindowEx IsDialogMessageW SetWindowTextW MoveWindow ShowWindow LoadCursorW GetSysColorBrush ReleaseDC GetDC GetClassNameW PtInRect ClientToScreen GetDesktopWindow PostQuitMessage DestroyMenu GetWindowDC BeginPaint EndPaint TabbedTextOutW DrawTextW GrayStringW ShowOwnedPopups SetCursor GetTopWindow DeleteMenu GetMenuStringW CharUpperW GetMenuItemCount GetSubMenu GetMenuItemID TrackPopupMenu SetWindowPlacement GetDlgItem GetWindowTextLengthW GetWindowTextW GetDlgCtrlID SetPropW GetPropW CallWindowProcW RemovePropW GetMessageTime GetMessagePos GetForegroundWindow SetForegroundWindow GetWindow SetWindowLongW SetWindowPos RegisterWindowMessageW OffsetRect IntersectRect SystemParametersInfoW IsIconic GetWindowPlacement GetWindowRect GetMenuCheckMarkDimensions LoadBitmapW GetMenuState ModifyMenuW SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetFocus GetNextDlgTabItem GetMessageW GetActiveWindow GetKeyState CallNextHookEx ValidateRect IsWindowVisible GetCursorPos SetWindowsHookExW GetParent GetLastActivePopup IsWindowEnabled GetWindowLongW SendMessageW MessageBoxW EnableWindow UnhookWindowsHookEx LoadStringW GetSystemMetrics IsChild GetCapture WinHelpW wsprintfW GetClassInfoW InsertMenuW PeekMessageW TranslateMessage DispatchMessageW RegisterClassW CreateWindowExW DefWindowProcW DestroyWindow GetMenu

advapi32

RegOpenKeyExW GetAce AddAccessAllowedAce InitializeAcl InitializeSecurityDescriptor LookupAccountSidW RegConnectRegistryW RegCreateKeyExW RegQueryValueExA RegSetValueExA RegEnumKeyW RegQueryInfoKeyW RegEnumValueW RegDeleteKeyW SetSecurityDescriptorDacl RegQueryValueExW RegisterEventSourceW ReportEventW DeregisterEventSource SetServiceStatus RegisterServiceCtrlHandlerW RegOpenKeyW StartServiceW RegDeleteValueW OpenServiceW ControlService QueryServiceStatus DeleteService RegCreateKeyW CopySid GetLengthSid IsValidSid LookupAccountNameW GetUserNameW StartServiceCtrlDispatcherW CloseServiceHandle CreateServiceW OpenSCManagerW RegCloseKey RegSetValueExW

shell32

SHGetFileInfoW DragAcceptFiles CommandLineToArgvW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

comctl32

ord17

gdi32

RectVisible TextOutW ExtTextOutW Escape OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetStretchBltMode SetROP2 SetPolyFillMode SetBkMode SelectPalette GetStockObject CreatePatternBrush CreateHatchBrush CreateSolidBrush ExtCreatePen CreatePen GetWindowExtEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx PtVisible SelectClipRgn ExcludeClipRect IntersectClipRect OffsetClipRgn MoveToEx LineTo SetTextAlign SetTextJustification SetTextCharacterExtra SetMapperFlags GetCurrentPositionEx ArcTo SetArcDirection PolyDraw PolylineTo SetColorAdjustment PolyBezierTo GetClipRgn CreateRectRgn SelectClipPath ExtSelectClipRgn PlayMetaFileRecord GetObjectType EnumMetaFile PlayMetaFile CreateBitmap ScaleWindowExtEx SelectObject RestoreDC SaveDC StartDocW DeleteDC DeleteObject GetDeviceCaps GetObjectW SetBkColor SetTextColor GetClipBox GetDCOrgEx CreateDIBPatternBrushPt GetViewportExtEx

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

comdlg32

GetFileTitleW

oleaut32

SysReAllocStringLen SysAllocStringLen

$WINDIR/bakoav3.sys

IMPHASH 032a268786866f8c08cfe9ace8b10aa8
SHA256 0e0efb65f52f8ae90f1227aafddb1bd23803229497fc82c5c458c8d6eb83a609
MD5 3ae42cb8a028c5be3f57575342bbb56d
SHA1 2939396b9069d4b46febc047b13ce2c30de7e886
SHA512 f4e5c0ff991fc907049171f8bc0ac763462e081b411547a3b24f7d57b51a73fb2c3d0a8daf5cccb0ddd8970ed5c81baf3a2c8e5b22eb3ccdc672a1e1aa01ae24
SSDEEP 196608:SPDuLJR9PL40/Rau8ik8lqRls5lzrZVlV03gHn4rj/L:vt8MYRlsDppf4rDL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

3b:c2:be:1f:17:ed:de:44:7b:d4:48:b0:98:18:d7:10:2e:c3:93:ac:2f:96:4c:3c:30:13:eb:a2:7f:ce:b8:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Dec 7, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

81:b8:95:86:ff:b2:35:35:6e:51:8b:b5:66:7b:f6:44:fe:19:77:8e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Dec 7, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

6663467

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

ioctlsocket getservbyport gethostbyaddr getservbyname select __WSAFDIsSet recv send getsockopt recvfrom sendto socket setsockopt shutdown closesocket ntohs WSACloseEvent WSACreateEvent WSAGetLastError inet_ntoa gethostname gethostbyname inet_addr WSACleanup WSAStartup ntohl getsockname getpeername listen connect WSAIoctl htons bind accept WSASetLastError htonl WSACancelBlockingCall

version

GetFileVersionInfoSizeA VerLanguageNameA VerLanguageNameW GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

netapi32

Netbios NetLocalGroupEnum NetApiBufferFree NetLocalGroupGetMembers NetUserEnum

rpcrt4

UuidFromStringA RpcStringFreeW UuidToStringW UuidCreate UuidFromStringW RpcStringFreeA UuidToStringA

kernel32

HeapFree HeapAlloc GetProcessHeap VirtualQuery FileTimeToSystemTime GetProcessTimes MulDiv lstrlenA DefineDosDeviceW LockResource LoadResource SizeofResource FindResourceExA EnumResourceLanguagesA GetSystemDefaultLangID GetUserDefaultLangID IsBadReadPtr lstrlenW GetPrivateProfileStringA GetShortPathNameW GetPrivateProfileIntW WritePrivateProfileStringW SetSystemPowerState CreateEventW ExpandEnvironmentStringsW GetPriorityClass FormatMessageW GetWindowsDirectoryW GetPrivateProfileIntA GetSystemDirectoryW lstrcpyA GetLongPathNameW CompareFileTime FindCloseChangeNotification FindFirstChangeNotificationA FindNextChangeNotification FileTimeToDosDateTime FileTimeToLocalFileTime LocalFileTimeToFileTime GetCurrentDirectoryA OutputDebugStringW FreeConsole WriteConsoleA GetStdHandle AllocConsole LockFile UnlockFile FindResourceA CreateSemaphoreA ReleaseSemaphore GlobalUnlock GlobalLock lstrcmpiA GlobalDeleteAtom ResumeThread SetThreadPriority SuspendThread lstrcpynA SystemTimeToFileTime GetFullPathNameA GetStringTypeExA GetThreadLocale GetShortPathNameA GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA TlsAlloc GlobalHandle TlsFree GlobalReAlloc TlsSetValue LocalReAlloc TlsGetValue GlobalSize GlobalFlags GetProcessVersion GetCPInfo GetOEMCP RtlUnwind RaiseException HeapReAlloc ExitProcess ExitThread SetStdHandle HeapSize FatalAppExitA LCMapStringA LCMapStringW GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr CompareStringA CompareStringW IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID GetStringTypeA GetStringTypeW SetHandleCount GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings FlushFileBuffers UnhandledExceptionFilter IsBadCodePtr SetConsoleCtrlHandler SetEnvironmentVariableA GetFileAttributesExA GetSystemInfo CreateThread GetModuleHandleW GetFileInformationByHandle SetEndOfFile RemoveDirectoryW SetFileTime GetFileType GetLogicalDriveStringsW GetVolumeInformationW OpenFileMappingA CreateFileMappingA MapViewOfFile UnmapViewOfFile ReleaseMutex EnumResourceNamesA FormatMessageA FindNextFileA MoveFileW GetDiskFreeSpaceA DefineDosDeviceA GetDiskFreeSpaceExA GlobalAlloc GlobalFree LocalAlloc GetSystemPowerStatus GetLogicalDriveStringsA OutputDebugStringA CreateMutexW OpenMutexW GetExitCodeProcess SetLastError SetFileAttributesW MoveFileExW SetPriorityClass GetFileAttributesExW OpenEventW GetFileTime CreateDirectoryW GetLocaleInfoW GetVersion QueryPerformanceCounter PeekNamedPipe TerminateThread FlushConsoleInputBuffer ReadConsoleInputA SetConsoleMode GetConsoleMode SetVolumeLabelA VirtualProtectEx WriteProcessMemory BackupWrite BackupRead BackupSeek VirtualProtect BeginUpdateResourceA UpdateResourceA EndUpdateResourceA EnumResourceTypesA GetThreadContext VirtualQueryEx InterlockedExchangeAdd ReadProcessMemory GetThreadPriority GetExitCodeThread QueryDosDeviceW GetModuleFileNameW GetCurrentDirectoryW SetCurrentDirectoryW LoadLibraryExW ReadFile InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventA CloseHandle SetEvent GetTickCount WaitForMultipleObjects DeviceIoControl CreateFileA GetProcAddress LoadLibraryA GetVersionExA MultiByteToWideChar FreeLibrary GetSystemDirectoryA LoadLibraryExA lstrcatA Sleep ResetEvent WaitForSingleObject GetCurrentProcessId GetLastError GetModuleHandleA DuplicateHandle GetCurrentProcess OpenProcess LocalFree WritePrivateProfileStringA GetPrivateProfileSectionA TerminateProcess GetCurrentThreadId GetCurrentThread SetUnhandledExceptionFilter SetErrorMode FreeLibraryAndExitThread OpenMutexA GetCommandLineA GetModuleFileNameA GetDriveTypeW QueryDosDeviceA CreateDirectoryA DeleteFileA SetFileAttributesA GetWindowsDirectoryA GetLogicalDrives MoveFileExA MoveFileA GetFileAttributesA ExpandEnvironmentStringsA CreateMutexA DeleteFileW GetPrivateProfileSectionNamesA WriteFile CopyFileA InterlockedIncrement FindClose FindNextFileW FindFirstFileW InterlockedDecrement SetThreadLocale SetNamedPipeHandleState WaitNamedPipeA ConnectNamedPipe CreateNamedPipeA GetOverlappedResult CancelIo CreateIoCompletionPort DisconnectNamedPipe PostQueuedCompletionStatus GetQueuedCompletionStatus OpenSemaphoreA SleepEx PulseEvent GetTempPathA GetTempPathW GetEnvironmentVariableW PeekConsoleInputA GetNumberOfConsoleInputEvents SetSystemTime GetTimeZoneInformation SetTimeZoneInformation GetProfileIntA GetDiskFreeSpaceExW CreateFileW WideCharToMultiByte CreateProcessW lstrcmpA GetFileAttributesW SetCurrentDirectoryA GetFileSize SetFilePointer GetACP GetComputerNameW SetProcessShutdownParameters OpenEventA CreateProcessA CopyFileW GetVolumeInformationA RemoveDirectoryA GetProfileStringA WriteProfileStringA InterlockedCompareExchange lstrcmpW LoadLibraryW GetComputerNameA DosDateTimeToFileTime GlobalMemoryStatus GetThreadSelectorEntry InterlockedExchange GetDriveTypeA GetSystemTime GetLocalTime FindFirstFileA GetEnvironmentStringsW

user32

EndPaint BeginPaint GetWindowDC ClientToScreen UnregisterClassA LoadIconA UpdateWindow SendDlgItemMessageA MapWindowPoints GetSysColor SetFocus AdjustWindowRectEx ScreenToClient EqualRect DeferWindowPos BeginDeferWindowPos CopyRect EndDeferWindowPos ScrollWindow GetScrollInfo SetScrollInfo ShowScrollBar GetScrollRange GetScrollPos SetScrollPos GetTopWindow IsChild GetCapture WinHelpA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID TrackPopupMenu SetWindowPlacement GetDlgCtrlID SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect CharUpperA LoadStringA GetMenuCheckMarkDimensions LoadBitmapA GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem TabbedTextOutA GetNextDlgTabItem GetActiveWindow GetKeyState CallNextHookEx ValidateRect GetCursorPos SetWindowsHookExA GetLastActivePopup IsWindowEnabled EnableWindow ShowOwnedPopups PostQuitMessage GetWindowTextLengthA OemToCharA CharToOemA IsWindow SetDlgItemTextA DefWindowProcA MsgWaitForMultipleObjects GetDlgItemTextA RegisterClassA SetWindowLongA DestroyWindow CloseWindow RegisterWindowMessageA SetActiveWindow GetClassNameA GetDlgItem SetRect IsRectEmpty UnionRect ExitWindowsEx CreateDesktopA CreateDesktopW wsprintfW wsprintfA CreateWindowExA GetClientRect SendMessageA DrawTextA GrayStringA InsertMenuA AppendMenuA GetMenuStringA RemoveMenu PtInRect SetWindowTextA wvsprintfA DeleteMenu CheckDlgButton CheckRadioButton EnumWindowStationsA EnumDesktopsA AttachThreadInput ShowWindow SetWindowPos SetForegroundWindow OemToCharBuffA CharToOemBuffA OpenDesktopW GetUserObjectInformationW GetWindowTextA GetDesktopWindow IsDlgButtonChecked ScrollWindowEx IsDialogMessageA MoveWindow GetSysColorBrush DestroyMenu GetFocus GetDlgItemInt EnumChildWindows EnumWindows GetParent GetWindowLongA GetWindowTextW IsWindowVisible EnumDesktopWindows MessageBoxW MessageBoxA OpenWindowStationA SetProcessWindowStation CloseWindowStation GetForegroundWindow GetClassNameW GetProcessWindowStation GetUserObjectInformationA OpenInputDesktop OpenDesktopA GetThreadDesktop SetThreadDesktop CloseDesktop LoadImageA GetClassLongA CopyIcon GetIconInfo DestroyIcon GetDC ReleaseDC LoadCursorA SetCursor SendMessageTimeoutA EnumDisplaySettingsA GetSystemMetrics PostThreadMessageA PostMessageA FindWindowA PeekMessageA GetMessageA TranslateMessage DispatchMessageA FindWindowExA GetWindowThreadProcessId GetClassInfoExA SetDlgItemInt GetClassInfoA GetWindow SetScrollRange

gdi32

SelectClipPath SetDIBColorTable BitBlt SetStretchBltMode StretchBlt GdiFlush GetStockObject GetPaletteEntries GetDeviceCaps CreateCompatibleDC CreateCompatibleBitmap SelectObject SetPixel DeleteObject DeleteDC ExtSelectClipRgn PlayMetaFileRecord GetObjectType EnumMetaFile PlayMetaFile GetViewportExtEx GetWindowExtEx CreatePen ExtCreatePen CreateSolidBrush CreateHatchBrush CreatePatternBrush CreateDIBPatternBrushPt PtVisible RectVisible TextOutA ExtTextOutA Escape CopyMetaFileA CreateDCA SetDIBits GetDIBits GetObjectA CreateFontIndirectW GetObjectW CombineRgn CreateRectRgnIndirect GetBitmapBits CreateRectRgn GetRegionData CreateBitmap GetDCOrgEx GetClipBox SetTextColor SetBkColor StartDocA SaveDC RestoreDC SelectPalette SetBkMode SetPolyFillMode SetROP2 SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx SelectClipRgn ExcludeClipRect IntersectClipRect OffsetClipRgn MoveToEx LineTo SetTextAlign SetTextJustification SetTextCharacterExtra SetMapperFlags GetCurrentPositionEx ArcTo SetArcDirection PolyDraw PolylineTo SetColorAdjustment PolyBezierTo GetClipRgn CreateDIBSection

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterW FindClosePrinterChangeNotification FreePrinterNotifyInfo GetPrinterW FindFirstPrinterChangeNotification DocumentPropertiesA EnumPortsA GetJobA AddPrinterA DeletePrinter OpenPrinterA EnumJobsA GetPrinterA ClosePrinter FindNextPrinterChangeNotification EnumPrintersA

advapi32

OpenEventLogA RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegNotifyChangeKeyValue RegCreateKeyW RegEnumKeyA RegConnectRegistryA ReportEventA RegisterEventSourceA FreeSid EqualSid RegSetValueA RegSetKeySecurity LookupAccountNameA RegFlushKey RegUnLoadKeyA RegLoadKeyA GetUserNameA EnumServicesStatusA EnumDependentServicesA RegLoadKeyW RegUnLoadKeyW RegDeleteValueW RegDeleteKeyW RegEnumValueW RegEnumKeyW RegConnectRegistryW RegQueryInfoKeyA RegEnumValueA RegDeleteKeyA RegDeleteValueA InitiateSystemShutdownA GetAclInformation GetLengthSid InitializeAcl GetAce AddAce AddAccessAllowedAce GetSecurityDescriptorDacl LookupAccountNameW GetFileSecurityW SetFileSecurityW GetFileSecurityA RegSetValueExA RegCreateKeyA RegCloseKey GetOldestEventLogRecord GetNumberOfEventLogRecords ReadEventLogA CloseEventLog LookupAccountSidW LookupAccountSidA QueryServiceStatus RegQueryInfoKeyW RegQueryValueA RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegSetValueExW ControlService StartServiceA DeleteService LockServiceDatabase CreateServiceA UnlockServiceDatabase LookupPrivilegeValueA AdjustTokenPrivileges SetFileSecurityA RegCreateKeyExA GetUserNameW InitializeSecurityDescriptor SetSecurityDescriptorDacl RegOpenKeyA RegisterEventSourceW ReportEventW DeregisterEventSource OpenSCManagerA OpenServiceA QueryServiceConfigA ChangeServiceConfigA CloseServiceHandle OpenProcessToken DuplicateTokenEx GetTokenInformation AllocateAndInitializeSid

shell32

SHGetPathFromIDListW DragAcceptFiles StrStrIW SHChangeNotify SHGetSpecialFolderLocation SHGetSpecialFolderPathW SHGetSpecialFolderPathA SHFileOperationW SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA

comctl32

ord17

ole32

CoTreatAsClass ReadClassStg ReadFmtUserTypeStg OleRegGetUserType WriteClassStg WriteFmtUserTypeStg SetConvertStg CreateBindCtx CoTaskMemAlloc OleDuplicateData ReleaseStgMedium CLSIDFromProgID StringFromCLSID CoSetProxyBlanket CoTaskMemFree CoCreateGuid CLSIDFromString CoInitializeEx CoInitialize CoCreateInstance CoUninitialize CoDisconnectObject OleRun

oleaut32

SafeArrayCreateVector GetErrorInfo SetErrorInfo CreateErrorInfo VariantInit SysFreeString SystemTimeToVariantTime VariantChangeType VariantClear VariantCopy SysAllocString SafeArrayUnaccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayGetElemsize SafeArrayGetDim SafeArrayCreate SafeArrayRedim SysAllocStringByteLen SysStringByteLen VarBstrFromCy VarDateFromStr VarBstrFromDate SafeArrayCopy SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayGetElement SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayLock SafeArrayUnlock SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor SysStringLen SysAllocStringLen SysReAllocStringLen VarCyFromStr

setupapi

SetupInstallFileA

crypt32

CertFindCertificateInStore CertAddEncodedCertificateToStore CertCloseStore CertFreeCertificateContext CertOpenStore

mpr

WNetGetConnectionW WNetGetConnectionA

shlwapi

PathFileExistsA

wldap32

ord41 ord27 ord301 ord33 ord79 ord35 ord32 ord200 ord45 ord22 ord213 ord145 ord50 ord26 ord46 ord30

$WINDIR/bakrdgv3.sys

IMPHASH f71f315bc7c309824aca4e997caab766
SHA256 a3d817490804a951bac1c7b1ea6f48aed75baec7e3b4e31be4fbd1fe82860bb1
MD5 97ac3ef2e098c4cb7dd6ec1d14dc28f1
SHA1 3e78e87eefe45f8403e46d94713b6667aee6d9c9
SHA512 693e90da2581306a1f9bb117142429301c7dc28a8caf623c4dfc21f735c53c4502e2b58a5ebdbd8c568dfd3393d1687428f1934f4c28b4fc715eb8f856ac02cd
SSDEEP 24576:I1iQzjPLwVa0gzIkUeSr18gU9W36RO5TsHKGaXDx0hl:Iz5zISSrqW36I7FXDx0hl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

d7:66:68:59:80:47:68:65:e0:3e:89:ea:42:fc:84:11:01:19:4b:f4:55:e4:f2:0d:64:18:c2:b3:38:a6:3b:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

c5:48:a9:b7:10:ac:42:fc:19:b3:16:05:2d:d0:bf:ab:f9:4f:f2:75

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

133766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalAddAtomA GlobalGetAtomNameA LockResource LoadResource FindResourceA ResumeThread SetThreadPriority SuspendThread GetCurrentThread GetCPInfo GetOEMCP GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA RtlUnwind GetTimeZoneInformation GetSystemTime ExitProcess TerminateProcess GetStartupInfoA GetCommandLineA RaiseException GetACP HeapReAlloc HeapSize ExitThread FatalAppExitA LCMapStringA LCMapStringW UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree GetStringTypeA GetStringTypeW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetStdHandle GlobalFindAtomA CompareStringA CompareStringW SetEnvironmentVariableA SleepEx SetThreadLocale LoadLibraryExW GetWindowsDirectoryW OpenMutexA OpenFileMappingA GlobalDeleteAtom GetProcessVersion TlsGetValue LocalReAlloc TlsSetValue GlobalReAlloc TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcatA SetErrorMode GlobalFlags GlobalSize OutputDebugStringA DefineDosDeviceA GetDiskFreeSpaceExA SetVolumeLabelA QueryDosDeviceW GetLogicalDrives GetDriveTypeW GetDriveTypeA GetExitCodeThread BeginUpdateResourceA UpdateResourceA EndUpdateResourceA EnumResourceLanguagesA EnumResourceTypesA EnumResourceNamesA SizeofResource LoadLibraryExA CreateFileMappingA MapViewOfFile UnmapViewOfFile VirtualProtectEx WriteProcessMemory VirtualProtect QueryPerformanceCounter VirtualQueryEx InterlockedExchangeAdd InterlockedExchange InterlockedCompareExchange ReadProcessMemory GetThreadPriority GetPriorityClass SetPriorityClass TerminateThread LoadLibraryW MoveFileW GetEnvironmentVariableW GetTempPathW GetTempPathA GetSystemDirectoryW ExpandEnvironmentStringsW ExpandEnvironmentStringsA FormatMessageW FindResourceExA SetLastError WaitForMultipleObjects ReleaseMutex ReleaseSemaphore CreateSemaphoreA SystemTimeToFileTime LocalFileTimeToFileTime GetShortPathNameA lstrcmpiA GetThreadLocale GetStringTypeExA GetFullPathNameA lstrcpynA GetVolumeInformationA lstrcpyA SetEndOfFile UnlockFile LockFile DuplicateHandle FileTimeToLocalFileTime lstrlenW GlobalLock GlobalUnlock lstrlenA InterlockedDecrement InterlockedIncrement LeaveCriticalSection EnterCriticalSection AllocConsole GetStdHandle WriteConsoleA FreeConsole OutputDebugStringW SetFilePointer DeleteCriticalSection InitializeCriticalSection GetProfileStringA WideCharToMultiByte CreateProcessA GetWindowsDirectoryA GlobalAlloc GlobalFree FormatMessageA ResetEvent SetEvent WaitForSingleObject SetConsoleCtrlHandler CreateMutexA GetVersionExA CreateEventA PulseEvent GetVersion GetUserDefaultLangID GetSystemDefaultLangID FreeLibrary MultiByteToWideChar MulDiv GetExitCodeProcess GetProcessTimes FileTimeToSystemTime CopyFileW GetDiskFreeSpaceExW GetFileTime SetFileTime VirtualQuery CreateProcessW GetProcessHeap HeapAlloc HeapFree WriteFile CreateFileW GetFileSize GetComputerNameA GetComputerNameW FlushFileBuffers GetFileAttributesW CreateDirectoryW CreateDirectoryA GetFileAttributesExA GetFileAttributesExW GetVolumeInformationW QueryDosDeviceA DeviceIoControl ReadFile Sleep MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileExW DeleteFileW SetFileAttributesA lstrcmpA RemoveDirectoryA MoveFileExA DeleteFileA GetSystemInfo FindFirstFileA FindNextFileA LoadLibraryA LocalFree OpenProcess GetLastError GetCurrentProcess CreateThread GetSystemDirectoryA GetModuleHandleW GetFileInformationByHandle GetCurrentThreadId GetModuleHandleA GetProcAddress GetTickCount GetLocalTime GetCurrentProcessId FindFirstFileW lstrcmpW FindNextFileW FindClose CreateFileA CloseHandle CopyFileA GetFileAttributesA GetCurrentDirectoryW GetModuleFileNameW GetCurrentDirectoryA GetLocaleInfoW GetModuleFileNameA

user32

GetKeyState SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos RegisterWindowMessageA OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement MoveWindow SetWindowLongA IsDialogMessageA ScrollWindowEx IsDlgButtonChecked SetDlgItemTextA SetDlgItemInt TrackPopupMenu GetDlgItemTextA GetDlgItemInt GetDlgItem CheckRadioButton CheckDlgButton GetSysColor GetSysColorBrush LoadCursorA GrayStringA DrawTextA TabbedTextOutA OpenInputDesktop BeginPaint GetWindowDC ReleaseDC GetDC ScreenToClient UnhookWindowsHookEx GetLastActivePopup IsWindowEnabled EnableWindow GetScrollPos SetScrollPos wvsprintfA GetMenu GetClassInfoA WinHelpA SendDlgItemMessageA GetUserObjectInformationA SetFocus GetFocus GetProcessWindowStation FindWindowExA GetWindowThreadProcessId GetClassNameW GetForegroundWindow CloseWindowStation SetProcessWindowStation OpenWindowStationA MessageBoxA MessageBoxW SendMessageTimeoutA EnumDesktopWindows IsWindowVisible GetWindowLongA SetWindowPlacement GetUserObjectInformationW GetParent EnumWindows OpenDesktopA GetThreadDesktop SetThreadDesktop CloseDesktop GetCapture IsChild GetTopWindow SetScrollRange GetScrollRange ShowScrollBar SetScrollInfo GetScrollInfo ScrollWindow EndDeferWindowPos CopyRect BeginDeferWindowPos DeferWindowPos EqualRect AdjustWindowRectEx IsWindow SetActiveWindow MapWindowPoints UpdateWindow PostMessageA LoadIconA GetCursorPos ValidateRect GetActiveWindow GetMessageA GetNextDlgTabItem EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA LoadBitmapA GetMenuCheckMarkDimensions EnumChildWindows GetDesktopWindow GetWindowTextA GetWindowTextW PostQuitMessage DestroyMenu ShowOwnedPopups SetCursor DeleteMenu EndPaint SetWindowTextA ClientToScreen GetWindow GetDlgCtrlID GetWindowRect PtInRect GetClassNameA RemoveMenu GetMenuItemCount GetSubMenu GetMenuState GetMenuStringA AppendMenuA GetMenuItemID InsertMenuA LoadStringA MsgWaitForMultipleObjects GetSystemMetrics CharUpperA wsprintfA GetWindowTextLengthA OemToCharA CharToOemA PeekMessageA TranslateMessage DispatchMessageA RegisterClassA DefWindowProcA DestroyWindow CreateWindowExA GetClientRect SendMessageA AttachThreadInput ShowWindow SetWindowPos SetForegroundWindow FindWindowA

gdi32

ExtTextOutA Escape GetDCOrgEx GetObjectA PtVisible CreateDIBPatternBrushPt CreatePatternBrush CreateHatchBrush CreateSolidBrush ExtCreatePen CreatePen GetWindowExtEx GetViewportExtEx PlayMetaFile EnumMetaFile GetObjectType PlayMetaFileRecord ExtSelectClipRgn SelectClipPath CreateRectRgn GetClipRgn PolyBezierTo SetColorAdjustment PolylineTo PolyDraw SetArcDirection ArcTo TextOutA SetMapperFlags SetTextCharacterExtra SetTextJustification SetTextAlign LineTo MoveToEx CreateFontIndirectW GetDeviceCaps GetObjectW GetStockObject CopyMetaFileA CreateDCA DeleteObject DeleteDC StartDocA SaveDC RestoreDC SelectObject SelectPalette SetBkColor SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx GetCurrentPositionEx RectVisible GetBitmapBits BitBlt CreateCompatibleBitmap CreateCompatibleDC ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox SelectClipRgn ExcludeClipRect CreateBitmap OffsetClipRgn IntersectClipRect

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegisterEventSourceA DeregisterEventSource GetUserNameA RegSetKeySecurity RegCreateKeyW RegEnumValueA RegQueryInfoKeyA RegEnumKeyA RegConnectRegistryA RegCreateKeyExA RegSetValueA RegDeleteKeyA RegOpenKeyExA SetServiceStatus RegisterServiceCtrlHandlerA StartServiceA RegDeleteValueA OpenServiceA ControlService QueryServiceStatus DeleteService OpenSCManagerA CreateServiceA CloseServiceHandle StartServiceCtrlDispatcherA IsValidSid CopySid GetAclInformation GetLengthSid InitializeAcl GetAce AddAce AddAccessAllowedAce GetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupAccountNameW GetFileSecurityW SetFileSecurityW GetFileSecurityA AllocateAndInitializeSid EqualSid FreeSid SetFileSecurityA RegSetValueExA RegOpenKeyA GetUserNameW GetTokenInformation LookupAccountSidW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegQueryValueExA RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegSetValueExW RegCloseKey ReportEventA

shell32

SHGetFileInfoA SHGetPathFromIDListW SHGetSpecialFolderPathA DragAcceptFiles

comctl32

ord17

ole32

OleRegGetUserType WriteClassStg WriteFmtUserTypeStg SetConvertStg ReadFmtUserTypeStg CoTaskMemAlloc OleDuplicateData CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize CoInitializeEx ReadClassStg StringFromCLSID ReleaseStgMedium CoDisconnectObject CreateBindCtx CoTreatAsClass

oleaut32

SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElemsize SafeArrayAccessData SafeArrayUnaccessData SafeArrayAllocData SysReAllocStringLen SysAllocStringLen SysStringLen SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayDestroy SafeArrayUnlock SafeArrayLock SafeArrayPutElement SafeArrayPtrOfIndex SafeArrayGetElement SafeArrayAllocDescriptor SystemTimeToVariantTime SafeArrayCopy VarBstrFromDate VarDateFromStr VarBstrFromCy VarCyFromStr SysStringByteLen VariantChangeType SysAllocStringByteLen SysAllocString VariantCopy SafeArrayRedim VariantClear SafeArrayCreate SafeArrayGetDim

mpr

WNetGetConnectionW

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

rpcrt4

RpcStringFreeW UuidToStringW RpcStringFreeA UuidToStringA UuidFromStringW UuidCreate

$WINDIR/bakrdlv3.sys

IMPHASH a30990f8c49e6bd780231fa7e7e4a8a3
SHA256 453e2290939078c070e46896b2d991f31d295bbc1c63059b10f3c24cad7c4822
MD5 0cbeb75d3090054817ea4df0773afe35
SHA1 58c543a84dc18e21d86ad2c011d8ac726867fb78
SHA512 f3ab9f393da18df2cfc22020627e72ae9e7c7b47db088aaf0fa773028c96d0e7e3d4127082b59296eecfc9c60d389a43c78ba0a4348b0f6ceb76cc8978ba649c
SSDEEP 768:aYNaVzGJ6dKwFGeThZF1oGPh4xFn2MpDGNxvTp23+zjo1:aEaVzGvwFGefoGyjcM0o1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

c9:04:85:a8:fc:df:a1:3b:0b:91:d6:3a:7e:86:e5:df:ed:35:f3:42:eb:17:da:17:b4:bc:51:9c:6f:84:d1:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Chains

Feb 2, 2021

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

f0:e8:ec:59:b9:e2:ee:75:e0:77:a7:75:d7:36:ed:41:74:21:af:7a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Chains

Feb 2, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Serial Number

08:1d:a4:67:70:c6:63:34:9e:8f:76:db:40:4a:47:9d

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 10, 2019 - Oct 20, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=T.E.C Solutions (G.Z.)Limited,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Serial Number

0f:1c:75:cb:3c:66:4f:c8:86:57:ed:11:ec:a5:71:01

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 10, 2019 - Oct 20, 2022

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

0

Major OS version

4

Entry point

4844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$WINDIR/bakstec3.sys

IMPHASH 0dfd18b47f2ad9bb705fc829b2b32c50
SHA256 cb72b724c5f57e83cc5bc215dd522c566e0ea695b9e3d167eed9be3f18d273ce
MD5 b9e0a7cbd7fdb4d179172dbdd453495a
SHA1 7f1b18a2bee7defa6db4900982fd3311aabed50d
SHA512 720985495b67e87f6ecf62268d7dc8fecdb7c06cf9606ce1a12ce4ea741dd3d46a759420e02ec54bc6e96e49d37a2e19ac307093b1228c01914c8e632a8d373c
SSDEEP 24576:mrmoCH/siu9xQBvJ4TyKyCdgjBXj0jHy3WBZ3cRDusH192mdoEtPg+61zpw94I25:mhxaM+7g+Kzq4I28/1eKle7mLXyn0Lw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

38:07:e2:8a:d5:c9:8d:4b:7e:4c:ea:f7:ba:96:9f:54:e3:95:b3:af:b1:f5:b6:9f:4c:93:2a:e7:91:a5:4d:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

10:a0:07:5d:9c:3b:02:a6:a7:50:0c:61:e1:6c:b6:eb:9a:c4:fb:9b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

256195

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetErrorMode lstrcatA TlsAlloc GlobalHandle TlsFree GlobalReAlloc TlsSetValue LocalReAlloc TlsGetValue GetProcessVersion GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA LockResource LoadResource FindResourceA SetEvent ResumeThread SetThreadPriority SuspendThread GetCurrentThread GetCPInfo GetOEMCP GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA RtlUnwind GetTimeZoneInformation GetSystemTime GetStartupInfoA GetCommandLineA ExitProcess RaiseException GetACP HeapReAlloc HeapSize ExitThread FatalAppExitA LCMapStringA LCMapStringW GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetFileType GlobalFlags GetStringTypeW SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetConsoleCtrlHandler SetStdHandle GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA SizeofResource BackupWrite BackupRead BackupSeek QueryPerformanceCounter VirtualQueryEx InterlockedExchangeAdd InterlockedExchange InterlockedCompareExchange ReadProcessMemory GetThreadPriority GetExitCodeThread TerminateThread ResetEvent MoveFileW GetEnvironmentVariableW GetTempPathW GetSystemDirectoryW CreateFileMappingA MapViewOfFile UnmapViewOfFile SetVolumeLabelA GetDiskFreeSpaceA FormatMessageW FindResourceExA EnumResourceTypesA EnumResourceLanguagesA EndUpdateResourceA UpdateResourceA BeginUpdateResourceA VirtualProtect DefineDosDeviceA GlobalFree GlobalSize GlobalAlloc SetLastError WaitForMultipleObjects CreateEventA ReleaseMutex CreateMutexA ReleaseSemaphore CreateSemaphoreA SystemTimeToFileTime LocalFileTimeToFileTime GetShortPathNameA lstrcmpiA GetThreadLocale GetStringTypeExA GetFullPathNameA lstrcpynA lstrcpyA SetEndOfFile UnlockFile LockFile DuplicateHandle FileTimeToLocalFileTime lstrlenW GlobalLock GlobalUnlock FormatMessageA lstrlenA InterlockedDecrement InterlockedIncrement LoadLibraryW GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA OpenMutexA GetVersionExA AllocConsole GetStdHandle WriteConsoleA FreeConsole OutputDebugStringW SetFilePointer GetProfileStringA WideCharToMultiByte WaitForSingleObject LocalAlloc GetTempPathA GetWindowsDirectoryA SetCurrentDirectoryA CreateProcessA LeaveCriticalSection EnterCriticalSection TerminateProcess SetPriorityClass GetPriorityClass GetDriveTypeA ExpandEnvironmentStringsW GetLogicalDrives ExpandEnvironmentStringsA DeleteCriticalSection EnumResourceNamesA InitializeCriticalSection GetVersion GetUserDefaultLangID GetSystemDefaultLangID MultiByteToWideChar MulDiv GetExitCodeProcess GetProcessTimes FileTimeToSystemTime GetWindowsDirectoryW OutputDebugStringA SetThreadLocale OpenFileMappingA SleepEx PulseEvent CopyFileW GetDiskFreeSpaceExW GetFileTime SetFileTime VirtualQuery CreateProcessW GetProcessHeap HeapAlloc HeapFree WriteFile GetComputerNameA GetComputerNameW FlushFileBuffers CreateDirectoryA GetFileAttributesExA GetFileAttributesExW GetVolumeInformationW QueryDosDeviceA DeviceIoControl Sleep MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileExW DeleteFileW SetFileAttributesA lstrcmpA RemoveDirectoryA DeleteFileA GetSystemInfo FindFirstFileA FindNextFileA LoadLibraryA LocalFree OpenProcess GetCurrentProcess CreateThread GetSystemDirectoryA GetModuleHandleW GetFileInformationByHandle GetCurrentThreadId GetModuleHandleA GetFileSize ReadFile GetLastError LoadLibraryExW LoadLibraryExA GetProcAddress FreeLibrary CreateFileW GetDriveTypeW QueryDosDeviceW GetTickCount GetFileAttributesW CreateDirectoryW GetLocalTime GetCurrentProcessId FindFirstFileW lstrcmpW FindNextFileW FindClose CreateFileA CloseHandle CopyFileA MoveFileExA GetFileAttributesA GetCurrentDirectoryW GetModuleFileNameW GetCurrentDirectoryA GetStringTypeA GetModuleFileNameA

user32

IsIconic GetWindowPlacement MoveWindow SetWindowLongA ScrollWindowEx IsDlgButtonChecked SetDlgItemTextA SetDlgItemInt SendDlgItemMessageA GetDlgItemTextA GetDlgItemInt CheckRadioButton CheckDlgButton GetSysColor GetSysColorBrush LoadCursorA GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ScreenToClient UnhookWindowsHookEx GetLastActivePopup IsWindowEnabled EnableWindow GetScrollPos SetScrollPos wvsprintfA SetFocus GetFocus SetWindowTextA ClientToScreen GetWindow SystemParametersInfoA GetWindowRect PtInRect RemoveMenu GetMenuItemCount GetSubMenu GetMenuState GetMenuStringA AppendMenuA GetMenuItemID InsertMenuA LoadStringA MsgWaitForMultipleObjects IntersectRect OffsetRect RegisterWindowMessageA GetMessagePos GetMessageTime DefWindowProcA GetSystemMetrics CharUpperA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CallNextHookEx wsprintfA GetWindowTextLengthA OemToCharA CharToOemA SetActiveWindow GetClassNameA GetDlgItem OpenDesktopW GetMessageA DispatchMessageA TranslateMessage CreateWindowExA SetWindowsHookExA DestroyWindow GetKeyState SetWindowPlacement TrackPopupMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture IsChild GetTopWindow SetScrollRange GetScrollRange ShowScrollBar SetScrollInfo GetScrollInfo ScrollWindow EndDeferWindowPos CopyRect BeginDeferWindowPos DeferWindowPos EqualRect AdjustWindowRectEx IsWindow PeekMessageA MapWindowPoints UpdateWindow PostMessageA LoadIconA GetCursorPos ValidateRect GetActiveWindow GetNextDlgTabItem EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA LoadBitmapA GetClientRect GetUserObjectInformationW CharToOemBuffA OemToCharBuffA SendMessageA AttachThreadInput ShowWindow SetWindowPos SetForegroundWindow FindWindowA GetWindowTextW GetMenuCheckMarkDimensions PostQuitMessage DestroyMenu ShowOwnedPopups SetCursor DeleteMenu GetDlgCtrlID GetWindowTextA GetDesktopWindow EnumChildWindows EnumWindows GetParent GetWindowLongA IsWindowVisible EnumDesktopWindows SendMessageTimeoutA MessageBoxW MessageBoxA OpenWindowStationA SetProcessWindowStation CloseWindowStation GetForegroundWindow GetClassNameW GetWindowThreadProcessId FindWindowExA GetProcessWindowStation GetUserObjectInformationA OpenInputDesktop OpenDesktopA GetThreadDesktop SetThreadDesktop CloseDesktop IsDialogMessageA

gdi32

GetDCOrgEx TextOutA CreateBitmap RectVisible PtVisible CreateDIBPatternBrushPt CreatePatternBrush CreateHatchBrush CreateSolidBrush ExtCreatePen CreatePen GetWindowExtEx GetViewportExtEx PlayMetaFile EnumMetaFile GetObjectType PlayMetaFileRecord ExtSelectClipRgn SelectClipPath CreateRectRgn GetClipRgn PolyBezierTo SetColorAdjustment PolylineTo PolyDraw SetArcDirection ArcTo GetCurrentPositionEx Escape SetTextCharacterExtra SetTextJustification SetTextAlign LineTo MoveToEx OffsetClipRgn IntersectClipRect ExcludeClipRect SelectClipRgn GetClipBox ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx CreateFontIndirectW GetDeviceCaps GetObjectW GetStockObject CopyMetaFileA CreateDCA DeleteObject DeleteDC StartDocA SaveDC RestoreDC SelectObject SelectPalette SetBkColor SetMapperFlags ExtTextOutA SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetTextColor SetMapMode SetViewportOrgEx GetObjectA SetViewportExtEx CreateCompatibleDC CreateCompatibleBitmap BitBlt GetBitmapBits OffsetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegConnectRegistryA RegCreateKeyW RegSetKeySecurity GetUserNameA DeregisterEventSource ReportEventA RegisterEventSourceA EnumServicesStatusA RegSetValueA QueryServiceStatus LockServiceDatabase UnlockServiceDatabase RegCreateKeyExA ControlService DeleteService CreateServiceA ChangeServiceConfig2A StartServiceA QueryServiceConfig2A OpenSCManagerA OpenServiceA QueryServiceConfigA ChangeServiceConfigA CloseServiceHandle RegQueryInfoKeyA RegEnumValueA RegDeleteKeyA RegDeleteValueA GetAclInformation GetLengthSid InitializeAcl GetAce AddAce AddAccessAllowedAce GetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupAccountNameW GetFileSecurityW SetFileSecurityW GetFileSecurityA AllocateAndInitializeSid EqualSid FreeSid SetFileSecurityA RegSetValueExA RegOpenKeyA GetUserNameW GetTokenInformation LookupAccountSidW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegSetValueExW RegCloseKey RegOpenKeyExA RegQueryValueExA RegEnumKeyA

shell32

SHGetSpecialFolderPathW DragAcceptFiles SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetPathFromIDListW SHGetSpecialFolderPathA

comctl32

ord17

ole32

ReadClassStg OleRegGetUserType WriteClassStg WriteFmtUserTypeStg SetConvertStg CreateBindCtx CoTaskMemAlloc OleDuplicateData CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize StringFromCLSID CoTreatAsClass ReleaseStgMedium CoDisconnectObject ReadFmtUserTypeStg CoInitializeEx

oleaut32

SysFreeString SetErrorInfo SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound CreateErrorInfo SystemTimeToVariantTime GetErrorInfo SafeArrayCopy SysReAllocStringLen SysAllocStringLen SysStringLen SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayDestroy SafeArrayUnlock SafeArrayLock SafeArrayPutElement SafeArrayPtrOfIndex SafeArrayGetElement SafeArrayAllocDescriptor SafeArrayAllocData VariantInit VarBstrFromDate VarDateFromStr VarBstrFromCy VarCyFromStr SysStringByteLen VariantChangeType SysAllocStringByteLen SysAllocString VariantCopy SafeArrayRedim VariantClear SafeArrayCreate SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetLBound

mpr

WNetGetConnectionW WNetGetConnectionA

setupapi

SetupInstallFileA

ws2_32

ntohl inet_addr inet_ntoa WSAStartup gethostbyname htonl

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

rpcrt4

UuidToStringW UuidCreate UuidFromStringW RpcStringFreeW UuidToStringA RpcStringFreeA

$WINDIR/bakwdgv3.sys

IMPHASH d3b49be17ba0983dccb13aeb18656ade
SHA256 326abf1af467670de571252bfd8118b9ea0b8a3babc10df092fffc2da3e11671
MD5 0aed8f70a00060f8005efa8d1c668b98
SHA1 c75fe3d1a2476da55f526d366f73bedbfd56f32a
SHA512 738f9cbd6f693647d8b091d7192db8963e2c4ecb179ce1b5c7a81f56045674694faed7fdf88af5d7e144149d86df167d9adf6460e3905024faf526c08f7dc787
SSDEEP 24576:ZlX1wCmSn/ggkRk9XJ4QkOHE5/H8ZZsjLAAhHoMapx1XyM05g8wWT3Q80I:HRZR5vkIE5P88hAFXyM05IWk8D
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

a1:05:7a:2e:18:8a:2a:9d:95:d7:29:e2:fd:1b:85:55:8c:ca:36:6e:80:4c:6c:ab:2b:02:70:4b:8e:bb:1c:40

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

f0:06:8d:72:8b:ea:e6:5b:53:a2:83:19:07:12:a9:03:fe:2d:4d:7e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

204276

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

setupapi

SetupInstallFileA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

kernel32

CreateSemaphoreA ReleaseSemaphore ReleaseMutex SetLastError ResumeThread SetThreadPriority SuspendThread TlsAlloc GlobalFree GlobalHandle TlsFree GlobalReAlloc GlobalAlloc TlsSetValue LocalReAlloc TlsGetValue lstrcatA GlobalSize GlobalFlags GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA LockResource LoadResource FindResourceA GetProcessVersion GetCPInfo GetOEMCP GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA RtlUnwind GetTimeZoneInformation GetCommandLineA RaiseException GetACP ExitThread HeapSize HeapReAlloc ExitProcess FatalAppExitA LCMapStringA LCMapStringW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree GetStringTypeA GetStringTypeW VirtualAlloc IsBadWritePtr UnhandledExceptionFilter IsBadReadPtr IsBadCodePtr IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetConsoleCtrlHandler SetStdHandle GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA SleepEx SetThreadLocale GetWindowsDirectoryW GetModuleFileNameA GetComputerNameW FlushFileBuffers CreateDirectoryA GetFileAttributesExA GetFileAttributesExW GetVolumeInformationW QueryDosDeviceA DeviceIoControl MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileExW WaitForSingleObject SystemTimeToFileTime LocalFileTimeToFileTime GetShortPathNameA SetCurrentDirectoryA OpenFileMappingA OutputDebugStringA DefineDosDeviceA GetDriveTypeW SetVolumeLabelA GetDiskFreeSpaceA OpenSemaphoreA OpenEventA GetQueuedCompletionStatus PostQueuedCompletionStatus DisconnectNamedPipe CreateIoCompletionPort CancelIo GetOverlappedResult CreateNamedPipeA ConnectNamedPipe WaitNamedPipeA SetNamedPipeHandleState GetThreadContext GetExitCodeThread ResetEvent VirtualProtectEx WriteProcessMemory VirtualProtect CreateFileMappingA MapViewOfFile UnmapViewOfFile BeginUpdateResourceA UpdateResourceA EndUpdateResourceA EnumResourceLanguagesA EnumResourceTypesA EnumResourceNamesA SizeofResource QueryPerformanceCounter InterlockedExchangeAdd InterlockedExchange InterlockedCompareExchange ReadProcessMemory GetThreadPriority TerminateThread LoadLibraryW MoveFileW GetEnvironmentVariableW GetTempPathW GetTempPathA GetSystemDirectoryW FormatMessageW FindResourceExA GetCurrentDirectoryA GetModuleFileNameW GetCurrentDirectoryW GetLastError Sleep GetThreadLocale GetStringTypeExA GetFullPathNameA lstrcpynA lstrcpyA SetEndOfFile UnlockFile LockFile DuplicateHandle FileTimeToLocalFileTime lstrlenW GlobalLock GlobalUnlock FormatMessageA lstrlenA InterlockedDecrement InterlockedIncrement VirtualQueryEx GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA AllocConsole GetStdHandle WriteConsoleA FreeConsole OutputDebugStringW GetProfileStringA WideCharToMultiByte LeaveCriticalSection EnterCriticalSection SetPriorityClass GetPriorityClass GetDriveTypeA ExpandEnvironmentStringsW QueryDosDeviceW GetLogicalDrives DeleteCriticalSection InitializeCriticalSection OpenMutexA CreateProcessA LocalAlloc lstrcmpiA DeleteFileW SetFileAttributesA lstrcmpA RemoveDirectoryA MoveFileExA DeleteFileA GetSystemInfo FindFirstFileA FindNextFileA LoadLibraryA LocalFree OpenProcess GetCurrentProcess CreateThread GetSystemDirectoryA GetModuleHandleW GetFileInformationByHandle GetCurrentThreadId GetModuleHandleA CreateFileW GetFileSize ReadFile LoadLibraryExW LoadLibraryExA GetProcAddress FreeLibrary GetTickCount GetFileAttributesW CreateDirectoryW GetLocalTime GetCurrentProcessId FindFirstFileW lstrcmpW FindNextFileW FindClose CreateFileA CloseHandle CopyFileA GetFileAttributesA ExpandEnvironmentStringsA CreateMutexA CreateEventA WaitForMultipleObjects SetEvent GetWindowsDirectoryA GetSystemTime SetFilePointer CompareFileTime SetErrorMode SetUnhandledExceptionFilter GetCurrentThread TerminateProcess GetVersion GetUserDefaultLangID GetSystemDefaultLangID MultiByteToWideChar MulDiv GetExitCodeProcess GetProcessTimes FileTimeToSystemTime CopyFileW GetDiskFreeSpaceExW GetFileTime SetFileTime VirtualQuery CreateProcessW GetProcessHeap HeapAlloc HeapFree WriteFile GetComputerNameA PulseEvent

user32

OpenInputDesktop DeleteMenu SetCursor ShowOwnedPopups DestroyMenu PostQuitMessage GetSysColorBrush LoadCursorA MoveWindow IsDialogMessageA ScrollWindowEx IsDlgButtonChecked SetDlgItemTextA SetDlgItemInt GetDlgItemTextA GetDlgItemInt CheckRadioButton CheckDlgButton LoadIconA OpenDesktopA UpdateWindow SendDlgItemMessageA MapWindowPoints GetSysColor SetActiveWindow IsWindow AdjustWindowRectEx EqualRect DeferWindowPos BeginDeferWindowPos CopyRect EndDeferWindowPos ScrollWindow GetScrollInfo SetScrollInfo ShowScrollBar GetScrollRange SetScrollRange GetTopWindow IsChild GetThreadDesktop SetThreadDesktop CloseDesktop PostMessageA EnableMenuItem GetCapture WinHelpA GetUserObjectInformationA GetProcessWindowStation FindWindowExA GetWindowThreadProcessId GetClassNameW GetForegroundWindow CloseWindowStation SetProcessWindowStation OpenWindowStationA MessageBoxA MessageBoxW SendMessageTimeoutA EnumDesktopWindows IsWindowVisible GetWindowLongA CharToOemBuffA OemToCharBuffA GetUserObjectInformationW GetClassInfoA RegisterClassA GetMenu TrackPopupMenu SetWindowPlacement DestroyWindow GetClassLongA SetPropA GetPropA CallWindowProcA RemovePropA DefWindowProcA GetMessageTime GetMessagePos SetWindowLongA RegisterWindowMessageA OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetMenuCheckMarkDimensions LoadBitmapA ModifyMenuA SetMenuItemBitmaps CheckMenuItem GetDlgItem GetNextDlgTabItem GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ScreenToClient GetLastActivePopup IsWindowEnabled EnableWindow GetScrollPos SetScrollPos wvsprintfA SetFocus GetFocus SetWindowTextA ClientToScreen GetWindow GetDlgCtrlID GetWindowRect PtInRect GetClassNameA RemoveMenu GetMenuItemCount GetSubMenu GetMenuState GetMenuStringA AppendMenuA GetMenuItemID InsertMenuA LoadStringA UnregisterClassA UnhookWindowsHookEx GetActiveWindow GetKeyState CallNextHookEx ValidateRect GetCursorPos SetWindowsHookExA GetSystemMetrics CharUpperA wsprintfA GetWindowTextLengthA OemToCharA CharToOemA PeekMessageA MsgWaitForMultipleObjects GetMessageA TranslateMessage DispatchMessageA CreateWindowExA GetClientRect SendMessageA AttachThreadInput ShowWindow SetWindowPos SetForegroundWindow FindWindowA GetWindowTextW GetWindowTextA GetDesktopWindow EnumChildWindows EnumWindows GetParent

gdi32

GetClipBox ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetTextColor SetStretchBltMode SetROP2 SetPolyFillMode SelectClipRgn SetBkColor SelectPalette SelectObject RestoreDC SaveDC StartDocA DeleteDC DeleteObject CreateDCA CopyMetaFileA GetStockObject GetObjectW GetDeviceCaps CreateFontIndirectW SetBkMode BitBlt IntersectClipRect OffsetClipRgn MoveToEx LineTo SetTextAlign SetTextJustification SetTextCharacterExtra SetMapperFlags GetCurrentPositionEx ArcTo SetArcDirection PolyDraw PolylineTo SetColorAdjustment PolyBezierTo GetClipRgn CreateRectRgn SelectClipPath ExtSelectClipRgn PlayMetaFileRecord GetObjectType EnumMetaFile PlayMetaFile GetViewportExtEx GetWindowExtEx CreatePen ExtCreatePen CreateSolidBrush CreateHatchBrush CreatePatternBrush CreateDIBPatternBrushPt PtVisible RectVisible TextOutA ExtTextOutA Escape CreateBitmap GetDCOrgEx GetObjectA GetBitmapBits ExcludeClipRect CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

LockServiceDatabase RegOpenKeyW RegSetValueExW RegOpenKeyA RegQueryValueExA RegCloseKey RegQueryValueExW RegCreateKeyExW RegCreateKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken LookupAccountSidW GetTokenInformation GetUserNameW RegSetValueExA SetFileSecurityA FreeSid EqualSid AllocateAndInitializeSid GetFileSecurityA SetFileSecurityW GetFileSecurityW LookupAccountNameW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorDacl AddAccessAllowedAce AddAce GetAce InitializeAcl GetLengthSid GetAclInformation QueryServiceConfig2A ChangeServiceConfigA QueryServiceConfigA ChangeServiceConfig2A CreateServiceA CloseServiceHandle DeleteService ControlService OpenServiceA OpenSCManagerA StartServiceA RegDeleteValueA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegQueryInfoKeyA RegCreateKeyExA RegSetValueA RegConnectRegistryA RegEnumKeyA RegCreateKeyW RegOpenKeyExW UnlockServiceDatabase QueryServiceStatus EnumServicesStatusA RegSetKeySecurity GetUserNameA DeregisterEventSource ReportEventA RegisterEventSourceA

shell32

SHGetFileInfoA SHGetPathFromIDListW SHGetSpecialFolderPathA DragAcceptFiles

comctl32

ord17

ole32

SetConvertStg CreateBindCtx CoTaskMemAlloc OleDuplicateData WriteFmtUserTypeStg CoInitialize CoCreateInstance CoUninitialize WriteClassStg CoInitializeEx OleRegGetUserType ReadFmtUserTypeStg ReadClassStg StringFromCLSID CoTreatAsClass ReleaseStgMedium CoDisconnectObject CoTaskMemFree

oleaut32

SafeArrayGetLBound CreateErrorInfo SafeArrayGetElemsize SafeArrayGetDim SafeArrayCreate VariantClear SafeArrayRedim VariantCopy SysAllocString SysAllocStringByteLen VariantChangeType SysStringByteLen VarCyFromStr VarBstrFromCy VarDateFromStr SafeArrayGetUBound SafeArrayCopy SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayGetElement SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayLock SafeArrayUnlock SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor SysStringLen SysAllocStringLen SysReAllocStringLen SafeArrayAccessData SafeArrayUnaccessData VarBstrFromDate SetErrorInfo GetErrorInfo VariantInit SysFreeString SystemTimeToVariantTime

mpr

WNetGetConnectionA WNetGetConnectionW

rpcrt4

UuidCreate RpcStringFreeA UuidToStringW RpcStringFreeW UuidFromStringW UuidToStringA

$WINDIR/bakwdgv364.sys

IMPHASH 987b90646e048e77dc47c1b719a85106
SHA256 799d176813c3d0f5a01fd482576aeab6a63e5024f3392e7974f5e437c3d7e3a0
MD5 889482a07ba13fc6e194a63d275a850a
SHA1 16a164fded3352abb63722a5c74750cdc438f99a
SHA512 e5cb9cf49120ed20b07faceefccef24da4335f28f49d9ae7bfafccbc9a239c4039e9ce5f5d13b49d0be475b3913311d08b7d70a1a2df0c974d4c5a5f7bec507a
SSDEEP 24576:YunZ2BYJf0ZF1H+V7o+9Ql7Dm2E6WJ6pFgGJifEozVlFQQr11tO+F2lE4i1d8g1O:FmAf0BH+Vs+9CG2E6WJ6pOGJYFzV7QQO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Digest

06:fd:9d:e7:f4:a9:fd:0a:12:23:4b:79:c2:38:b9:5d:fe:71:d8:31:78:84:a8:a8:d2:e0:19:3e:10:a0:f6:1a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

e8:f5:10:4e:62:44:77:da:a4:b7:c4:0c:bf:1c:fe:63:d2:06:c0:66

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

2

Major OS version

5

Entry point

293076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\WorkshopAgent\DevelopProj\Code\PreRelease\V4\PreRelease\Bin\Release\WinWdgv364.pdb

setupapi

SetupInstallFileA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

kernel32

MoveFileA FreeLibrary GetUserDefaultLangID GetVersion GetSystemDefaultLangID WideCharToMultiByte GetProfileStringA SetFilePointer OutputDebugStringW FreeConsole WriteConsoleA GetStdHandle AllocConsole LoadLibraryExA LoadLibraryExW OpenMutexA CompareFileTime GetSystemTime GetWindowsDirectoryA CreateEventA CreateMutexA SetEvent LocalAlloc CreateProcessA lstrcmpiA TerminateProcess WaitForMultipleObjects MultiByteToWideChar MulDiv GetExitCodeProcess GetProcessTimes FileTimeToSystemTime CopyFileW GetDiskFreeSpaceExW GetFileTime SetFileTime VirtualQuery CreateProcessW GetProcessHeap HeapAlloc HeapFree WriteFile CreateFileW GetFileSize GetComputerNameA GetComputerNameW FlushFileBuffers CreateDirectoryA GetFileAttributesExA GetFileAttributesExW GetVolumeInformationW OutputDebugStringA QueryDosDeviceW GetDriveTypeA DefineDosDeviceA GetDiskFreeSpaceExA SetVolumeLabelA GetVolumeInformationA GetLogicalDrives GetDriveTypeW VirtualProtectEx WriteProcessMemory ReadProcessMemory VirtualProtect CreateFileMappingA MapViewOfFile UnmapViewOfFile SizeofResource QueryDosDeviceA DeviceIoControl ReadFile SetFileAttributesW lstrcmpW RemoveDirectoryW DeleteFileW MoveFileExW SetFileAttributesA lstrcmpA RemoveDirectoryA DeleteFileA MoveFileExA GetSystemInfo FindFirstFileW FindNextFileW FindFirstFileA FindNextFileA FindClose LoadLibraryA LocalFree OpenProcess GetCurrentProcess CreateThread GetSystemDirectoryA GetModuleHandleW GetFileInformationByHandle GetModuleHandleA GetProcAddress GetCurrentThreadId GetTickCount GetFileAttributesW IsBadReadPtr CreateDirectoryW GetLocalTime GetCurrentProcessId CreateFileA CloseHandle CopyFileA GetFileAttributesA ExpandEnvironmentStringsA Sleep GetLastError GetModuleFileNameA GetCurrentDirectoryW GetModuleFileNameW GetCurrentDirectoryA GetThreadPriority OpenFileMappingA SetEndOfFile GetPriorityClass LockResource BeginUpdateResourceA UpdateResourceA EndUpdateResourceA EnumResourceLanguagesA EnumResourceNamesA EnumResourceTypesA SetPriorityClass VirtualQueryEx SetEnvironmentVariableA CompareStringW LoadResource FindResourceExA lstrlenA lstrlenW GetVersionExA FormatMessageA GetACP FormatMessageW WaitForSingleObject InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SleepEx CreateSemaphoreA ReleaseSemaphore ReleaseMutex PulseEvent ResetEvent SuspendThread TerminateThread ResumeThread SetThreadPriority GetExitCodeThread FileTimeToLocalFileTime SetLastError GetSystemDirectoryW MoveFileW GetTempPathA GetTempPathW GetEnvironmentVariableA GetEnvironmentVariableW ExpandEnvironmentStringsW RtlLookupFunctionEntry RtlUnwindEx EncodePointer DecodePointer GetSystemTimeAsFileTime FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader GetDateFormatA GetTimeFormatA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCPInfo GetOEMCP IsValidCodePage FlsGetValue FlsFree GetCurrentThread FlsAlloc LCMapStringW HeapSize ExitProcess GetLocaleInfoW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetStringTypeW GetTimeZoneInformation GetConsoleCP GetConsoleMode FatalAppExitA HeapReAlloc SetConsoleCtrlHandler LoadLibraryW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleW FreeResource

user32

GetThreadDesktop OpenDesktopA SetThreadDesktop CloseDesktop AttachThreadInput MsgWaitForMultipleObjects PeekMessageA GetMessageA TranslateMessage DispatchMessageA GetDesktopWindow EnumChildWindows EnumWindows GetWindowLongA EnumDesktopWindows GetClassNameW FindWindowExA IsWindowVisible CreateWindowExA GetClientRect SendMessageA wsprintfA GetSystemMetrics GetUserObjectInformationW GetForegroundWindow OpenInputDesktop ShowWindow GetWindowLongPtrA SetWindowPos SetForegroundWindow FindWindowA GetWindowThreadProcessId GetWindowTextW GetWindowTextA GetParent SendMessageTimeoutA MessageBoxW MessageBoxA OpenWindowStationA SetProcessWindowStation CloseWindowStation GetProcessWindowStation GetUserObjectInformationA

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt GetBitmapBits DeleteObject DeleteDC CreateFontIndirectW GetDeviceCaps GetObjectW GetStockObject CreateDCW

advapi32

AddAce StartServiceA OpenSCManagerA OpenServiceA RegisterEventSourceW ControlService DeleteService CloseServiceHandle CreateServiceA ChangeServiceConfig2A QueryServiceConfigA ChangeServiceConfigA QueryServiceConfig2A RegCreateKeyExA InitializeSecurityDescriptor GetAclInformation GetLengthSid InitializeAcl GetAce AddAccessAllowedAce SetSecurityDescriptorDacl GetSecurityDescriptorDacl LookupAccountNameW GetUserNameW GetFileSecurityW SetFileSecurityW GetFileSecurityA AllocateAndInitializeSid EqualSid FreeSid SetFileSecurityA RegSetValueExA GetTokenInformation LookupAccountSidW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegSetValueExW RegOpenKeyA RegQueryValueExA RegCloseKey DeregisterEventSource GetUserNameA RegSetKeySecurity EnumServicesStatusA QueryServiceStatus UnlockServiceDatabase LockServiceDatabase RegCreateKeyW RegEnumValueA RegDeleteValueA RegQueryInfoKeyA RegEnumKeyA RegDeleteKeyA RegConnectRegistryA RegOpenKeyExA ReportEventW

shell32

SHGetPathFromIDListW

ole32

CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

SystemTimeToVariantTime DosDateTimeToVariantTime

mpr

WNetGetConnectionW

$WINDIR/win.ini

SHA256 75087cdfb4a2e480c033ced528b9294e2603a4d1bbe344d671c896e58c214174
MD5 3b32e1b962c1036c83ea9bff91c319fc
SHA1 32596891bbb0d0419a9825f23c53259bf492332f
SHA512 41ca226a793413cf0213037a8a2beb599593fcf16dbe6cbb1e4dac9a64bc4acbe8ae780aede4dbd1b3d5759c8fff4e7a0ac12b706b6188221983ba81f41c485d
MD5 SHA1 SHA512

systecv3.exe

IMPHASH 0dfd18b47f2ad9bb705fc829b2b32c50
SHA256 cb72b724c5f57e83cc5bc215dd522c566e0ea695b9e3d167eed9be3f18d273ce
MD5 b9e0a7cbd7fdb4d179172dbdd453495a
SHA1 7f1b18a2bee7defa6db4900982fd3311aabed50d
SHA512 720985495b67e87f6ecf62268d7dc8fecdb7c06cf9606ce1a12ce4ea741dd3d46a759420e02ec54bc6e96e49d37a2e19ac307093b1228c01914c8e632a8d373c
SSDEEP 24576:mrmoCH/siu9xQBvJ4TyKyCdgjBXj0jHy3WBZ3cRDusH192mdoEtPg+61zpw94I25:mhxaM+7g+Kzq4I28/1eKle7mLXyn0Lw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

38:07:e2:8a:d5:c9:8d:4b:7e:4c:ea:f7:ba:96:9f:54:e3:95:b3:af:b1:f5:b6:9f:4c:93:2a:e7:91:a5:4d:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

10:a0:07:5d:9c:3b:02:a6:a7:50:0c:61:e1:6c:b6:eb:9a:c4:fb:9b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

256195

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetErrorMode lstrcatA TlsAlloc GlobalHandle TlsFree GlobalReAlloc TlsSetValue LocalReAlloc TlsGetValue GetProcessVersion GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA LockResource LoadResource FindResourceA SetEvent ResumeThread SetThreadPriority SuspendThread GetCurrentThread GetCPInfo GetOEMCP GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA RtlUnwind GetTimeZoneInformation GetSystemTime GetStartupInfoA GetCommandLineA ExitProcess RaiseException GetACP HeapReAlloc HeapSize ExitThread FatalAppExitA LCMapStringA LCMapStringW GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetFileType GlobalFlags GetStringTypeW SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetConsoleCtrlHandler SetStdHandle GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA SizeofResource BackupWrite BackupRead BackupSeek QueryPerformanceCounter VirtualQueryEx InterlockedExchangeAdd InterlockedExchange InterlockedCompareExchange ReadProcessMemory GetThreadPriority GetExitCodeThread TerminateThread ResetEvent MoveFileW GetEnvironmentVariableW GetTempPathW GetSystemDirectoryW CreateFileMappingA MapViewOfFile UnmapViewOfFile SetVolumeLabelA GetDiskFreeSpaceA FormatMessageW FindResourceExA EnumResourceTypesA EnumResourceLanguagesA EndUpdateResourceA UpdateResourceA BeginUpdateResourceA VirtualProtect DefineDosDeviceA GlobalFree GlobalSize GlobalAlloc SetLastError WaitForMultipleObjects CreateEventA ReleaseMutex CreateMutexA ReleaseSemaphore CreateSemaphoreA SystemTimeToFileTime LocalFileTimeToFileTime GetShortPathNameA lstrcmpiA GetThreadLocale GetStringTypeExA GetFullPathNameA lstrcpynA lstrcpyA SetEndOfFile UnlockFile LockFile DuplicateHandle FileTimeToLocalFileTime lstrlenW GlobalLock GlobalUnlock FormatMessageA lstrlenA InterlockedDecrement InterlockedIncrement LoadLibraryW GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA OpenMutexA GetVersionExA AllocConsole GetStdHandle WriteConsoleA FreeConsole OutputDebugStringW SetFilePointer GetProfileStringA WideCharToMultiByte WaitForSingleObject LocalAlloc GetTempPathA GetWindowsDirectoryA SetCurrentDirectoryA CreateProcessA LeaveCriticalSection EnterCriticalSection TerminateProcess SetPriorityClass GetPriorityClass GetDriveTypeA ExpandEnvironmentStringsW GetLogicalDrives ExpandEnvironmentStringsA DeleteCriticalSection EnumResourceNamesA InitializeCriticalSection GetVersion GetUserDefaultLangID GetSystemDefaultLangID MultiByteToWideChar MulDiv GetExitCodeProcess GetProcessTimes FileTimeToSystemTime GetWindowsDirectoryW OutputDebugStringA SetThreadLocale OpenFileMappingA SleepEx PulseEvent CopyFileW GetDiskFreeSpaceExW GetFileTime SetFileTime VirtualQuery CreateProcessW GetProcessHeap HeapAlloc HeapFree WriteFile GetComputerNameA GetComputerNameW FlushFileBuffers CreateDirectoryA GetFileAttributesExA GetFileAttributesExW GetVolumeInformationW QueryDosDeviceA DeviceIoControl Sleep MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileExW DeleteFileW SetFileAttributesA lstrcmpA RemoveDirectoryA DeleteFileA GetSystemInfo FindFirstFileA FindNextFileA LoadLibraryA LocalFree OpenProcess GetCurrentProcess CreateThread GetSystemDirectoryA GetModuleHandleW GetFileInformationByHandle GetCurrentThreadId GetModuleHandleA GetFileSize ReadFile GetLastError LoadLibraryExW LoadLibraryExA GetProcAddress FreeLibrary CreateFileW GetDriveTypeW QueryDosDeviceW GetTickCount GetFileAttributesW CreateDirectoryW GetLocalTime GetCurrentProcessId FindFirstFileW lstrcmpW FindNextFileW FindClose CreateFileA CloseHandle CopyFileA MoveFileExA GetFileAttributesA GetCurrentDirectoryW GetModuleFileNameW GetCurrentDirectoryA GetStringTypeA GetModuleFileNameA

user32

IsIconic GetWindowPlacement MoveWindow SetWindowLongA ScrollWindowEx IsDlgButtonChecked SetDlgItemTextA SetDlgItemInt SendDlgItemMessageA GetDlgItemTextA GetDlgItemInt CheckRadioButton CheckDlgButton GetSysColor GetSysColorBrush LoadCursorA GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ScreenToClient UnhookWindowsHookEx GetLastActivePopup IsWindowEnabled EnableWindow GetScrollPos SetScrollPos wvsprintfA SetFocus GetFocus SetWindowTextA ClientToScreen GetWindow SystemParametersInfoA GetWindowRect PtInRect RemoveMenu GetMenuItemCount GetSubMenu GetMenuState GetMenuStringA AppendMenuA GetMenuItemID InsertMenuA LoadStringA MsgWaitForMultipleObjects IntersectRect OffsetRect RegisterWindowMessageA GetMessagePos GetMessageTime DefWindowProcA GetSystemMetrics CharUpperA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CallNextHookEx wsprintfA GetWindowTextLengthA OemToCharA CharToOemA SetActiveWindow GetClassNameA GetDlgItem OpenDesktopW GetMessageA DispatchMessageA TranslateMessage CreateWindowExA SetWindowsHookExA DestroyWindow GetKeyState SetWindowPlacement TrackPopupMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture IsChild GetTopWindow SetScrollRange GetScrollRange ShowScrollBar SetScrollInfo GetScrollInfo ScrollWindow EndDeferWindowPos CopyRect BeginDeferWindowPos DeferWindowPos EqualRect AdjustWindowRectEx IsWindow PeekMessageA MapWindowPoints UpdateWindow PostMessageA LoadIconA GetCursorPos ValidateRect GetActiveWindow GetNextDlgTabItem EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA LoadBitmapA GetClientRect GetUserObjectInformationW CharToOemBuffA OemToCharBuffA SendMessageA AttachThreadInput ShowWindow SetWindowPos SetForegroundWindow FindWindowA GetWindowTextW GetMenuCheckMarkDimensions PostQuitMessage DestroyMenu ShowOwnedPopups SetCursor DeleteMenu GetDlgCtrlID GetWindowTextA GetDesktopWindow EnumChildWindows EnumWindows GetParent GetWindowLongA IsWindowVisible EnumDesktopWindows SendMessageTimeoutA MessageBoxW MessageBoxA OpenWindowStationA SetProcessWindowStation CloseWindowStation GetForegroundWindow GetClassNameW GetWindowThreadProcessId FindWindowExA GetProcessWindowStation GetUserObjectInformationA OpenInputDesktop OpenDesktopA GetThreadDesktop SetThreadDesktop CloseDesktop IsDialogMessageA

gdi32

GetDCOrgEx TextOutA CreateBitmap RectVisible PtVisible CreateDIBPatternBrushPt CreatePatternBrush CreateHatchBrush CreateSolidBrush ExtCreatePen CreatePen GetWindowExtEx GetViewportExtEx PlayMetaFile EnumMetaFile GetObjectType PlayMetaFileRecord ExtSelectClipRgn SelectClipPath CreateRectRgn GetClipRgn PolyBezierTo SetColorAdjustment PolylineTo PolyDraw SetArcDirection ArcTo GetCurrentPositionEx Escape SetTextCharacterExtra SetTextJustification SetTextAlign LineTo MoveToEx OffsetClipRgn IntersectClipRect ExcludeClipRect SelectClipRgn GetClipBox ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx CreateFontIndirectW GetDeviceCaps GetObjectW GetStockObject CopyMetaFileA CreateDCA DeleteObject DeleteDC StartDocA SaveDC RestoreDC SelectObject SelectPalette SetBkColor SetMapperFlags ExtTextOutA SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetTextColor SetMapMode SetViewportOrgEx GetObjectA SetViewportExtEx CreateCompatibleDC CreateCompatibleBitmap BitBlt GetBitmapBits OffsetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegConnectRegistryA RegCreateKeyW RegSetKeySecurity GetUserNameA DeregisterEventSource ReportEventA RegisterEventSourceA EnumServicesStatusA RegSetValueA QueryServiceStatus LockServiceDatabase UnlockServiceDatabase RegCreateKeyExA ControlService DeleteService CreateServiceA ChangeServiceConfig2A StartServiceA QueryServiceConfig2A OpenSCManagerA OpenServiceA QueryServiceConfigA ChangeServiceConfigA CloseServiceHandle RegQueryInfoKeyA RegEnumValueA RegDeleteKeyA RegDeleteValueA GetAclInformation GetLengthSid InitializeAcl GetAce AddAce AddAccessAllowedAce GetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupAccountNameW GetFileSecurityW SetFileSecurityW GetFileSecurityA AllocateAndInitializeSid EqualSid FreeSid SetFileSecurityA RegSetValueExA RegOpenKeyA GetUserNameW GetTokenInformation LookupAccountSidW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegSetValueExW RegCloseKey RegOpenKeyExA RegQueryValueExA RegEnumKeyA

shell32

SHGetSpecialFolderPathW DragAcceptFiles SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetPathFromIDListW SHGetSpecialFolderPathA

comctl32

ord17

ole32

ReadClassStg OleRegGetUserType WriteClassStg WriteFmtUserTypeStg SetConvertStg CreateBindCtx CoTaskMemAlloc OleDuplicateData CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize StringFromCLSID CoTreatAsClass ReleaseStgMedium CoDisconnectObject ReadFmtUserTypeStg CoInitializeEx

oleaut32

SysFreeString SetErrorInfo SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound CreateErrorInfo SystemTimeToVariantTime GetErrorInfo SafeArrayCopy SysReAllocStringLen SysAllocStringLen SysStringLen SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayDestroy SafeArrayUnlock SafeArrayLock SafeArrayPutElement SafeArrayPtrOfIndex SafeArrayGetElement SafeArrayAllocDescriptor SafeArrayAllocData VariantInit VarBstrFromDate VarDateFromStr VarBstrFromCy VarCyFromStr SysStringByteLen VariantChangeType SysAllocStringByteLen SysAllocString VariantCopy SafeArrayRedim VariantClear SafeArrayCreate SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetLBound

mpr

WNetGetConnectionW WNetGetConnectionA

setupapi

SetupInstallFileA

ws2_32

ntohl inet_addr inet_ntoa WSAStartup gethostbyname htonl

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

rpcrt4

UuidToStringW UuidCreate UuidFromStringW RpcStringFreeW UuidToStringA RpcStringFreeA

winrdgv3.exe

IMPHASH f71f315bc7c309824aca4e997caab766
SHA256 a3d817490804a951bac1c7b1ea6f48aed75baec7e3b4e31be4fbd1fe82860bb1
MD5 97ac3ef2e098c4cb7dd6ec1d14dc28f1
SHA1 3e78e87eefe45f8403e46d94713b6667aee6d9c9
SHA512 693e90da2581306a1f9bb117142429301c7dc28a8caf623c4dfc21f735c53c4502e2b58a5ebdbd8c568dfd3393d1687428f1934f4c28b4fc715eb8f856ac02cd
SSDEEP 24576:I1iQzjPLwVa0gzIkUeSr18gU9W36RO5TsHKGaXDx0hl:Iz5zISSrqW36I7FXDx0hl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

d7:66:68:59:80:47:68:65:e0:3e:89:ea:42:fc:84:11:01:19:4b:f4:55:e4:f2:0d:64:18:c2:b3:38:a6:3b:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

c5:48:a9:b7:10:ac:42:fc:19:b3:16:05:2d:d0:bf:ab:f9:4f:f2:75

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Chains

Nov 10, 2022

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Guangzhou TEC Solutions Co.\, Ltd.,O=Guangzhou TEC Solutions Co.\, Ltd.,L=Guangzhou,ST=Guangdong Province,C=CN

Serial Number

0b:98:41:aa:e8:06:68:9a:fc:0b:07:20:3c:f3:1e:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2022 - Oct 22, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

133766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalAddAtomA GlobalGetAtomNameA LockResource LoadResource FindResourceA ResumeThread SetThreadPriority SuspendThread GetCurrentThread GetCPInfo GetOEMCP GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA RtlUnwind GetTimeZoneInformation GetSystemTime ExitProcess TerminateProcess GetStartupInfoA GetCommandLineA RaiseException GetACP HeapReAlloc HeapSize ExitThread FatalAppExitA LCMapStringA LCMapStringW UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree GetStringTypeA GetStringTypeW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetStdHandle GlobalFindAtomA CompareStringA CompareStringW SetEnvironmentVariableA SleepEx SetThreadLocale LoadLibraryExW GetWindowsDirectoryW OpenMutexA OpenFileMappingA GlobalDeleteAtom GetProcessVersion TlsGetValue LocalReAlloc TlsSetValue GlobalReAlloc TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcatA SetErrorMode GlobalFlags GlobalSize OutputDebugStringA DefineDosDeviceA GetDiskFreeSpaceExA SetVolumeLabelA QueryDosDeviceW GetLogicalDrives GetDriveTypeW GetDriveTypeA GetExitCodeThread BeginUpdateResourceA UpdateResourceA EndUpdateResourceA EnumResourceLanguagesA EnumResourceTypesA EnumResourceNamesA SizeofResource LoadLibraryExA CreateFileMappingA MapViewOfFile UnmapViewOfFile VirtualProtectEx WriteProcessMemory VirtualProtect QueryPerformanceCounter VirtualQueryEx InterlockedExchangeAdd InterlockedExchange InterlockedCompareExchange ReadProcessMemory GetThreadPriority GetPriorityClass SetPriorityClass TerminateThread LoadLibraryW MoveFileW GetEnvironmentVariableW GetTempPathW GetTempPathA GetSystemDirectoryW ExpandEnvironmentStringsW ExpandEnvironmentStringsA FormatMessageW FindResourceExA SetLastError WaitForMultipleObjects ReleaseMutex ReleaseSemaphore CreateSemaphoreA SystemTimeToFileTime LocalFileTimeToFileTime GetShortPathNameA lstrcmpiA GetThreadLocale GetStringTypeExA GetFullPathNameA lstrcpynA GetVolumeInformationA lstrcpyA SetEndOfFile UnlockFile LockFile DuplicateHandle FileTimeToLocalFileTime lstrlenW GlobalLock GlobalUnlock lstrlenA InterlockedDecrement InterlockedIncrement LeaveCriticalSection EnterCriticalSection AllocConsole GetStdHandle WriteConsoleA FreeConsole OutputDebugStringW SetFilePointer DeleteCriticalSection InitializeCriticalSection GetProfileStringA WideCharToMultiByte CreateProcessA GetWindowsDirectoryA GlobalAlloc GlobalFree FormatMessageA ResetEvent SetEvent WaitForSingleObject SetConsoleCtrlHandler CreateMutexA GetVersionExA CreateEventA PulseEvent GetVersion GetUserDefaultLangID GetSystemDefaultLangID FreeLibrary MultiByteToWideChar MulDiv GetExitCodeProcess GetProcessTimes FileTimeToSystemTime CopyFileW GetDiskFreeSpaceExW GetFileTime SetFileTime VirtualQuery CreateProcessW GetProcessHeap HeapAlloc HeapFree WriteFile CreateFileW GetFileSize GetComputerNameA GetComputerNameW FlushFileBuffers GetFileAttributesW CreateDirectoryW CreateDirectoryA GetFileAttributesExA GetFileAttributesExW GetVolumeInformationW QueryDosDeviceA DeviceIoControl ReadFile Sleep MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileExW DeleteFileW SetFileAttributesA lstrcmpA RemoveDirectoryA MoveFileExA DeleteFileA GetSystemInfo FindFirstFileA FindNextFileA LoadLibraryA LocalFree OpenProcess GetLastError GetCurrentProcess CreateThread GetSystemDirectoryA GetModuleHandleW GetFileInformationByHandle GetCurrentThreadId GetModuleHandleA GetProcAddress GetTickCount GetLocalTime GetCurrentProcessId FindFirstFileW lstrcmpW FindNextFileW FindClose CreateFileA CloseHandle CopyFileA GetFileAttributesA GetCurrentDirectoryW GetModuleFileNameW GetCurrentDirectoryA GetLocaleInfoW GetModuleFileNameA

user32

GetKeyState SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos RegisterWindowMessageA OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement MoveWindow SetWindowLongA IsDialogMessageA ScrollWindowEx IsDlgButtonChecked SetDlgItemTextA SetDlgItemInt TrackPopupMenu GetDlgItemTextA GetDlgItemInt GetDlgItem CheckRadioButton CheckDlgButton GetSysColor GetSysColorBrush LoadCursorA GrayStringA DrawTextA TabbedTextOutA OpenInputDesktop BeginPaint GetWindowDC ReleaseDC GetDC ScreenToClient UnhookWindowsHookEx GetLastActivePopup IsWindowEnabled EnableWindow GetScrollPos SetScrollPos wvsprintfA GetMenu GetClassInfoA WinHelpA SendDlgItemMessageA GetUserObjectInformationA SetFocus GetFocus GetProcessWindowStation FindWindowExA GetWindowThreadProcessId GetClassNameW GetForegroundWindow CloseWindowStation SetProcessWindowStation OpenWindowStationA MessageBoxA MessageBoxW SendMessageTimeoutA EnumDesktopWindows IsWindowVisible GetWindowLongA SetWindowPlacement GetUserObjectInformationW GetParent EnumWindows OpenDesktopA GetThreadDesktop SetThreadDesktop CloseDesktop GetCapture IsChild GetTopWindow SetScrollRange GetScrollRange ShowScrollBar SetScrollInfo GetScrollInfo ScrollWindow EndDeferWindowPos CopyRect BeginDeferWindowPos DeferWindowPos EqualRect AdjustWindowRectEx IsWindow SetActiveWindow MapWindowPoints UpdateWindow PostMessageA LoadIconA GetCursorPos ValidateRect GetActiveWindow GetMessageA GetNextDlgTabItem EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA LoadBitmapA GetMenuCheckMarkDimensions EnumChildWindows GetDesktopWindow GetWindowTextA GetWindowTextW PostQuitMessage DestroyMenu ShowOwnedPopups SetCursor DeleteMenu EndPaint SetWindowTextA ClientToScreen GetWindow GetDlgCtrlID GetWindowRect PtInRect GetClassNameA RemoveMenu GetMenuItemCount GetSubMenu GetMenuState GetMenuStringA AppendMenuA GetMenuItemID InsertMenuA LoadStringA MsgWaitForMultipleObjects GetSystemMetrics CharUpperA wsprintfA GetWindowTextLengthA OemToCharA CharToOemA PeekMessageA TranslateMessage DispatchMessageA RegisterClassA DefWindowProcA DestroyWindow CreateWindowExA GetClientRect SendMessageA AttachThreadInput ShowWindow SetWindowPos SetForegroundWindow FindWindowA

gdi32

ExtTextOutA Escape GetDCOrgEx GetObjectA PtVisible CreateDIBPatternBrushPt CreatePatternBrush CreateHatchBrush CreateSolidBrush ExtCreatePen CreatePen GetWindowExtEx GetViewportExtEx PlayMetaFile EnumMetaFile GetObjectType PlayMetaFileRecord ExtSelectClipRgn SelectClipPath CreateRectRgn GetClipRgn PolyBezierTo SetColorAdjustment PolylineTo PolyDraw SetArcDirection ArcTo TextOutA SetMapperFlags SetTextCharacterExtra SetTextJustification SetTextAlign LineTo MoveToEx CreateFontIndirectW GetDeviceCaps GetObjectW GetStockObject CopyMetaFileA CreateDCA DeleteObject DeleteDC StartDocA SaveDC RestoreDC SelectObject SelectPalette SetBkColor SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx GetCurrentPositionEx RectVisible GetBitmapBits BitBlt CreateCompatibleBitmap CreateCompatibleDC ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox SelectClipRgn ExcludeClipRect CreateBitmap OffsetClipRgn IntersectClipRect

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegisterEventSourceA DeregisterEventSource GetUserNameA RegSetKeySecurity RegCreateKeyW RegEnumValueA RegQueryInfoKeyA RegEnumKeyA RegConnectRegistryA RegCreateKeyExA RegSetValueA RegDeleteKeyA RegOpenKeyExA SetServiceStatus RegisterServiceCtrlHandlerA StartServiceA RegDeleteValueA OpenServiceA ControlService QueryServiceStatus DeleteService OpenSCManagerA CreateServiceA CloseServiceHandle StartServiceCtrlDispatcherA IsValidSid CopySid GetAclInformation GetLengthSid InitializeAcl GetAce AddAce AddAccessAllowedAce GetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupAccountNameW GetFileSecurityW SetFileSecurityW GetFileSecurityA AllocateAndInitializeSid EqualSid FreeSid SetFileSecurityA RegSetValueExA RegOpenKeyA GetUserNameW GetTokenInformation LookupAccountSidW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegQueryValueExA RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegSetValueExW RegCloseKey ReportEventA

shell32

SHGetFileInfoA SHGetPathFromIDListW SHGetSpecialFolderPathA DragAcceptFiles

comctl32

ord17

ole32

OleRegGetUserType WriteClassStg WriteFmtUserTypeStg SetConvertStg ReadFmtUserTypeStg CoTaskMemAlloc OleDuplicateData CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize CoInitializeEx ReadClassStg StringFromCLSID ReleaseStgMedium CoDisconnectObject CreateBindCtx CoTreatAsClass

oleaut32

SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElemsize SafeArrayAccessData SafeArrayUnaccessData SafeArrayAllocData SysReAllocStringLen SysAllocStringLen SysStringLen SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayDestroy SafeArrayUnlock SafeArrayLock SafeArrayPutElement SafeArrayPtrOfIndex SafeArrayGetElement SafeArrayAllocDescriptor SystemTimeToVariantTime SafeArrayCopy VarBstrFromDate VarDateFromStr VarBstrFromCy VarCyFromStr SysStringByteLen VariantChangeType SysAllocStringByteLen SysAllocString VariantCopy SafeArrayRedim VariantClear SafeArrayCreate SafeArrayGetDim

mpr

WNetGetConnectionW

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

rpcrt4

RpcStringFreeW UuidToStringW RpcStringFreeA UuidToStringA UuidFromStringW UuidCreate

Sharing

General

Malware Config

Signatures

File Explorer