b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73

resource	yara_rule
static1/unpack001/CrashReport.exe	detect_ak_stuff

resource
b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73
unpack001/$PLUGINSDIR/LogEx.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/$PLUGINSDIR/LogEx.dll
unpack002/$PLUGINSDIR/inetc.dll
unpack002/$PLUGINSDIR/nsProcess.dll

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73
MD5 be9a87d9ac301266af08218734ff4224
SHA1 c46026f4015bed9ecf183be84c60c230b291a0db
SHA512 7c8a31d0c92ec948f4788160b4233316746ae32adb0341f80f050c2abce4a23b6987f4123b6da5d5d51afb182bce662d694f434dee711732d9c780a0504035d4
SSDEEP 196608:Qbf0n7QqLlUTuyTfcD4RmT5HdIFbyTu25SmF/5:QbG7Qq+h0YM9Mby/5Sm3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/LogEx.dll

IMPHASH 549d7b44067bbcdf42bf6a90a80a3a9e
SHA256 57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314
MD5 0f96d9eb959ad4e8fd205e6d58cf01b8
SHA1 7c45512cbdb24216afd23a9e8cdce0cfeaa7660f
SHA512 9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c
SSDEEP 384:w4NSXFjXCATBAQR4F1Y5u6I3wa4W7KNP66BjLjyXB0JyuDchv8EnohgSil2X:woaF+ATCQye/I3KWmxj00Jyb8Enov
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6315

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH ac10bd0ffca217141ca47c63b7c99be6
SHA256 2fd047e73350f864d85b2bc128ec19cc30b7d47db656aad08aa7923155ab4f97
MD5 210f551d877a262fa2b32fa23289ffda
SHA1 a527a7b94711146843e1dd78b61b1ba78dce2a26
SHA512 ba9486f02b602e0208cca4f1ca64d3f2f601cbd239ebc8b11e5b80d55dc7eab0d0bfcb20444e505a2e3b4fd3ac5a0c9cb5e1b3753e4aa302c70770453ea798a6
SSDEEP 6144:Olat1rg5hb6fAEHWAxpEFrFQhi4oOkM4lpfO8BgKL8OxwFCLGZXj:o4g5hbg1WAxpEJFXFlF1gqxwFCL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

174652

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\浏览器打包\Plugins\Inetc\Unicode\Plugins\inetc.pdb

wininet

InternetOpenW InternetCrackUrlW InternetConnectW HttpEndRequestW HttpOpenRequestW HttpAddRequestHeadersW InternetErrorDlg InternetCloseHandle HttpAddRequestHeadersA InternetQueryOptionW InternetSetOptionW InternetSetFilePointer InternetGetLastResponseInfoW FtpOpenFileW FtpCreateDirectoryW HttpQueryInfoW HttpSendRequestExW HttpSendRequestW InternetWriteFile InternetReadFile

comctl32

ord17

kernel32

GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetLocaleInfoA GetConsoleMode GetConsoleCP IsProcessorFeaturePresent GetStringTypeW LCMapStringW SetStdHandle WriteConsoleW OutputDebugStringA RtlUnwind GetLocaleInfoW InterlockedExchange SetConsoleCtrlHandler SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess OutputDebugStringW FlushFileBuffers lstrlenW WriteFile ReadFile lstrcmpW lstrcpynW GetLastError GetProcAddress LoadLibraryA LocalFree DeleteFileW CloseHandle SleepEx SetFilePointer GetTickCount lstrcatW GetFileSize CreateFileW lstrcmpiW LocalAlloc lstrcpyW MulDiv GetModuleHandleW MultiByteToWideChar TerminateThread WaitForSingleObject CreateThread CreateFileA lstrlenA WideCharToMultiByte GlobalFree GlobalAlloc HeapQueryInformation HeapSize HeapReAlloc IsValidCodePage GetCPInfo GetOEMCP GetACP FatalAppExitA LeaveCriticalSection EnterCriticalSection FreeLibrary VirtualQuery GetProcessHeap HeapAlloc TerminateProcess HeapFree GetModuleFileNameW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA DeleteCriticalSection GetStartupInfoW GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount ExitProcess IsBadReadPtr HeapValidate GetCurrentThreadId DecodePointer GetCommandLineA IsDebuggerPresent RaiseException LoadLibraryW EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetCurrentThread

user32

wsprintfA FindWindowExW CreateDialogParamW EnableWindow IsWindowVisible GetMessageW IsDialogMessageW TranslateMessage DispatchMessageW RedrawWindow UpdateWindow KillTimer DestroyWindow LoadIconW SetTimer GetWindowRect GetClientRect SystemParametersInfoW SetDlgItemTextW SendMessageW GetWindowTextW PostMessageW GetDlgItem SendDlgItemMessageW SetWindowTextW GetWindowLongW SetWindowLongW ShowWindow GetParent MessageBoxW IsWindow wsprintfW SetWindowPos

Name

.textbss

Size

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

336KB

Virtual Size

336KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/modern-wizard.bmp

SHA256 22712c75f0bd2fb440a5479556f17179ff5f73990ec002ad864f8c2eba977825
MD5 9159924114a572e819c2042816402411
SHA1 55096a3bf88474424e6a04052012f7ff9dc2f5c7
SHA512 93e51877255cbc99490d2973c166394e5def7ec52439ef03845c858effaf25879a81cfa6b91cb4326ace2ee3288dbdd9d745912b25968a86d8e0481bcfe16e1b
SSDEEP 192:ZQMN2I7r2HP3iYWNQhpkke5k9DzJXKP6x6SBrl8Ld:ZQFHPUNQhpkke5kdJBl8B
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH 439074d1c01f7b16781bdf060930814a
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

CrashReport.exe

IMPHASH 6da0f239c0bc210f0880b9fe9471df76
SHA256 3124871115df9aa1b5883810ef517f3c6b628314cc027f7d9242299677adde13
MD5 9983f02133e3a9b7c374f49ebef1bb22
SHA1 e58815eb8b034c1cd3d24efd8fabb96dc9fbb2b9
SHA512 167db0c962d4bea4c98743844a94cba6826b6e79a895903736db33955fe7f4a5fa01fad292681c8298de97f39eed7c9bc4c2e89546f99921711843fbc565fbae
SSDEEP 24576:VHtxJLzqmtRRYzFS5jyedubyjiIf9uNftb7AIAewvYj9tLd1abOVnt59RoKcZ86l:RHBWoRyzqjyedubyWIf9uNfV7AIAewvN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

detect oss ak

oss ak information detected.

oss_ak

PE Signature issue

Digest

c2:2d:89:0d:f4:97:cd:e2:4f:ce:22:55:c4:9b:a8:34:ce:c2:dd:e8:d7:2d:67:d3:3a:b3:2b:96:c7:a2:61:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Chains

Jun 2, 2023

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Serial Number

34:9b:5e:1c:4b:84:90:fc:72:86:2a:aa:7b:9e:dc:b3

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2022 - Jul 10, 2024

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Serial Number

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 26, 2021 - May 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

5

Entry point

182244

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\yxcalendar\win\YXCalendar\bin\CrashReport.pdb

kernel32

ReadConsoleInputA DeleteFileA GetModuleFileNameA FindClose WideCharToMultiByte EncodePointer DecodePointer RaiseException EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId QueryPerformanceCounter CloseHandle DuplicateHandle WaitForSingleObjectEx Sleep GetCurrentProcess GetCurrentThread GetExitCodeThread MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue GetLastError SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FindNextFileA GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualFree VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind ReadFile CreateFileW GetFileType HeapAlloc HeapFree GetModuleHandleExW HeapReAlloc ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx GetTimeZoneInformation ReadConsoleW SetStdHandle SetConsoleCtrlHandler GetProcessHeap FindFirstFileExA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW HeapSize SetEndOfFile LoadLibraryA GlobalMemoryStatus FlushConsoleInputBuffer FindFirstFileA SetConsoleMode

libcurl

curl_easy_reset curl_easy_getinfo curl_easy_perform curl_easy_setopt curl_easy_init curl_easy_strerror curl_slist_free_all curl_slist_append curl_global_cleanup curl_global_init curl_easy_cleanup

user32

GetUserObjectInformationW GetProcessWindowStation MessageBoxA

advapi32

RegisterEventSourceA DeregisterEventSource ReportEventA

Name

.text

Size

818KB

Virtual Size

818KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

262KB

Virtual Size

261KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

InstallSystemTimeSyncService.bat

SHA256 55c6a33051fdcd000084593d093ad02863fe97068609f27e8de16901935baf52
MD5 a7064c6865c7e3c53d34c6eaf693aa03
SHA1 f000692f607e2cf6a88c8f68ea6d9313619d5356
SHA512 837ce7186ce58ab18a25c45af571eba78048473745b309cbe54bac435a56dc77dc9d65f3f07645b8dde501a99c6157cd9caebbda27cfb3085f90e466c7fd9a90
MD5 SHA1 SHA512

SystemClockHook.dll

IMPHASH c2180e518c18b1e66d725a3cec7d4630
SHA256 6c8bcc59b466e3562f067c9818d41a3cfb3c3a16a0087f1c3b01d0dcccf7cbf2
MD5 a7d86ed5997983ec1f994ac6db0f9528
SHA1 698b6a99c3d6fab20213b70be2f865fcf04cbd1d
SHA512 852f69b3c0c28c733e9c05e20ece0837a07ee96b07f042b84a8c6d410e55e8e83d49918c08ed237fa06440cd370bcd460dbcf8a2fe6141a709dc681469452e0b
SSDEEP 3072:c0EoPvvwCwQC2mCGxVBuQa3v90q68JSrfgIwt30yq8LJ3UCMucUYmPhmdV/mYtdY:HEovwCWG3VZFSzgJUGK2rOPJ9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

25:bd:17:c7:e9:ec:6f:94:d7:bd:6a:dd:11:ae:7e:50:a2:9d:f3:1d:ac:be:5f:06:75:53:80:32:73:f2:05:06

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Chains

Jun 2, 2023

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Serial Number

34:9b:5e:1c:4b:84:90:fc:72:86:2a:aa:7b:9e:dc:b3

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2022 - Jul 10, 2024

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Serial Number

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 26, 2021 - May 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

5

Entry point

5360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\code\yxcalendar\win\YXCalendar\bin\SystemClockHook.pdb

advapi32

IsTextUnicode RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegCloseKey

shell32

ShellExecuteW ShellExecuteExW

user32

MonitorFromWindow MessageBeep ChildWindowFromPointEx GetMonitorInfoW MessageBoxIndirectW GetDesktopWindow GetWindowThreadProcessId UnhookWindowsHookEx SetWindowsHookExW FindWindowA SetLayeredWindowAttributes GetWindowLongW DefWindowProcW MonitorFromPoint GetWindow DestroyWindow SetWindowPos keybd_event CreateWindowExW SendMessageW UnregisterClassW CreatePopupMenu RegisterClassExW GetWindowRect OpenClipboard SetTimer FindWindowExA CloseClipboard EmptyClipboard MapWindowPoints GetSysColor SetFocus LoadCursorW SetClipboardData SetWindowLongW CheckMenuItem GetClientRect AppendMenuW KillTimer GetParent SetForegroundWindow InvalidateRect GetCursorPos BeginPaint EndPaint PostMessageW FindWindowExW CallNextHookEx GetClassNameA IsWindow FindWindowW wsprintfW GetDC ReleaseDC TrackPopupMenu

gdi32

SelectObject CreateDIBSection CreateCompatibleDC GdiFlush CreateFontW GetTextMetricsW DeleteDC GetTextExtentPoint32W SetTextColor SetBkMode DeleteObject CreateBitmap SetTextAlign ExtTextOutW GetDeviceCaps BitBlt

comctl32

ord412 ord410 ord413

kernel32

ReadConsoleW ReadFile GetConsoleMode GetConsoleCP SetFilePointerEx SetStdHandle GetFullPathNameW GetCurrentDirectoryW LCMapStringW GetStdHandle GetACP GetStringTypeW FindClose HeapFree GetModuleFileNameA ExitProcess DeleteFileW MoveFileExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection FindFirstFileExA FindNextFileA GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap FlushFileBuffers GetTimeZoneInformation WriteConsoleW HeapSize HeapReAlloc HeapAlloc SetEndOfFile DecodePointer CompareStringW EnterCriticalSection SetLastError GetUserDefaultLangID GetLocaleInfoW IsValidCodePage MulDiv GetDateFormatW ReleaseSemaphore OutputDebugStringA OpenFileMappingW CloseHandle GetCurrentProcessId MapViewOfFile WaitNamedPipeA GetCurrentProcess WriteFile GetModuleFileNameW WaitForSingleObject CreateFileW GetCurrentThreadId GetModuleHandleA CreateFileA GlobalAlloc GetNativeSystemInfo LoadLibraryW CreateThread GetLocalTime GetProcAddress GlobalLock FreeLibrary CreateSemaphoreW WideCharToMultiByte GetSystemTime GlobalUnlock GetVersion LoadLibraryA GetModuleHandleW GetLongPathNameW GetVersionExW MultiByteToWideChar Sleep OpenSemaphoreW GetTickCount LoadLibraryExW WritePrivateProfileStringW GetPrivateProfileStringW GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedFlushSList RtlUnwind RaiseException

Name

.text

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.shared

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SystemClockHookHost.exe

IMPHASH a8c2dd54edcb2dc89fbd25c84eea1175
SHA256 8abc0ec4f912026b300b2a564904577bf4048b435d4b43e26ecf22405d3efd4b
MD5 5d445a73c7cfdd4f03c4ad93e6475c57
SHA1 58cde8ed44a766451ee7c47858a3542d103f4284
SHA512 9917fe7c15746860360f1db148a3cabea4349a0e66a30b4572b64e3cd4c60d39101be262f57586242cdad42d3f966702d9ab45fe2e7f7ee001c03050da8ce24a
SSDEEP 3072:ECTmgqnd0isEuKVVeOeqsH6/oCJWnBYY7BByncxG:HTxq0isyZ2Bcf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

4e:8f:d3:c1:67:b2:cf:88:b7:84:bd:79:3f:71:87:3b:11:7b:3f:3e:8c:e7:08:e0:2f:bc:29:40:56:89:49:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Chains

Jun 2, 2023

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Serial Number

34:9b:5e:1c:4b:84:90:fc:72:86:2a:aa:7b:9e:dc:b3

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2022 - Jul 10, 2024

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Serial Number

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 26, 2021 - May 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

5

Entry point

5021

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\yxcalendar\win\YXCalendar\bin\SystemClockHookHost.pdb

shell32

ShellExecuteW

user32

PostQuitMessage FindWindowA GetWindow GetClassNameA InvalidateRect GetMessageW DefWindowProcW PostMessageW MessageBoxW CreateWindowExW SendMessageW ReplyMessage RegisterWindowMessageA DispatchMessageW SetTimer RegisterClassW TranslateMessage LoadIconW FindWindowW LoadCursorW KillTimer

psapi

EmptyWorkingSet

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSUnRegisterSessionNotification WTSRegisterSessionNotification

kernel32

SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc HeapSize GetProcessHeap GetStringTypeW SetStdHandle FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose DecodePointer WriteConsoleW RaiseException LCMapStringW GetFileType HeapAlloc HeapFree GetACP GetModuleHandleExW ExitProcess GetCurrentProcess OutputDebugStringA GetModuleFileNameW CreateMutexW WaitForSingleObject GetModuleHandleA CreateToolhelp32Snapshot Sleep GetLastError Process32NextW TerminateThread Process32FirstW CloseHandle GetNativeSystemInfo CreateThread GetProcAddress WTSGetActiveConsoleSessionId GetTickCount LoadLibraryW FreeLibrary GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile MultiByteToWideChar WideCharToMultiByte CreateFileW

SystemClockHookHost_x64.exe

IMPHASH 7ae8e8912e8d2a4e6465b4ba25fe1405
SHA256 94ea02eed6c7cf4e349773e00be51d791c35399b341b1174b12815c50dcb5564
MD5 22cb902359ab5b2e14d36c3e47320d44
SHA1 4b62dbc7be7f33c10bf9bdcc4ca0c373dd5b4214
SHA512 e6948e9f993724a508930309ca595f8c4066bcab3f4eef1ccc67da87d536bd2f5ebac13161d413efa47c0e60a3ed4476617010a35fdf4d3fc916fcd210c4adfd
SSDEEP 3072:z9oM7hY27gAzivYQnsQtG7vQZKCUtWVY+9NnnbxwQ:ZFYrOivHnDGy0Y7NaQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

PE Signature issue

Digest

fa:bc:eb:e9:5e:e0:a1:76:ad:af:27:b4:a7:a6:44:0a:c4:6c:07:f6:00:34:5c:d8:8d:9f:d3:60:9a:78:52:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Chains

Jun 2, 2023

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Serial Number

34:9b:5e:1c:4b:84:90:fc:72:86:2a:aa:7b:9e:dc:b3

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2022 - Jul 10, 2024

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Serial Number

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 26, 2021 - May 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

2

Major OS version

5

Entry point

5236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\code\yxcalendar\win\YXCalendar\bin\SystemClockHookHost_x64.pdb

shell32

ShellExecuteW

user32

PostQuitMessage FindWindowA GetWindow GetClassNameA InvalidateRect GetMessageW DefWindowProcW PostMessageW MessageBoxW CreateWindowExW SendMessageW ReplyMessage RegisterWindowMessageA DispatchMessageW SetTimer RegisterClassW TranslateMessage LoadIconW FindWindowW LoadCursorW KillTimer

psapi

EmptyWorkingSet

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSUnRegisterSessionNotification WTSRegisterSessionNotification

kernel32

GetConsoleCP HeapReAlloc HeapSize GetProcessHeap GetStringTypeW SetStdHandle LCMapStringW GetConsoleMode FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType SetFilePointerEx FlushFileBuffers WriteConsoleW RaiseException HeapAlloc HeapFree GetACP GetModuleHandleExW ExitProcess WideCharToMultiByte MultiByteToWideChar GetCurrentProcess OutputDebugStringA GetModuleFileNameW CreateMutexW GetModuleHandleA CreateToolhelp32Snapshot Sleep GetLastError Process32NextW TerminateThread Process32FirstW CloseHandle GetNativeSystemInfo CreateThread GetProcAddress WTSGetActiveConsoleSessionId GetTickCount LoadLibraryW FreeLibrary GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile CreateFileW

Name

.text

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SystemClockHook_x64.dll

IMPHASH 443433d9a18fa753f36e722021b41657
SHA256 51c326343e505706ec3c72ba8c9e1fb114b6b2726dd19ab1e41e2bce8c179d23
MD5 2b74042ee8dbd812f9be1458b5eb83b5
SHA1 c493e439b61cbb4f552291b078fa08e61bae43c9
SHA512 6c9c0fd770c357a440a0f3b0c235ab02184ab3dc060482ed3fb2caf970560c4dd6361096021457cf4981a1d6c75d425754cddb434027a0fb057051fbe00caf61
SSDEEP 6144:94leAGyEHTfGJdgvPVES0/4AFonQBG/82Pdn:jAbEHTuJaX4/4AFyQk/82Pdn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

PE Signature issue

Digest

22:a6:67:6d:62:dc:87:a2:9a:9b:64:a5:a6:9f:7b:cf:40:5e:ea:dc:cd:e3:5e:ef:f2:96:2d:45:8d:4b:5a:f1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Chains

Jun 2, 2023

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Serial Number

34:9b:5e:1c:4b:84:90:fc:72:86:2a:aa:7b:9e:dc:b3

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2022 - Jul 10, 2024

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Serial Number

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 26, 2021 - May 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

2

Major OS version

5

Entry point

5964

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\code\yxcalendar\win\YXCalendar\bin\SystemClockHook_x64.pdb

advapi32

IsTextUnicode RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegCloseKey

shell32

ShellExecuteW ShellExecuteExW

user32

MonitorFromWindow MessageBeep ChildWindowFromPointEx GetMonitorInfoW MessageBoxIndirectW GetDesktopWindow GetWindowThreadProcessId UnhookWindowsHookEx SetWindowsHookExW FindWindowA SetLayeredWindowAttributes DefWindowProcW MonitorFromPoint GetWindow DestroyWindow SetWindowPos keybd_event SetWindowLongPtrW CreateWindowExW SendMessageW UnregisterClassW CreatePopupMenu GetWindowLongPtrW GetWindowRect TrackPopupMenu OpenClipboard SetTimer FindWindowExA CloseClipboard EmptyClipboard MapWindowPoints GetSysColor SetFocus LoadCursorW SetClipboardData CheckMenuItem GetClientRect AppendMenuW KillTimer GetParent SetForegroundWindow InvalidateRect GetCursorPos BeginPaint EndPaint PostMessageW FindWindowExW CallNextHookEx GetClassNameA IsWindow FindWindowW wsprintfW GetDC ReleaseDC RegisterClassExW

gdi32

SelectObject CreateDIBSection CreateCompatibleDC GdiFlush CreateFontW GetTextMetricsW DeleteDC GetTextExtentPoint32W SetTextColor SetBkMode DeleteObject CreateBitmap SetTextAlign ExtTextOutW GetDeviceCaps BitBlt

comctl32

ord412 ord410 ord413

kernel32

GetConsoleMode GetConsoleCP SetFilePointerEx SetStdHandle GetFullPathNameW GetCurrentDirectoryW LCMapStringW CompareStringW HeapReAlloc GetACP GetStringTypeW HeapAlloc HeapFree ReadFile ExitProcess DeleteFileW MoveFileExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError ReadConsoleW FindClose FindFirstFileExA FindNextFileA GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap FlushFileBuffers GetTimeZoneInformation WriteConsoleW GetModuleFileNameA HeapSize SetEndOfFile GetStdHandle InterlockedFlushSList GetUserDefaultLangID GetLocaleInfoW IsValidCodePage MulDiv GetDateFormatW ReleaseSemaphore OutputDebugStringA OpenFileMappingW CloseHandle GetCurrentProcessId MapViewOfFile WaitNamedPipeA GetCurrentProcess WriteFile GetModuleFileNameW WaitForSingleObject CreateFileW GetCurrentThreadId GetModuleHandleA CreateFileA GlobalAlloc GetNativeSystemInfo LoadLibraryW CreateThread GetLocalTime GetProcAddress GlobalLock FreeLibrary CreateSemaphoreW WideCharToMultiByte GetSystemTime GlobalUnlock GetVersion LoadLibraryA GetModuleHandleW GetLongPathNameW GetVersionExW MultiByteToWideChar Sleep OpenSemaphoreW GetTickCount LoadLibraryExW WritePrivateProfileStringW GetPrivateProfileStringW GetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RaiseException

Name

.text

Size

158KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.shared

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SystemTimeSyncService.exe

IMPHASH d20eb1af1e62fa4ab9291a0877200854
SHA256 ade4c7136d191729bf74d271358035b8ee80f533236e221c39b805400718f4d7
MD5 77d3503b66525f8004abbeddd6edcdcf
SHA1 5b77d1f87981b4e9cbabb89b5e354453895e60ae
SHA512 56f571cd4747b80930279f6d6385aa2c6e0026c49b8264990e2be4dcd56ffee939c5e61870d87468ee36014003f915cf698ed374337f772dd4d5ba22ef360491
SSDEEP 6144:DsVsVdyJQI0QOAKmTkayBnDpFgW50w92J4+D5rqGfnEAOAd6GN1FOh+V:DsugIQOZEdyBDpSWFOtvfEqdtXFOh+V
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

60:0d:dc:eb:30:b3:a7:3d:5a:d7:18:8d:ac:8b:65:ef:79:a6:22:9f:9d:6f:fa:3e:2d:93:dc:f7:ac:3c:92:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Chains

Jun 2, 2023

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Serial Number

34:9b:5e:1c:4b:84:90:fc:72:86:2a:aa:7b:9e:dc:b3

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2022 - Jul 10, 2024

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Serial Number

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 26, 2021 - May 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

5

Entry point

88352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\yxcalendar\win\YXCalendar\bin\SystemTimeSyncService.pdb

kernel32

CloseHandle SetEvent HeapCreate HeapDestroy GetCurrentDirectoryW CreateFileW WriteFile OutputDebugStringA SetLastError GetCurrentProcessId GetLocalTime GetTickCount HeapAlloc HeapReAlloc HeapFree HeapSize IsDebuggerPresent RaiseException GetCurrentProcess CreateThread GetCurrentThreadId GetModuleHandleW GetProcAddress GetCommandLineW RtlCaptureStackBackTrace SetUnhandledExceptionFilter QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree FlushFileBuffers ReadFile SetEndOfFile SetFilePointerEx GetLastError CreateDirectoryW GetFileAttributesExW FindClose FindFirstFileExW FindNextFileW ResetEvent WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetStartupInfoW InitializeSListHead WideCharToMultiByte EncodePointer DecodePointer MultiByteToWideChar CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo FreeLibrary LoadLibraryExW RtlUnwind ExitThread FreeLibraryAndExitThread ExitProcess GetConsoleCP GetConsoleMode SetStdHandle GetFileType GetStdHandle GetCommandLineA GetACP GetTimeZoneInformation IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW WriteConsoleW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetTempPathA Sleep CreateEventW WaitForSingleObject GetModuleFileNameW SetLocalTime

advapi32

OpenServiceW StartServiceCtrlDispatcherW InitializeSecurityDescriptor StartServiceW ControlService RegisterServiceCtrlHandlerW DeleteService SetServiceStatus OpenSCManagerW CloseServiceHandle QueryServiceStatus CreateServiceW SetSecurityDescriptorDacl

shell32

SHGetSpecialFolderPathW

libcurl

curl_easy_setopt curl_easy_cleanup curl_easy_init curl_easy_perform

winhttp

WinHttpGetIEProxyConfigForCurrentUser

dbghelp

SymGetLineFromAddr64 SymFromAddr

Name

.text

Size

237KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=22, id=241, version=40116,

count=159, id=243, version=40116,

count=32, id=242, version=40116,

count=1, id=199, version=41118,

count=26, id=259, version=24123,

count=64, id=261, version=24123,

count=34, id=260, version=24123,

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=193, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=268, id=1, productName=Unmarked objects,

count=5, id=265, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

UninstallSystemTimeSyncService.bat

SHA256 ee7fa177b3262fd07801cb129b122cd42bc66e61f6b7f3b9b10a837c563d645a
MD5 266baae5a3f6cf8a9838dce0aa04fa87
SHA1 862c70a5d15778a8ec77dee6098ed169cb931cdc
SHA512 676affd8f44d6c26be5315bbaf016e70dd6ee5df6722684015e6c8fa83a62edf8c47d73d3f119666c19377f1ba33d0449662ed9001a564bc26f9d721bf035dee
MD5 SHA1 SHA512

YXCalendar.exe

IMPHASH a2d1e971d0322f960cc01d5aa3f86b5c
SHA256 7b59ce0108b3474df9c3282afee1cfc41e0e572d5cf7b2cb72c3cc64ce77bd7b
MD5 18418c7f12becb03f65121f37f50c284
SHA1 fbb2bd6f4494dc9e8798c0e2209de2967af69f80
SHA512 d546d4df4055c163aa2592423b92b82275e2a144cd713d1be513e02893cf223b216da6ef9a473acaaff3a2f01ff4f75780b484ae25403b9cc5fc51f4895a12b1
SSDEEP 196608:jIwzaWxdeNctICkmDcoPTDZ/tTpIhFeXawoE0D+JMvd:jIwHxd9tDcoHZ1wKS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

33:1f:e7:e6:63:f2:58:11:77:f3:b4:34:85:51:13:d0:42:74:f0:25:b5:42:6d:d6:7f:dd:eb:e0:af:45:7c:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Chains

Jun 2, 2023

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Serial Number

34:9b:5e:1c:4b:84:90:fc:72:86:2a:aa:7b:9e:dc:b3

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2022 - Jul 10, 2024

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Serial Number

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 26, 2021 - May 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

5

Entry point

3207900

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\yxcalendar\win\YXCalendar\bin\YXCalendar.pdb

kernel32

SizeofResource CreateNamedPipeA FreeResource LockResource LoadResource FindResourceW MoveFileW ConnectNamedPipe GetLocalTime GlobalUnlock GlobalLock GlobalAlloc GetVersionExW FindClose FindNextFileW FlushFileBuffers QueryPerformanceCounter FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap DeleteCriticalSection GetFileSize LockFileEx LocalFree CreateFileMappingA UnlockFile HeapDestroy HeapAlloc GetSystemInfo HeapReAlloc DeleteFileA GetVersionExA LoadLibraryA CreateFileA GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA FormatMessageW GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LeaveCriticalSection LockFile GetDiskFreeSpaceW InterlockedCompareExchange WriteFile GetFullPathNameW EnterCriticalSection HeapFree HeapCreate ReadFile AreFileApisANSI SetThreadExecutionState FindFirstFileW SetUnhandledExceptionFilter SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage WriteConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW ReadConsoleW GetStdHandle GetCurrentProcessId CreateFileW GetCurrentProcess OpenEventW Process32NextW Process32FirstW CreateToolhelp32Snapshot MapViewOfFile CreateFileMappingW TerminateProcess OpenProcess CopyFileW GetModuleHandleW GetNativeSystemInfo InterlockedIncrement InterlockedDecrement GetProcAddress LoadLibraryW GetModuleFileNameW GetTempPathW GetTickCount DeleteFileW CreateThread CloseHandle TerminateThread SetEvent OutputDebugStringW Sleep SetStdHandle ResumeThread ExitThread PeekNamedPipe GetFileType GetDriveTypeW GetConsoleMode GetConsoleCP RtlUnwind CreateTimerQueue QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect CreateEventW WaitForSingleObject LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation SwitchToThread SignalObjectAndWait InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter WaitForSingleObjectEx GetTimeZoneInformation FindFirstFileExW RegisterWaitForSingleObject UnregisterWaitEx GetModuleHandleA SetFilePointerEx VirtualFree VirtualAlloc GetModuleHandleExW ReleaseMutex FileTimeToSystemTime GetCurrentThreadId OutputDebugStringA TryEnterCriticalSection GetStringTypeW QueryPerformanceFrequency SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW MulDiv lstrlenW GetCurrentDirectoryW ExitProcess GetACP VerSetConditionMask VerifyVersionInfoW lstrcmpiW lstrcpyW GlobalFree SetFileTime LocalFileTimeToFileTime CreateDirectoryW RaiseException lstrcpynW ResetEvent IsDebuggerPresent DuplicateHandle GetCurrentThread SetThreadPriority GetThreadPriority GetCommandLineW RtlCaptureStackBackTrace SystemTimeToTzSpecificLocalTime

user32

ShowWindow MonitorFromWindow SetWindowPos GetWindowRect GetWindow MonitorFromPoint GetWindowThreadProcessId SendMessageW IsWindowVisible PostMessageW KillTimer ClientToScreen IsIconic IsZoomed GetClientRect SetFocus SetTimer PtInRect GetSystemMetrics IntersectRect OffsetRect IsWindow SetWindowLongW GetWindowLongW SetParent GetClassNameW GetMonitorInfoW MoveWindow FindWindowExW wsprintfW GetDC GetKeyState CallNextHookEx SetWindowsHookExW UnhookWindowsHookEx GetWindowTextW FindWindowA RegisterWindowMessageW GetLastInputInfo ReleaseDC RegisterHotKey EnumDisplayMonitors AttachThreadInput GetForegroundWindow GetParent SetForegroundWindow LoadIconW CreatePopupMenu AppendMenuW CheckMenuItem TrackPopupMenu keybd_event InvalidateRect GetCursorPos EnumWindows GetWindowTextLengthW PostThreadMessageW ScreenToClient SetClassLongW OpenClipboard CloseClipboard EmptyClipboard ExitWindowsEx GetClipboardData SetClipboardData IsClipboardFormatAvailable GetCursor WindowFromPoint FindWindowW LoadCursorW MessageBoxA MapVirtualKeyW MessageBoxW GetKeyNameTextA UnregisterHotKey GetMessageW TranslateMessage DispatchMessageW CreateWindowExW DestroyWindow CharNextW GetActiveWindow GetFocus SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect MapWindowPoints GetSysColor UnionRect IsRectEmpty LoadImageW SetWindowRgn SetCursor InflateRect DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW EnableWindow SetPropW GetPropW IsWindowEnabled DestroyMenu EnableMenuItem CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos SetWindowTextW UpdateWindow EqualRect CharPrevW DrawTextW FillRect SetRect DrawIconEx GetKeyboardLayout GetKeyNameTextW MapVirtualKeyExW UpdateLayeredWindow GetWindowRgn wsprintfA DrawTextA CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo PostQuitMessage

gdi32

CreateCompatibleDC CreateFontIndirectW CreatePen DeleteDC GetDeviceCaps GetStockObject AddFontMemResourceEx RemoveFontMemResourceEx EnumFontFamiliesW CreateDIBitmap SaveDC SelectObject CloseEnhMetaFile CreateEnhMetaFileW GetEnhMetaFileHeader PlayEnhMetaFile GetTextMetricsW SetWindowOrgEx CreateRoundRectRgn CreatePatternBrush CreateSolidBrush DeleteObject CreateCompatibleBitmap SetTextColor CombineRgn CreatePenIndirect CreateRectRgnIndirect GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo SelectClipRgn ExtSelectClipRgn StretchBlt SetStretchBltMode CreateDIBSection MoveToEx TextOutW GdiFlush CreateRectRgn PtInRegion GetTextExtentPointA GetBitmapBits SetBitmapBits BitBlt SetBkMode GetObjectA GetObjectW SetBkColor GetPixel RestoreDC Rectangle

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCreateKeyA LookupPrivilegeValueW AdjustTokenPrivileges RegQueryValueExA RegSetValueExA OpenProcessToken RegQueryInfoKeyA RegOpenKeyExA GetTokenInformation RegSetValueExW RegDeleteValueW RegQueryValueExW RegNotifyChangeKeyValue RegCloseKey RegOpenKeyExW

shell32

SHGetSpecialFolderPathW SHAppBarMessage Shell_NotifyIconW ShellExecuteA ShellExecuteExW ShellExecuteW DragQueryFileW

ole32

CreateStreamOnHGlobal DoDragDrop CoCreateInstance ReleaseStgMedium CLSIDFromString CLSIDFromProgID OleDuplicateData CoSetProxyBlanket CoUninitialize CoCreateGuid OleLockRunning CoInitialize

oleaut32

SysStringLen VariantClear VariantInit SysFreeString SysAllocStringByteLen SysAllocString

comctl32

InitCommonControlsEx _TrackMouseEvent ord17

gdiplus

GdipCreateFont GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateStringFormat GdipSetStringFormatAlign GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipCreateFontFromDC GdipSetStringFormatLineAlign GdipCreateFontFromLogfontA GdipSaveImageToFile GdipCreateBitmapFromFile GdipGetImageWidth GdipGetFontSize GdipGetImageEncodersSize GdipGetGenericFontFamilySansSerif GdipCreateHBITMAPFromBitmap GdipGetPathWorldBounds GdipGetFontStyle GdipCreatePath GdipDisposeImage GdipDeletePath GdipCreateBitmapFromHBITMAP GdipCloneImage GdipAddPathString GdipGetFamily GdipGetImageEncoders GdipGetImageHeight GdipDeleteStringFormat GdipDeleteFont GdipCreateSolidFill GdipFillPieI GdipDeleteBrush GdipAlloc GdipSetSmoothingMode GdipRotateWorldTransform GdipTranslateWorldTransform GdipGetPropertyItem GdipFree GdipGetPropertyItemSize GdipCreateFromHDC GdipFillEllipseI GdipCloneBrush GdipFillRectangleI GdipDeleteGraphics GdipImageSelectActiveFrame GdipImageGetFrameCount GdiplusStartup GdiplusShutdown GdipAddPathLine ord1 GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipSetTextRenderingHint GdipSetInterpolationMode GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillPath GdipDrawImageRectI GdipDrawString GdipMeasureString GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipAddPathEllipseI GdipLoadImageFromFile GdipDrawEllipseI GdipSetClipPath GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList

dbghelp

SymGetLineFromAddr64 SymFromAddr MiniDumpWriteDump

winmm

timeGetTime timeKillEvent timeSetEvent PlaySoundW

ws2_32

WSAStartup gethostbyname WSACleanup gethostname

libcurl

curl_easy_strerror curl_global_cleanup curl_global_init curl_easy_getinfo curl_easy_setopt curl_easy_cleanup curl_easy_perform curl_easy_init curl_slist_append curl_slist_free_all

winhttp

WinHttpGetIEProxyConfigForCurrentUser

iphlpapi

GetAdaptersInfo

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

914KB

Virtual Size

914KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

21B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

218KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=31, id=241, version=40116,

count=179, id=243, version=40116,

count=33, id=242, version=40116,

count=2, id=261, version=23013,

count=6, id=199, version=41118,

count=27, id=259, version=24123,

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=28, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=339, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=37, id=260, version=24123,

count=129, id=261, version=24123,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=631, id=1, productName=Unmarked objects,

count=222, id=265, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

YXCapture.dll

IMPHASH e3d948651137792db1574debe5630739
SHA256 96290694a953e721c87d1b30c02190598f93a77e9f58fe0c0e584d5214a3a27e
MD5 5c67357fca4bbebb215b8dbf1d617300
SHA1 4e56bef46f87ede792cb8015eff59eb430896627
SHA512 e24bd58be87bca99f5e68096fef7a3ea067d26146142dd1e53279bbb60207783562f2d9732bb257e68b3f75a1ab46129def472e3c76f1500f92a5f0c56df98a2
SSDEEP 12288:Bl6rwCkTDoxkYbAQpJUnFDQnCWK9tmyDHdmNs:Bl6r9AKI2nCTKit
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

c0:d3:aa:a1:51:d1:55:a1:c5:21:74:be:2a:c1:39:94:9c:72:ae:e4:37:13:ca:a8:a1:eb:5d:64:c5:d3:96:bd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Chains

Jun 2, 2023

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Serial Number

34:9b:5e:1c:4b:84:90:fc:72:86:2a:aa:7b:9e:dc:b3

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2022 - Jul 10, 2024

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Serial Number

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 26, 2021 - May 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

5

Entry point

231829

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\yxcapture\bin\YXCapture.pdb

kernel32

FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose GetStringTypeW GetStdHandle LCMapStringW GetModuleFileNameA GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo SetLastError InterlockedFlushSList LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind EncodePointer OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent WriteConsoleW GetFileAttributesW FreeResource GlobalUnlock GlobalLock GlobalAlloc GetTickCount GetLocalTime GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetCurrentProcessId GetProfileIntW GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy FindResourceExW FindResourceW SizeofResource LockResource LoadResource DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount DecodePointer TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW GetLastError RaiseException WaitForSingleObjectEx ResetEvent SetEvent CreateDirectoryW DosDateTimeToFileTime SystemTimeToFileTime DuplicateHandle SetFileTime SetFilePointer WriteFile GetFileType GetCurrentProcess CreateFileW CloseHandle ReadFile GetFileSize ExitProcess GetCurrentDirectoryW GetModuleHandleW GetModuleFileNameW LoadLibraryW GetProcAddress GetACP OutputDebugStringA

user32

IsWindow IsWindowVisible GetWindowRect FindWindowExW GetWindow GetWindowLongW FillRect GetClientRect ClientToScreen ClipCursor SetCapture GetWindowTextLengthW CharPrevW CharNextW MessageBoxW SetWindowRgn IsIconic MapWindowPoints GetClassNameW KillTimer SetTimer GetFocus DestroyWindow MonitorFromWindow GetParent GetPropW SetPropW EnableWindow PtInRect RegisterClassW GetMessageW GetCapture DispatchMessageW ReleaseCapture EnumDisplayMonitors GetUpdateRect GetDesktopWindow GetMonitorInfoW GetCursorPos ScreenToClient BeginDeferWindowPos DeferWindowPos EndDeferWindowPos SetFocus InvalidateRgn GetSystemMetrics UpdateWindow GetDCEx GetDC ReleaseDC GetWindowThreadProcessId CallWindowProcW ShowWindow SetWindowTextW InflateRect CreateWindowExW SendMessageW PostMessageW SetWindowLongW MoveWindow InvalidateRect SetCursor LoadCursorW GetClassInfoExW CloseClipboard OffsetRect EqualRect SetRectEmpty SetRect IsRectEmpty CopyRect IsZoomed IntersectRect EndPaint BeginPaint wsprintfW DrawTextW SetClipboardData EmptyClipboard OpenClipboard SendInput CloseWindow PostQuitMessage DefWindowProcW SetForegroundWindow AttachThreadInput GetForegroundWindow RegisterClassExW TranslateMessage TranslateAcceleratorW GetKeyState LoadAcceleratorsW SetWindowPos GetWindowTextW

gdi32

GetPixel StretchBlt BitBlt CreateCompatibleBitmap CreateCompatibleDC SetTextColor CreateFontW CreatePen ExtTextOutW SetBkColor RestoreDC PatBlt SetBkMode UnrealizeObject Rectangle SetROP2 GetStockObject SelectObject SetWindowOrgEx SetViewportOrgEx SetMapMode CreatePatternBrush CreateBitmap SaveDC CreateSolidBrush GetObjectW DeleteObject TextOutW MoveToEx CreateDIBSection SetStretchBltMode ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CreatePenIndirect CombineRgn CreateRoundRectRgn GetTextMetricsW CreateFontIndirectW DeleteDC GetObjectA

comdlg32

GetSaveFileNameW

shell32

SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal

comctl32

_TrackMouseEvent ord17

gdiplus

GdipCreatePen1 GdipDeletePen GdipCreateAdjustableArrowCap GdipDeleteCustomLineCap GdipFree GdipSetPenCustomEndCap GdipDrawLineI GdipCreatePath GdipDeletePath GdipAddPathLineI GdipWidenPath GdipIsVisiblePathPointI GdipDrawLinesI GdipAddPathLine2I GdipDrawEllipseI GdipAddPathEllipseI GdipGetDC GdipReleaseDC GdiplusStartup GdiplusShutdown GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipDisposeImage GdipSetStringFormatLineAlign GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipCreateLineBrushI GdipSetStringFormatAlign GdipDrawImageRectI GdipGetImageHeight GdipGetImageWidth GdipLoadImageFromStream GdipSetClipRectI GdipDrawLines GdipDrawString GdipSetTextRenderingHint GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipCreateRegionRectI GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateLineBrushFromRectI GdipCombineRegionPath GdipAddPathPolygonI GdipCreateRegionPath GdipAddPathRectangleI GdipDrawRectangleI GdipResetClip GdipFillRectangleI GdipSetSolidFillColor GdipGetRegionBoundsI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipSetClipRegion GdipDeleteRegion GdipSaveImageToFile GdipGetImageEncoders GdipCreateBitmapFromScan0 GdipGetImageEncodersSize

shlwapi

PathFindExtensionW

Name

.text

Size

325KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=21, id=241, version=40116,

count=143, id=243, version=40116,

count=26, id=242, version=40116,

count=2, id=261, version=23013,

count=1, id=199, version=41118,

count=20, id=259, version=24123,

count=18, id=260, version=24123,

count=36, id=261, version=24123,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=29, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=341, id=1, productName=Unmarked objects,

count=24, id=265, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

YXUpdate.exe

IMPHASH ae40e2621116b97a8c371655e4362b32
SHA256 8365265b0f62a8b69a1bd2bd99442a3d780a94193754b5bcddde14777630f3fc
MD5 74b26f8fdcdc65eb79b290421ffbc08f
SHA1 be52873e363cc1a2e8d639366a853f5f9e498574
SHA512 0555897bdcc3c27e3810e0a409e7eeb0b824c8ce3552620ed77c5d7d932eb6efc692cc9849f90a78ddad06d83af596ee27087a7d5ecbe2fa1b16dddc072ba88d
SSDEEP 12288:CcLpkPkl63yxf+nXlo+C/SZ3bsIaGmtWDag2vY7pPWLmrXp/am/R:3LaPa63sco+iSZ3qG4WDRpPfDp/am
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

18:72:bf:23:6f:a0:44:8d:89:ee:b4:ac:91:35:68:05:e0:ac:5d:3f:5f:cd:43:cc:05:69:a6:8c:3f:5f:c7:ae

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Chains

Jun 2, 2023

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Serial Number

34:9b:5e:1c:4b:84:90:fc:72:86:2a:aa:7b:9e:dc:b3

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2022 - Jul 10, 2024

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Serial Number

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 26, 2021 - May 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

5

Entry point

116553

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\yxcalendar\win\YXCalendar\bin\YXUpdate.pdb

kernel32

Sleep GetLastError OutputDebugStringW CopyFileW MoveFileW WaitForSingleObject FindClose RemoveDirectoryW FindNextFileW FindFirstFileW DeleteFileW GetModuleFileNameW WideCharToMultiByte SystemTimeToFileTime GetCurrentDirectoryW CloseHandle LocalFileTimeToFileTime MultiByteToWideChar GetFileAttributesW CreateFileW SetFilePointer HeapCreate HeapDestroy OutputDebugStringA SetLastError GetCurrentProcessId GetLocalTime GetTickCount HeapAlloc HeapReAlloc HeapFree HeapSize IsDebuggerPresent RaiseException GetCurrentProcess GetCurrentThreadId GetModuleHandleW GetProcAddress GetCommandLineW RtlCaptureStackBackTrace SetUnhandledExceptionFilter QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetFileTime SetEndOfFile SetFilePointerEx CreateEventW GetFileAttributesExW SetEvent FindFirstFileExW ResetEvent UnhandledExceptionFilter IsProcessorFeaturePresent WaitForSingleObjectEx GetStartupInfoW InitializeSListHead EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo FreeLibrary LoadLibraryExW RtlUnwind GetConsoleCP GetConsoleMode ExitProcess SetStdHandle GetFileType GetStdHandle GetCommandLineA GetACP ReadConsoleW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WriteConsoleW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteFile ReadFile FlushFileBuffers CreateDirectoryW

user32

SendMessageW FindWindowW wsprintfW

shell32

ShellExecuteExW SHGetSpecialFolderPathW ShellExecuteW

libcurl

curl_easy_setopt curl_easy_cleanup curl_easy_getinfo curl_easy_init curl_easy_perform

winhttp

WinHttpGetIEProxyConfigForCurrentUser

dbghelp

SymGetLineFromAddr64 SymFromAddr

Name

.text

Size

256KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

828B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

389KB

Virtual Size

389KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=22, id=241, version=40116,

count=159, id=243, version=40116,

count=32, id=242, version=40116,

count=1, id=199, version=41118,

count=26, id=259, version=24123,

count=62, id=261, version=24123,

count=36, id=260, version=24123,

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=193, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=259, id=1, productName=Unmarked objects,

count=5, id=265, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

data.dat

SHA256 bb6d591747746a84a575d4e4ce90fae3bfbfe338423b9cc7598e42ab6623a601
MD5 3fc9518dc1dc8a609dceb4336e46f3ff
SHA1 945a1bea1890f05699b2a22f764a9050dda7381c
SHA512 d7c2b8a7aefee20501bc3bbb3511865147099d669314df9892acdcce3d8dc49b072bdb9f286cc576a4389a42661868d3c3070861f1f38af04f91d7e34638c0eb
SSDEEP 24576:U1ftuVGx24+T0l7YzIw59I7I/GDeOmt8kXNjyEnLijkNd3ERrRkR7maMnyl/e3WS:iE6uToh
MD5 SHA1 SHA512 SSDEEP

data1.dat

SHA256 0d8b99c433576e05b78d1d4d6a371f08f33dc48350608d18fa6e955a85163898
MD5 e07ab64c6d9c5bfbb195004fd5f90db3
SHA1 7e436b667288ad6b42c342d1de6e02f46bd1ab2d
SHA512 c43189e8e43cac651485d0dae317c74b2c1ef86332e78ff3465a5504edcc4fe149e2f5070b3a36cdbba7e376ecdd016f92e6456877cfbb71467f59e888a23c9a
SSDEEP 3072:StzQUxAmvxE2cNVPyQDlxJNWNmH967h935coH4H/LtNJge3i:SttxN+vRNgNK9Wh15h4nuey
MD5 SHA1 SHA512 SSDEEP

data2.dat

SHA256 f80adeaa5afafbdde6c1665a46dc76670b93fdd1f946e8b4018ca7bce5337680
MD5 173cba437c2bf4c29b5bf4db581105b8
SHA1 6126ec2b8f255f6ffe87836314bd50b7fd983ce8
SHA512 0ffe01f8b06d1229c2221537ed5372a9e9a26665a0a8f65aad9f860564a31bce10fbb432c5abd829c7946f3a7c2000d5770ac28c3b1f78530d8b4f8051be7b4c
SSDEEP 192:heH5WITTsQkwVhkSJDZ1KdZsXAmc1UzVNNKhnbnTNPmZNn:vgtZ15IqN
MD5 SHA1 SHA512 SSDEEP

data4.dat

SHA256 b54030fcc7125f615f2e8d4a1bd0c9708ec07c2b07858da055bc56305d5329b5
MD5 9e8699a64f71187bcebfe24edc5f4ebe
SHA1 ab3fa13a9b2b15ca3493f89801f13c7e8cb032be
SHA512 27c44706119e4f824c187c6b303eebcc19b3c47049ab17d6227976d74e0e7cf7feb03a1dc3ad1578821d02554f527624dc652a6e2a00ae2751955e3666e1693a
SSDEEP 768:hq4OkgKryu52IuogSQAxaDPn+2x8qE50lFpz5xJUc6I4ZPKM:hrOkgAISQOaDPvxckz5xj6I4R
MD5 SHA1 SHA512 SSDEEP

data6.dat

SHA256 29a8ffec43fba9f869d1bb8109dc20e3cbaebd434ad2682d71e9d8b7491f7c1b
MD5 3143ede64d84a23bb90fef0245617b73
SHA1 144ea19e45dc2c34c0396b3728bd61a73d58866b
SHA512 a3d7bfb4da9b968476b85bf2127b6295947251185af2de9b51527c450b0825933851d07f237edf200228839523ad01b1410a8b9275dff7ad0f7da7372cbfe409
SSDEEP 192:S7D8KY2zkD8KY2eHhpDTsccley7+B+tsRAiAVlHyAtjVONCbdKMmj5Kvzt:ohY2zqhY2eHX7cleQsmiAVv83j5Ot
MD5 SHA1 SHA512 SSDEEP

directui license.txt

SHA256 6033476be3d1d41166b65984e2be94c87ac98dce55bfec887e932b696e859295
MD5 ab54b14548a4cc76dd7c27414d971111
SHA1 68a3888b33ee1c5d5efb913846867c9a8788cadb
SHA512 cc8c4d90efedf4aeb3ba3b64ebd0e938576867618a334bccf3cb6790338c6a1da239393a618f6e6a1186cb363cb514ac9528ada51f0090fe2fc709e5c666d971
MD5 SHA1 SHA512

duilib license.txt

SHA256 7ed2acca31a243ba107d8c12fddecd52462fd326d3d2c73b04d4cf10c76765ff
MD5 7faec2006bb231d14b794a9f31769448
SHA1 c2b5a34fe521502f6fca3031201b47074f30f258
SHA512 777e0ec5d6b599fb0eabb8180fb6f302012ff12245e3de6a3dc568798cb057858eff18b08dacd28a72250236c4767abc2583670d92a946f684b45cb5144bd7e2
MD5 SHA1 SHA512

echarts.min.js

SHA256 7f4e96c4794813d639476790972aaaa13df57818b986d0cdced9902b28b12c4c
MD5 eae8f86aa44d997b3e1121a651ca31a4
SHA1 fda95a8df5b5ecd1ff292648d80f968b1075ad7e
SHA512 f75c1370f4ef4cc99c0d86c90031aeaca22cb6796888c968080d844ac2bb0eb1b70fc21dda06a04f090ba1b9c0606067358868eb8bcf05c08a16c330c7b6a8c4
SSDEEP 12288:Zv9DrbrkJhGmbk5FCFzs9TcjrN1DDgzS1KSgvDVdkYp:LDrbrkJcmbgCzvvgzSUSgvDVdX
MD5 SHA1 SHA512 SSDEEP

libcurl.dll

IMPHASH eb425d2964f463fa8f4eb5046781399a
SHA256 d51171f6955f8b899e9172ced5398dba075c3bb0f2e454e6652faef64b2b0d4b
MD5 a6b9e8cfb03e06dbdce046592c83503e
SHA1 116d26917b20074df10a9e4e5950a130e7f93612
SHA512 8da20b52444f5d66f1e26688adeb66b5ec9c48625c887cd226901044a21dde92b2661949c57af7955029d083be88fb3d6bec081563f1575bb21f4ecd90f68418
SSDEEP 49152:Yg60wAln1VueTXNxVCQZw/wCI01IP1qsTCnqsyN:Yg60wAln7gmIwCzcqj
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

e1:0c:3c:8e:3c:bf:d0:cc:0a:c9:99:5e:33:a8:47:4b:e8:73:5b:ec:64:5e:c9:e3:3a:8b:0c:ed:f6:9c:58:b2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Chains

Jun 2, 2023

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Serial Number

34:9b:5e:1c:4b:84:90:fc:72:86:2a:aa:7b:9e:dc:b3

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2022 - Jul 10, 2024

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Serial Number

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 26, 2021 - May 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

1353680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\curl-7.65.2\build\Win32\VC14\DLL Release - DLL OpenSSL\libcurl.pdb

ws2_32

getnameinfo gethostbyname sendto recvfrom WSACleanup WSAStartup send select __WSAFDIsSet ioctlsocket listen accept gethostname freeaddrinfo getaddrinfo WSAIoctl WSASetLastError socket setsockopt recv ntohs htons getsockopt getsockname getpeername connect closesocket bind WSAGetLastError shutdown

wldap32

ord219 ord167 ord301 ord147 ord133 ord79 ord142 ord145 ord127 ord27 ord26 ord118 ord41 ord208 ord216 ord14 ord46

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

kernel32

SetFileAttributesW GetFileAttributesExW FlushFileBuffers SetStdHandle GetFullPathNameA GetFullPathNameW GetCurrentDirectoryW SetCurrentDirectoryW HeapReAlloc EnumSystemLocalesW FindClose IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetACP GetStringTypeW GetCurrentThread HeapAlloc FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW IsValidCodePage GetOEMCP GetUserDefaultLCID GetCPInfo InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SleepEx MultiByteToWideChar WideCharToMultiByte WaitForSingleObject CloseHandle ExpandEnvironmentStringsA GetCommandLineA GetLastError SetLastError FormatMessageA VerSetConditionMask FreeLibrary GetProcAddress LoadLibraryW GetModuleHandleW GetSystemDirectoryW QueryPerformanceFrequency VerifyVersionInfoW WaitForMultipleObjects GetFileType GetStdHandle ReadFile PeekNamedPipe GetTickCount QueryPerformanceCounter GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW FormatMessageW WriteFile GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiber GetCurrentProcessId GlobalMemoryStatus FindFirstFileW ConvertFiberToThread ConvertThreadToFiber GetSystemTime SystemTimeToFileTime HeapFree GetConsoleCP GetModuleFileNameW GetModuleFileNameA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetProcessHeap SetEndOfFile WriteConsoleW GetTimeZoneInformation HeapSize OutputDebugStringA OutputDebugStringW WaitForSingleObjectEx EncodePointer DecodePointer Sleep LoadLibraryA RaiseException ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPushEntrySList InterlockedFlushSList RtlUnwind LoadLibraryExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread CreateFileW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetFilePointerEx SetConsoleCtrlHandler

user32

GetUserObjectInformationW MessageBoxW GetProcessWindowStation

advapi32

CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CryptGenRandom

curl_easy_cleanup curl_easy_duphandle curl_easy_escape curl_easy_getinfo curl_easy_init curl_easy_pause curl_easy_perform curl_easy_recv curl_easy_reset curl_easy_send curl_easy_setopt curl_easy_strerror curl_easy_unescape curl_easy_upkeep curl_escape curl_formadd curl_formfree curl_formget curl_free curl_getdate curl_getenv curl_global_cleanup curl_global_init curl_global_init_mem curl_global_sslset curl_maprintf curl_mfprintf curl_mime_addpart curl_mime_data curl_mime_data_cb curl_mime_encoder curl_mime_filedata curl_mime_filename curl_mime_free curl_mime_headers curl_mime_init curl_mime_name curl_mime_subparts curl_mime_type curl_mprintf curl_msnprintf curl_msprintf curl_multi_add_handle curl_multi_assign curl_multi_cleanup curl_multi_fdset curl_multi_info_read curl_multi_init curl_multi_perform curl_multi_remove_handle curl_multi_setopt curl_multi_socket curl_multi_socket_action curl_multi_socket_all curl_multi_strerror curl_multi_timeout curl_multi_wait curl_mvaprintf curl_mvfprintf curl_mvprintf curl_mvsnprintf curl_mvsprintf curl_pushheader_byname curl_pushheader_bynum curl_share_cleanup curl_share_init curl_share_setopt curl_share_strerror curl_slist_append curl_slist_free_all curl_strequal curl_strnequal curl_unescape curl_url curl_url_cleanup curl_url_dup curl_url_get curl_url_set curl_version curl_version_info

uninst.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 43930aa3d2c80ecc5a057b63028f676bda0e1a1719ec6fe069b24e77bad0495f
MD5 df4af422f25f41505417ee37cbe658d3
SHA1 82672b5f9204227b7b81dcb65bc7e72f67030733
SHA512 a9f51c65a9270020ecdbd4f6c7151dbe1b5b11611b862a1c3bbb0eb03fe811e3e7a030e81fea65c404acce75cfed793ffa80fbcd2dfbcfaf8b044aba566c8583
SSDEEP 12288:HYKtWDag2vx7pPWL5br3WhceKOESMhtXV6rnlvRw:HY0WD+pPEb7WuOEVhx8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

13:9d:dc:db:75:41:f0:34:3f:58:3c:b7:16:ee:24:4a:e4:b8:eb:b1:0e:6e:dc:24:27:a2:3b:8d:18:2b:45:20

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Chains

Jun 2, 2023

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=Dongguan Youxiao Network Technology Co.\,Ltd,O=Dongguan Youxiao Network Technology Co.\,Ltd,L=Dongguan,ST=Guangdong,C=CN

Serial Number

34:9b:5e:1c:4b:84:90:fc:72:86:2a:aa:7b:9e:dc:b3

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2022 - Jul 10, 2024

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Serial Number

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 26, 2021 - May 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LogEx.dll

IMPHASH 549d7b44067bbcdf42bf6a90a80a3a9e
SHA256 57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314
MD5 0f96d9eb959ad4e8fd205e6d58cf01b8
SHA1 7c45512cbdb24216afd23a9e8cdce0cfeaa7660f
SHA512 9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c
SSDEEP 384:w4NSXFjXCATBAQR4F1Y5u6I3wa4W7KNP66BjLjyXB0JyuDchv8EnohgSil2X:woaF+ATCQye/I3KWmxj00Jyb8Enov
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6315

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH ac10bd0ffca217141ca47c63b7c99be6
SHA256 2fd047e73350f864d85b2bc128ec19cc30b7d47db656aad08aa7923155ab4f97
MD5 210f551d877a262fa2b32fa23289ffda
SHA1 a527a7b94711146843e1dd78b61b1ba78dce2a26
SHA512 ba9486f02b602e0208cca4f1ca64d3f2f601cbd239ebc8b11e5b80d55dc7eab0d0bfcb20444e505a2e3b4fd3ac5a0c9cb5e1b3753e4aa302c70770453ea798a6
SSDEEP 6144:Olat1rg5hb6fAEHWAxpEFrFQhi4oOkM4lpfO8BgKL8OxwFCLGZXj:o4g5hbg1WAxpEJFXFlF1gqxwFCL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

174652

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\浏览器打包\Plugins\Inetc\Unicode\Plugins\inetc.pdb

wininet

InternetOpenW InternetCrackUrlW InternetConnectW HttpEndRequestW HttpOpenRequestW HttpAddRequestHeadersW InternetErrorDlg InternetCloseHandle HttpAddRequestHeadersA InternetQueryOptionW InternetSetOptionW InternetSetFilePointer InternetGetLastResponseInfoW FtpOpenFileW FtpCreateDirectoryW HttpQueryInfoW HttpSendRequestExW HttpSendRequestW InternetWriteFile InternetReadFile

comctl32

ord17

kernel32

GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetLocaleInfoA GetConsoleMode GetConsoleCP IsProcessorFeaturePresent GetStringTypeW LCMapStringW SetStdHandle WriteConsoleW OutputDebugStringA RtlUnwind GetLocaleInfoW InterlockedExchange SetConsoleCtrlHandler SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess OutputDebugStringW FlushFileBuffers lstrlenW WriteFile ReadFile lstrcmpW lstrcpynW GetLastError GetProcAddress LoadLibraryA LocalFree DeleteFileW CloseHandle SleepEx SetFilePointer GetTickCount lstrcatW GetFileSize CreateFileW lstrcmpiW LocalAlloc lstrcpyW MulDiv GetModuleHandleW MultiByteToWideChar TerminateThread WaitForSingleObject CreateThread CreateFileA lstrlenA WideCharToMultiByte GlobalFree GlobalAlloc HeapQueryInformation HeapSize HeapReAlloc IsValidCodePage GetCPInfo GetOEMCP GetACP FatalAppExitA LeaveCriticalSection EnterCriticalSection FreeLibrary VirtualQuery GetProcessHeap HeapAlloc TerminateProcess HeapFree GetModuleFileNameW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA DeleteCriticalSection GetStartupInfoW GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount ExitProcess IsBadReadPtr HeapValidate GetCurrentThreadId DecodePointer GetCommandLineA IsDebuggerPresent RaiseException LoadLibraryW EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetCurrentThread

user32

wsprintfA FindWindowExW CreateDialogParamW EnableWindow IsWindowVisible GetMessageW IsDialogMessageW TranslateMessage DispatchMessageW RedrawWindow UpdateWindow KillTimer DestroyWindow LoadIconW SetTimer GetWindowRect GetClientRect SystemParametersInfoW SetDlgItemTextW SendMessageW GetWindowTextW PostMessageW GetDlgItem SendDlgItemMessageW SetWindowTextW GetWindowLongW SetWindowLongW ShowWindow GetParent MessageBoxW IsWindow wsprintfW SetWindowPos

Name

.textbss

Size

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

336KB

Virtual Size

336KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsProcess.dll

IMPHASH 439074d1c01f7b16781bdf060930814a
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer