TruyKich[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/IpConfig.dll
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

TruyKich.exe

IMPHASH 1f23f452093b5c1ff091a2f9fb4fa3e9
SHA256 c71d54595ddbd907eb04b521e448cbf8eea12ec5a9ff907d82be9ffe4ab37e81
MD5 ec78ce90c1aa04aa7de6b5fef3a535d9
SHA1 a3f3cbdc19a6bcd469254ddabfd3c2001a511168
SHA512 2c29fa50bb14720eda63105f02bb25b3071755aa77d7abd7acd98632a1c5bd1ae98ffb7c3c0d13c0dc4637314ace368b1fac10929998abff72f050a7a175ddb0
SSDEEP 49152:GP8zUR1vFG5FktYPUP6LrxfXSrEi3XyeE0Rpm:cR1vI5ytbiL5XS53XrhRpm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

c6:7a:19:6a:80:cb:66:f0:f0:ca:a2:6a:2b:d4:18:0e:66:b9:09:fb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=VTC MOBILE SERVICES JOINT STOCK COMPANY,O=VTC MOBILE SERVICES JOINT STOCK COMPANY,STREET=Phường Vĩnh Tuy+STREET=Số 65\, phố Lạc Trung\,,L=Quận Hai Bà Trưng,C=VN

Chains

Jan 29, 2021

CN=VTC MOBILE SERVICES JOINT STOCK COMPANY,O=VTC MOBILE SERVICES JOINT STOCK COMPANY,STREET=Phường Vĩnh Tuy+STREET=Số 65\, phố Lạc Trung\,,L=Quận Hai Bà Trưng,C=VN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=VTC MOBILE SERVICES JOINT STOCK COMPANY,O=VTC MOBILE SERVICES JOINT STOCK COMPANY,STREET=Phường Vĩnh Tuy+STREET=Số 65\, phố Lạc Trung\,,L=Quận Hai Bà Trưng,C=VN

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

01

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=VTC MOBILE SERVICES JOINT STOCK COMPANY,O=VTC MOBILE SERVICES JOINT STOCK COMPANY,STREET=Phường Vĩnh Tuy+STREET=Số 65\, phố Lạc Trung\,,L=Quận Hai Bà Trưng,C=VN

Serial Number

83:3e:8e:e6:e6:f5:06:1a:16:5d:02:82:84:5c:3d:59

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 25, 2021 - Jan 25, 2022

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Minor OS version

0

Major OS version

4

Entry point

13477

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess SetCurrentDirectoryW GetFileAttributesW SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW GetShortPathNameW GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalUnlock GetDiskFreeSpaceW GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/IpConfig.dll

IMPHASH 3f0fda09180f619ca116344bede41608
SHA256 fe2093ff4bfa1d7259c922aca1e7bb219c4d234e469942446d9e2f8086b7d720
MD5 a75e3775daac9958610ce1308e0bca3b
SHA1 d83ce354cde527c2e20fb425415f6d4795dd4cd4
SHA512 48168a91ec90df262b1e158f32b4bc2a6d6ce10022eb96d4a6f3c755b977e5c104558626adaa214bda29d7f1d246f19e2df59b9a338982aa1c623e1bdd5714c6
SSDEEP 3072:oa/4Ftm9rSlia00FW96LOsWNQmtQ9WVx95+tTIJ:t/4S9raiae8DSDtQ9W3utEJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10306

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Unicode\Plugins\IpConfig.pdb

kernel32

InterlockedIncrement InterlockedDecrement GlobalAlloc lstrcpynW GlobalFree lstrcpyW FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA HeapFree GetProcessHeap GetLastError GetCurrentThreadId GetCommandLineA RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep HeapSize ExitProcess HeapAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA RtlUnwind LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage SetFilePointer WriteFile GetConsoleCP GetConsoleMode MultiByteToWideChar LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

wsprintfW

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayGetElement VariantInit SysAllocStringByteLen VariantCopy VariantClear SafeArrayGetLBound SysStringLen SysAllocString

$PLUGINSDIR/StdUtils.dll

IMPHASH 7b79709c0d5576549eb261e3410f95f8
SHA256 4787e95796035dda92a6cbff56ffddde5ace96f5e46f0f40d2998189ccd6e7ce
MD5 b7f044787bb5a0c1eb43907c061c1ac0
SHA1 84675f05e0e406482a688c61e0dee35b9a8fb390
SHA512 7f0ebc15ee74050a8b493f2c944fc6551056efedde60193be76d4115d28b10f06cc9a859cb42135deee56d614d2ca90e432627f30432d303320dd41fc7fcde6f
SSDEEP 1536:1k3Dhu2n/PaONjb0GCDeTF7Rqh7AG2gCf46Q6K3le45Gq:CNu2n/SOx0hDeTF7Rqh7Bl2K3lefq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

59428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

iswspace ??3@YAXPAX@Z _msize _wsetlocale _snprintf iswcntrl _beginthreadex time srand rand clock _getpid _wsplitpath iswgraph __wgetmainargs wcsncpy _wcsnicmp wcschr calloc free _wcsicmp _snwprintf swscanf abort ??2@YAPAXI@Z memset memcpy

shlwapi

ord176

crypt32

CryptProtectData CryptUnprotectData

kernel32

GlobalFree MultiByteToWideChar WideCharToMultiByte InterlockedExchange HeapValidate InterlockedDecrement InterlockedIncrement GetSystemTime OutputDebugStringA GetExitCodeProcess InitializeCriticalSection SystemTimeToFileTime TerminateThread WaitForSingleObject LocalFree GetFullPathNameW GetVersion GetFileAttributesW LoadLibraryW FreeLibrary CloseHandle lstrcpynW GlobalAlloc DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetTickCount Sleep VerSetConditionMask GetCurrentProcess GetModuleHandleW FatalAppExitW GetVersionExW TerminateProcess GetModuleFileNameW RaiseException VerifyVersionInfoW GetLastError GetProcAddress SetFilePointerEx WriteFile ReadFile CreateFileW GetFileSizeEx GetCommandLineW

user32

MsgWaitForMultipleObjects PeekMessageW DispatchMessageW wsprintfW DestroyWindow SetTimer UnregisterClassW KillTimer LoadStringW MessageBoxW GetWindowThreadProcessId AllowSetForegroundWindow CreateWindowExW RegisterClassW MessageBoxA

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

ShellExecuteExW SHFileOperationW ShellExecuteW

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 75ed96254fbf894e42058062b4b4f0d1
SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10647

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH e1c0bd3d5b9f3f5cec7ea773ff66ac6e
SHA256 b8fa7b9393fff910144768588c471ca7c9ec98a2b8b186b2172b8ba7a5279500
MD5 a6f622a2f12ac10bca04e23deff5cada
SHA1 abf851b5ccfb64004e9b49718a467bd754545887
SHA512 35c8b0db179104e638f1b40f3f8038a41fdc327e112de5cb0dbb97cbf1dfa276fcf6400fcb46b88cb5ba233ca769becbdb4b4d40920adca831e3c0f38193c50f
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4714

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH e2ee55bddad4241d619d6a8a38e2d869
SHA256 feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
MD5 ca95c9da8cef7062813b989ab9486201
SHA1 c555af25df3de51aa18d487d47408d5245dba2d1
SHA512 a30d94910204d1419c803dc12d90a9d22f63117e4709b1a131d8c4d5ead7e4121150e2c8b004a546b33c40c294df0a74567013001f55f37147d86bb847d7bbc9
SSDEEP 192:oF8cSzvTyl4tgi8pPjQM0PuAg0YNy8IFtSP:EBSzm+t18pZ0WAg0R8IFg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

WDlauncher.exe

IMPHASH 51b52e8778db954dda3149403236c0f4
SHA256 998be12689f985f09d583469156a902d8c9f2b43fd6baea1d5d8d24a110c8063
MD5 bb410ae7adb7a89b48965042cc858f1b
SHA1 dec09db3bbcb5884c99886d8c24425acc002c1ea
SHA512 5461ce9cd93b92fc58b0a9befb506aea5557934161bc27cfc759db20f91ffdd556f0a8155fc211bb15d29bd6415bc1df66625f0dc772c69d392aaac42eeca1ef
SSDEEP 49152:eBn8+ofrR6nCR51VEMaYGcN9FerhfxX1BTN55gBT4q0apQTujcaKy:eBn1n1ZXb2kqdLY2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

36:ff:50:9c:05:c9:93:5a:1f:61:0c:46:3a:4f:8c:fd:3e:3c:36:9a:85:84:b6:41:88:ce:24:aa:4c:71:d5:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Dec 22, 2020

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

68:03:14:ba:23:12:c3:37:d5:31:d6:54:dc:5d:78:2d:80:7f:63:5d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Dec 22, 2020

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

02:f9:e9:ea:01:af:ba:10:0b:a1:31:9c:24:91:32:bb

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 5, 2019 - Jan 23, 2022

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

06:0e:67:ed:0c:51:28:35:12:bd:6c:69:69:49:ee:2b

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 21, 2018 - Jan 23, 2022

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

5

Entry point

1236371

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\microclient_build\build\launcher\bin\Release\WDlauncher.pdb

ws2_32

htons ntohs setsockopt getsockopt getaddrinfo accept listen recvfrom getsockname getpeername connect closesocket bind send recv WSASetLastError select WSACleanup WSAStartup gethostbyname inet_ntoa __WSAFDIsSet socket WSAGetLastError WSAIoctl freeaddrinfo ntohl htonl gethostname ioctlsocket sendto

psapi

GetProcessImageFileNameW

kernel32

VerifyVersionInfoW GetSystemTimeAsFileTime GetEnvironmentVariableA GetFileAttributesA GetLogicalDriveStringsW QueryDosDeviceW InitializeCriticalSection SleepEx GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerifyVersionInfoA ExpandEnvironmentStringsA GetStdHandle PeekNamedPipe WaitForMultipleObjects SetLastError FormatMessageA CreateFileA GetFileSizeEx WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage GetProcessHeap SetStdHandle GetTimeZoneInformation HeapSize FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode HeapReAlloc HeapFree GetFullPathNameW HeapAlloc ExitThread GetDriveTypeW SetEnvironmentVariableW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetModuleHandleExW RtlUnwind VerSetConditionMask QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue OutputDebugStringW LocalFree GetStartupInfoW IsDebuggerPresent InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter FindFirstFileW GetVersionExW SetEnvironmentVariableA ResetEvent SetEvent SetThreadPriority GetSystemDirectoryW GetLongPathNameW GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW QueryPerformanceFrequency QueryPerformanceCounter TlsFree GetLocalTime GlobalUnlock GlobalLock GlobalAlloc WideCharToMultiByte DosDateTimeToFileTime SystemTimeToFileTime DuplicateHandle SetFileTime SetFilePointer WriteFile GetFileType GetCurrentProcess CreateFileW ReadFile GetFileSize MulDiv DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException DecodePointer ExitProcess GetCurrentDirectoryW SetCurrentDirectoryW FindResourceW GetModuleHandleW GetModuleFileNameW GetTickCount SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetACP LoadLibraryW TlsSetValue TlsGetValue TlsAlloc CreateEventW EncodePointer GetCurrentThread WaitForSingleObjectEx GetCurrentThreadId TryEnterCriticalSection AreFileApisANSI CreateHardLinkW SetFilePointerEx SetEndOfFile GetFileInformationByHandle GetFileAttributesExW lstrcpynA GetProcAddress FreeLibrary MoveFileExW CopyFileW LeaveCriticalSection EnterCriticalSection SetFileAttributesW RemoveDirectoryW CreateDirectoryW FindNextFileW FindFirstFileExW FindClose GetStringTypeW FormatMessageW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetFileAttributesW Sleep GetExitCodeThread TerminateThread CreateThread TerminateProcess GetCurrentProcessId OpenProcess DeleteFileW CloseHandle WaitForSingleObject GetLastError GetProcessId IsProcessorFeaturePresent GetExitCodeProcess InterlockedDecrement InterlockedIncrement UnregisterWaitEx

user32

GetClientRect GetWindowRect ScreenToClient SetCursor IntersectRect UnionRect OffsetRect LoadCursorW GetMessageW CreateWindowExW IsWindow DestroyWindow UpdateLayeredWindow SetWindowPos IsIconic SetFocus GetFocus GetKeyState SetCapture ReleaseCapture SetTimer KillTimer GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos IsRectEmpty PtInRect GetWindowLongW SetWindowLongW GetParent PeekMessageW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW ShowWindow EnableWindow SetPropW GetPropW MonitorFromWindow GetMonitorInfoW IsZoomed SetWindowRgn MonitorFromPoint CharNextW MoveWindow GetWindowRgn CharPrevW DrawTextW FillRect SetRect HideCaret ShowCaret GetCaretPos ClientToScreen GetSysColor MapWindowPoints SetWindowTextW GetWindowTextW GetWindowTextLengthW DispatchMessageW TranslateMessage MessageBoxW PostMessageW SendMessageW FindWindowW CreateAcceleratorTableW InvalidateRgn GetWindowPlacement SetForegroundWindow GetWindowThreadProcessId GetClassNameW GetWindow EnumWindows

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW GetDeviceCaps TextOutW GetObjectA SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRectRgnIndirect CombineRgn CreateDIBSection PtInRegion CreateRectRgn CreateRoundRectRgn GetObjectW GetTextMetricsW SelectObject SaveDC RestoreDC GetStockObject DeleteObject DeleteDC CreatePen BitBlt

shell32

SHGetSpecialFolderPathW ShellExecuteExW ShellExecuteW

ole32

CoCreateGuid OleLockRunning CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal CoInitializeEx CoCreateInstance

oleaut32

VariantClear VariantInit SysAllocString SysStringLen SysFreeString

advapi32

CryptCreateHash RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

gdiplus

GdipDeleteGraphics GdipCreateFromHDC GdipDeleteStringFormat GdipSetPenDashStyle GdipSetPenMode GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAddPathArcI GdipAddPathLineI GdipDeletePath GdipCreatePath GdipFree GdipAlloc GdiplusStartup GdipSetStringFormatAlign GdipSetStringFormatFlags GdipCloneStringFormat GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipStringFormatGetGenericTypographic GdipDrawImageRectI GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipLoadImageFromStream GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipDrawLineI

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

iphlpapi

GetAdaptersInfo

comctl32

ord17 _TrackMouseEvent

wldap32

ord143 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord46

crypt32

CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertGetNameStringA CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CertAddCertificateContextToStore CertFreeCertificateChain CryptStringToBinaryA

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

440KB

Virtual Size

440KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=21, id=241, version=40116,

count=193, id=243, version=40116,

count=31, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=199, version=41118,

count=29, id=259, version=24123,

count=20, id=260, version=24234,

count=64, id=261, version=24234,

count=130, id=261, version=24123,

count=39, id=260, version=24123,

count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=99, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=490, id=1, productName=Unmarked objects,

count=8, id=260, version=24218,

count=79, id=261, version=24218,

count=1, id=255, version=24218,

count=1, id=151,

count=1, id=258, version=24218,

locales/bz

SHA256 6dfa34a8c77431dc2f550727309bb18e682b165bce5163db9690249d809454f6
MD5 87f1b3770f84e617039c474053693edf
SHA1 b0d413070cb248ba6ba7a330e9ff96cc78b9c570
SHA512 b739f1caead840ad5386b783901c28388cb1ec86469659cc262922df23d79c0c8f01a685127948e8fbc4586e601c0c1d65d5fb51d691741e1cc124b2511f3f14
MD5 SHA1 SHA512

locales/jp

SHA256 e80f0a9c10390eb5147db1ef438e8d6ff17be9a616eca199cbd7e595ed529300
MD5 c420ad2f0141b32d9c887f9525e1fbeb
SHA1 f29e187fac5260e28e18e1eb8b4a777ff2f826b6
SHA512 ba6e28ab6ffa381267ef4d18923030743d24eec6337156fabbf5d0ac09ddb5dd4f98eaf01bee8c1ed70576fb9d99a3d794659307ba3517670ed9090cedde5e8d
MD5 SHA1 SHA512

locales/na

SHA256 1b728a8b8d8ee9857c9a1ff441b3dec42117325a39ee4b7fb46753fddff4dfc1
MD5 34dcc60068310ab7f31837e469fd95ec
SHA1 0ae703c8d8b93c14aa2569f660fdb913a32da151
SHA512 f67693571f5971d85b3fd99e11edecdf2c626b18c3ab65cbaf0fa7d7fece314f39978e5caf980aea2055d9de0330ddd0b5194dfda141d2c23240084947c8abdb
MD5 SHA1 SHA512

locales/nabz

SHA256 b9492121f4500d900c72aac8fdb9abab880962d5b18e101a6bba375d50f53de9
MD5 b6e421bd89e35119bc9e99a9e5a09df5
SHA1 19e48bc9b1f23fab52146b8c886d51f173db3934
SHA512 12a360c61c3f402bd73f4254cebb6d8623c615affae04a6eb96ace6dfc9a46fce4d22ea7289ed86ee7d480eb801619553d72a744f2daa43e4fef94ac9bfd04fd
MD5 SHA1 SHA512

locales/tk

SHA256 0328da3660f3ba5da50482fd9f56acb83d8008a0a959115d87f5c0db463938dd
MD5 4698911577221ec52c8d274aba6516d2
SHA1 e15a0719ac2f88f0fc416e3d5e51c18fbf0101a6
SHA512 d562ca1c0dc7b7adb669c8f4a8af2fe1c37550c486feb5978c3a157cfd827f2f0359d91d61a8d8390fb6bf2828e1370ce9327d0850fc94dd1814dc31a45f1575
MD5 SHA1 SHA512

locales/tw

SHA256 e415ab0d2d395eeed104ebc284e736a55fea27239e3250f4e3972dbfd3d82d07
MD5 24c8836d101a96d6238c7ef4c216c382
SHA1 f9dad5829768ca5282f1f5734830c6ae4d9bad10
SHA512 92a169bb742007e6cd40e4ff0cf0ac97f3f4cac98dfb32051609863a1d0d83dbd4986f1cc265457c94ec253f2c67821b9bdae3ef1a3cec57279c0b329743140a
MD5 SHA1 SHA512

locales/viet

SHA256 64149ad90b3e32e5a8e20c2149e107326a745d58bfb8800a982ed0fb1ac01a2e
MD5 62d57554fb81081742ebbb5edf5782a9
SHA1 32473f0a0d09f94e967e55e3c489686ec11c3ad5
SHA512 9eb76b2c9ec3698d03a9901502d168baabcbc6fffb1f249915fbf9a256172496896f906ddc2eb0bfe2f0223af60fcc45c392111b848d6c2b37ecb9948c6cb615
MD5 SHA1 SHA512

locales/zh-CN

SHA256 bd8de6c75186e616fbca948d79ce983074add9a94e3f2c75e13f28aac8def7c4
MD5 53df424b1a4e758bedc5d61817e0ed73
SHA1 915421c99c96c7e12c00e4b0c3580eb8dcb52123
SHA512 a1e457e9768cfb478a249e4004611a585a2fd6d3418cd9bce40f1633f5aff265de0966f94f082aa6fb1aa3776492d6bbc0d6f67ba3c03c7683ff080c5cb27160
MD5 SHA1 SHA512

platform.ini

SHA256 5b9b3c5a700f8ea360131521b120778c8c796e589763633a5a47d709bdab7c4c
MD5 9d5ef50f7494cf7f05b71b1f8fe75c21
SHA1 33fd98f84b1bdd5f6210ad434bb86eb9d5de0571
SHA512 cf46ccdc7e3f627f0ae6a653eaf61964d00650c41b4a030753d5485d390a0bd0881fb7650542ba348ac386dc4600e70af643f00ada43355ec645a75fc13f6d8e
MD5 SHA1 SHA512

platform_ex.ini

SHA256 54d6fd7843e3f87289a9fe2d849fae11abfa0b257299f07bfb39221a8e5dfe30
MD5 6074a774821288511b15112c4f0d21b4
SHA1 157ef0f1fdc4da7c6353f03dc157145097d2bd31
SHA512 ac552f7e857019005a0319aafedab1aa2653ff77826604eb0d2adc988cbed369908e29b097aa6cdbe54236e59ce0532bab5b26f9ca8ae9f66f145558d9009622
MD5 SHA1 SHA512

res.zip

SHA256 8b5c516c63ceaaba7e974c4d5b0893e1fa6f653659bccca27fa179c08c3e7467
MD5 b260c983938bcb9ae15e6576be5f1996
SHA1 aa0bf55fa64c95466e1f9cd5f4040bbe14927d99
SHA512 e7d51b955465abbb5c7fd698a88fbc0491595c640ecbcf0d987f1a6d17ab1c398e10a1263595ca82631450255a5d6e9e5c55843d37e6303eedefa1d842ca5489
SSDEEP 12288:0fyKWAAH4zSnohrQPQ38fFqhn2ufPSFcYgmI10ouirZofyKWAAH4zSnohvFTy:0ppM5oaVfFqF2uycY1kei1oppM5orTy
MD5 SHA1 SHA512 SSDEEP

background-4399.png

SHA256 8822a51216c7ce328c87b5178a82f993979bd684ca62694d718c3c6ca1b3af56
MD5 d036afee034210df1e1191630b36ecf8
SHA1 40e1e319971f99b27397989fc90d0b6c99aa4b50
SHA512 30b4fba3cddc1981ed971d5c681fa56f527f7984b3381c6e661459a59dfbf12a43215df04498d0696e700e0d0ac55675adbf4e8614f71c649d870aa78648c03b
SSDEEP 3072:enCdauYdJ/fhwW407ITMDdH7xUUVr05t8kkqigYgXODW8JA4yxITD1tD73E:0hn/fhwW407EMDdH7xU/5tRFwgXCJRy5
MD5 SHA1 SHA512 SSDEEP

background-battle.jpg

SHA256 6bf596d03287d1b3d55d7e8da8b2fb1750ddbec9531ca43fda2afc6c2065fad2
MD5 17ccc858258d5dcb63f20c6426b2842c
SHA1 850e8872bb4f93158948be106a95d41aa450773b
SHA512 7f2b4874f86aacbbfae63d59cfa1dc13cb16488e74b2be469379bb50a7dc31330d914cc3fa299f3c2d7bc50daf89b37475a83595d17ccba3c8145e18dc1a86d5
SSDEEP 6144:DgklsO1Gp2f/bu3f0p9ssh0U2uQujTSFizN7xegL6Ip1w+n4oSO9x:sklsOlmfZsht2uJPSF6sgmI/4oSW
MD5 SHA1 SHA512 SSDEEP

background.png

SHA256 8822a51216c7ce328c87b5178a82f993979bd684ca62694d718c3c6ca1b3af56
MD5 d036afee034210df1e1191630b36ecf8
SHA1 40e1e319971f99b27397989fc90d0b6c99aa4b50
SHA512 30b4fba3cddc1981ed971d5c681fa56f527f7984b3381c6e661459a59dfbf12a43215df04498d0696e700e0d0ac55675adbf4e8614f71c649d870aa78648c03b
SSDEEP 3072:enCdauYdJ/fhwW407ITMDdH7xUUVr05t8kkqigYgXODW8JA4yxITD1tD73E:0hn/fhwW407EMDdH7xU/5tRFwgXCJRy5
MD5 SHA1 SHA512 SSDEEP

bar-bg.png

SHA256 d13328951a1bd5030e3162bb241f0282a673e26730e260dd8abdb9cafb82dc15
MD5 557595b35869304e45d537f50c7568f0
SHA1 2d460258b0719456595c968d76404604ca99996e
SHA512 f7acfdffece476a3d9f7bff8fc8009fd6309f79e7bbd58b38be0757131faea4fefc7c85400a2ee780a5794e857f9039b639911f785fccbe4768c6330fff977dc
SSDEEP 96:FY7Y20aFVqZQZU91NgCW1oZjvKyWjwgVw5oF72rISMmZx:FY7yQ6KhGZ7ujwK8oF7fpmZx
MD5 SHA1 SHA512 SSDEEP

bar.png

SHA256 85a74ce9555a90cc6ccf61f0a4106f34936ff659ec16314f1e2db80c4d983aea
MD5 5a8505a2bb5a7f73aac515fd3596cae4
SHA1 e1da7da75d887ffb837dbf335c80eda0740e0239
SHA512 023e5d7ad7c68fdfe1f2ae87122b950f7b90ff68ca5dbe7be30ef0b826a6cbf6f05890aa7b41d337760ada98b5e0ab1568a1fe8a321dc84990eb3773f9ac38a1
MD5 SHA1 SHA512

black.png

SHA256 0f71c11669e37373e5893807e58127d2c350bb3d6049e5cb553ddb33ae8c9dc3
MD5 f896aa41257e8bad19c57c95a8e6c999
SHA1 2d048ce4dc1f011a92b3b605c155892cd2eb47c4
SHA512 1289b38f7c112073d83ee2756c6b6e36d51f55946f9276a83b992f316a97d64dd710e4fc9bcaa57896b8c73c451aadda0a77ee7c7a27cc5d697b0b1d16cc17e5
MD5 SHA1 SHA512

close.png

SHA256 a699adc474428a94ef1d29df2abcbdf97982e4141fa3f4b5df67420784833828
MD5 915b5cf3341ca7f40aa94f4d68bf35d1
SHA1 e0fea01de2d0f5c5d5780f8f1690d33ff80bfc25
SHA512 02d1347d59c6ab49e17d6984a89727b10a3455b26c588505f01da3a529f0719e0986f28da50f518df70d6c441c29132a616c086a3331cd7baa8c32ea9873b980
MD5 SHA1 SHA512

close_hover.png

SHA256 6a696c0a1cdc6c3b4769b2049db1de686d1afc82fdde09d2e40555014edb74ce
MD5 bb583871f6759d81aaefe62f4d4afea5
SHA1 4f3f64f0396232c2c0d9375041e3d3916e883a77
SHA512 71140d9d1371666c2548fa431dfe91394b651be5989fdb6c6049e345f623c52b6ea74d09adba0edb7b379f3078c5184cabdf617b990ac72d11d5b685a7ee5b06
MD5 SHA1 SHA512

launcher.xml

SHA256 d7d9b6a67b75aadd0105e31ce53921a18e617be2b7959c3d5a34cfd8d4e52236
MD5 43fc61ce0b00b04fc5a07cea71f1c17a
SHA1 3dff146234852b5212abde6b2b224bd58f985b36
SHA512 6c9cc6f0fb3e3a5282949b21b8c3ff6ad103e38411c226778ba4c1f7ab05c5b4b9ec9a8650d849628e01b0a2fa76c076d42578196ec1c412bd71d580d5b54cd8
MD5 SHA1 SHA512

launcher_4399.xml

SHA256 eb1588a8f319fe8ebbb723ecc12bced7268ff892735a80202bd72f402be28bf8
MD5 98b6f48a95b3be06d53edac1ce346d63
SHA1 85f2feb2eec5dd4c50d05b13101cf570ec8e1c5e
SHA512 ba2bf61d3a037ad3d914eb73ddf235a320c4dda51ab92aeb71dccf91dfbb8cac071e63b0bcb430a291165903b863a9b2a84ed517c3e9adb81ea0d7e4665c8352
MD5 SHA1 SHA512

launcher_battle.xml

SHA256 d995363eea5d2a6eef33b8c164ceb7a4bcff7ed87528cf6ef8f0f7a12c638e6a
MD5 cfed8b2f763cd1a1c6cf81366aea2d6b
SHA1 be40c272667f863bb92e4aca7824fb1621e8a1ef
SHA512 76d4e6019302d3c8b5a03cfa3e80703715f02cfc18ff6387df5d34505928ad94fb36f9044456e9521b32a650f9789be26d1d253aeb83c0df2b921f978a9a4a14
MD5 SHA1 SHA512

loading_battle.png

SHA256 d6619eff533c08905c56ef2c0cca6cee5cf07ca69623a2ca855b395121136baf
MD5 c36b41b2b3fe978d4633a671d758f6ff
SHA1 7b6c163dc5fc24f0518aa3d9562e7bb50e966168
SHA512 071ef12d2294a4f92612e8ce97971e9ce6abc6d2444663863392a54899a23fb4b9e8e4b0f2f7e9f4880284874d74a0044eb3577faf0fc4704bc58816f5d3e4ca
SSDEEP 384:LANxjJSsdqHLFyu9ScqhDRnaL8QtIvnmYVwsL:0Tj3wrou9lapSevnmYusL
MD5 SHA1 SHA512 SSDEEP

min.png

SHA256 b72d26fe721d8814a598188e4894d3596c9b89217a95915eb9ee691aef6e8c68
MD5 08c254337c9b4fb19dac41eb1d5d0f8b
SHA1 e7613dbd154774f163820e9865033d6da6e3ed52
SHA512 bfc6f7a739d786da864c4331418dfbd414e463c0c498b624220b1acc228dcc3717fa688cf9fe39d01cbde6327b5ff892c44ac7116c9685d5aca15198a6afe2c3
MD5 SHA1 SHA512

min_c.png

SHA256 b6719455d77de4a5403b2754b58ce4170bceb69eeac36fefe59e8c39e3269488
MD5 b2c74fcc294eaa14adfb4bfab39da0f1
SHA1 c28305d74cc60a47cc48be5b3d84ab321aeb49e1
SHA512 53cf6c05e0ecc10870d0a18a45e2fae80d7b9485d31219abc93fcfffbb01c8d53a8e24a467c8477c97f761cc90802bdecaf49d27851591ec6cadb2dc51cb015d
MD5 SHA1 SHA512

min_hover.png

SHA256 1106e7cb526a412c19cdaec988e6c95d6e341201a1104b6ee3a3056055d48d93
MD5 cbd8be1db147b6a89a7dfe09887d5d56
SHA1 9828714ad63d81d1cce1af39cfa245cba0bd3a1d
SHA512 04405d7c6cbe7c9f215bfb3ab0ae77883d8a6c2fcf0928f09052ee70377a41961e897f44471548ce61a5b4ad6beb2e0d5627a63934b5be8c1e3bd5f47afffbaf
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer

TruyKich.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/IpConfig.dll

kernel32

user32

ole32

oleaut32

generic

$PLUGINSDIR/StdUtils.dll

msvcrt

shlwapi

crypt32

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

WDlauncher.exe

PE Signature issue

ws2_32

psapi

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

gdiplus

imm32

iphlpapi

comctl32

wldap32

crypt32

generic

locales/bz

locales/jp

locales/na

locales/nabz

locales/tk

locales/tw

locales/viet

locales/zh-CN

platform.ini

platform_ex.ini

res.zip

background-4399.png

background-battle.jpg