d81f8841d655ea0b8bf771be8851230c740af163e8d8cfc617bb54118696266c

Sharing

Copy URL Twitter E-mail

General

Target

d81f8841d655ea0b8bf771be8851230c740af163e8d8cfc617bb54118696266c
Size

4.0MB
MD5

117ea6debf03de4ddc27bcfe0fa8f036
SHA1

d25a694abe9b4bf8da70b0c8f1fa74bb5600a47d
SHA256

d81f8841d655ea0b8bf771be8851230c740af163e8d8cfc617bb54118696266c
SHA512

e05ffb440c7a328f1438122364b9746bf621b181da86a22c38705d7d0935eec8956c661d537246fd41a9c072b94b144f1be6952a24f3c31b7d34ef9f3e1f58ff
SSDEEP

98304:c3J+RC1BWlYO0kkAEG/GwggitatTNvDUBMRR7+QWnMN:m1BZkmGHggitYT5DUBMRFlWm

Score

1^/10

Malware Config

Signatures

Files

d81f8841d655ea0b8bf771be8851230c740af163e8d8cfc617bb54118696266c
.zip
ProductInfo.dat
RunDll.exe
.exe windows:5 windows x86 arch:x86

491a909a888f345e4596a474c658b0a1

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:fd:3e:81:a2:3e:67:96:8b:af:99:9b:7a:1b:3b:bc
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/09/2020, 00:00

Not After

03/11/2021, 12:00

Subject

CN=成都奇鲁科技有限公司,O=成都奇鲁科技有限公司,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c3:77:dd:1b:88:8f:fc:2b:a4:e7:34:ca:3b:eb:78:91:de:5d:0a:87:2c:3e:66:1a:bf:e3:50:72:66:77:44:cf
Signer

Actual PE Digest

c3:77:dd:1b:88:8f:fc:2b:a4:e7:34:ca:3b:eb:78:91:de:5d:0a:87:2c:3e:66:1a:bf:e3:50:72:66:77:44:cf

Digest Algorithm

sha256

PE Digest Matches

true

1b:08:fd:ad:bf:c9:62:16:ed:a0:86:32:35:59:cd:1a:b7:72:f1:5b
Signer

Actual PE Digest

1b:08:fd:ad:bf:c9:62:16:ed:a0:86:32:35:59:cd:1a:b7:72:f1:5b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\build\lib_common\pop_popex\rundll\Release\RunDll.pdb

Imports

kernel32

GetCurrentProcess
RaiseException
GetCurrentThreadId
GetLastError
SetErrorMode
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
lstrcmpiW
LoadLibraryW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
VirtualProtect
GetCurrentProcessId
SetUnhandledExceptionFilter
HeapSetInformation
CloseHandle
IsBadReadPtr
SetEvent
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
DecodePointer
FindResourceExW
FindResourceW
SizeofResource
LoadResource
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
FlushFileBuffers
CreateThread
WaitForSingleObjectEx
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
WriteConsoleW
ReadConsoleW
HeapDestroy
LocalFree
WaitForSingleObject
LockResource
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
IsDebuggerPresent
OutputDebugStringW
GetVersionExW
GetFileSizeEx
ReadFile
SetFilePointer
CreateFileW
GetStringTypeW
FormatMessageW
EncodePointer
SetLastError
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetLocalTime
InitializeCriticalSection
ReleaseMutex
CreateMutexW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetFileAttributesExW
SetConsoleCtrlHandler
DeleteFileW
GetFileType
SetFilePointerEx
WriteFile
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetACP
GetCurrentThread
ResetEvent

user32

CharNextW
UnregisterClassW
DestroyWindow
DefWindowProcW
wsprintfW

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ord165
ShellExecuteExW
CommandLineToArgvW

ole32

CoTaskMemFree
CoUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize

oleaut32

VarUI4FromStr
SysFreeString

shlwapi

PathAppendW
PathIsRelativeW
PathRemoveFileSpecW
StrStrIA
StrStrIW
PathFileExistsW
SHGetValueW
PathCombineW

comctl32

InitCommonControlsEx

crypt32

CertGetNameStringW
CryptStringToBinaryA
CryptStringToBinaryW
CryptBinaryToStringA
CryptBinaryToStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 514KB - Virtual size: 514KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SoulDancer.exe
.exe windows:5 windows x86 arch:x86

79e6bc575f20a95d354de2a12428c062

Code Sign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:3a:9f:12:d7:27:bb:f0:11:99:e7:4e:0a:5c:7d:8a
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

30/10/2019, 00:00

Not After

03/11/2020, 12:00

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=Chengdu,ST=Sichuan,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a2:c3:d3:42:a0:5e:b5:82:18:9a:9b:19:2f:d4:8b
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09/11/2017, 00:00

Not After

08/11/2020, 23:59

Subject

SERIALNUMBER=91510100394487762T,CN=Chengdu Qilu Technology Co. Ltd.,OU=IT Dept,O=Chengdu Qilu Technology Co. Ltd.,L=chengdu,ST=sichuan,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130647616f78696e,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

31:36:cb:0e:c0:7a:d8:9d:57:0f:eb:65:16:dc:30:52:6d:c0:85:88:8e:47:39:d0:04:a2:0b:98:cf:d4:e6:d5
Signer

Actual PE Digest

31:36:cb:0e:c0:7a:d8:9d:57:0f:eb:65:16:dc:30:52:6d:c0:85:88:8e:47:39:d0:04:a2:0b:98:cf:d4:e6:d5

Digest Algorithm

sha256

PE Digest Matches

true

e4:04:c9:13:26:76:5d:06:45:06:8e:ed:b8:cc:7d:25:cf:75:ef:e7
Signer

Actual PE Digest

e4:04:c9:13:26:76:5d:06:45:06:8e:ed:b8:cc:7d:25:cf:75:ef:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\301051\out\Release\SoulDancer.pdb

Imports

user32

IsWindow
SendMessageW

kernel32

GetFileType
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
GetLastError
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
LoadLibraryA
InitializeCriticalSectionAndSpinCount

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Theme.ico
ThemeExtension.dll
.dll windows:5 windows x86 arch:x86

adbe758ed216aa8dcb48a64025c9b3de

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

84:b4:e8:e7:e6:bb:d2:6b:08:44:49:34:3f:28:f3:af:d1:51:db:61:9e:19:3b:a8:b3:2e:bb:91:67:95:13:92
Signer

Actual PE Digest

84:b4:e8:e7:e6:bb:d2:6b:08:44:49:34:3f:28:f3:af:d1:51:db:61:9e:19:3b:a8:b3:2e:bb:91:67:95:13:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\.jenkins\workspace\halodesk\ExplorerHook\bin\Release\ThemeExtension.pdb

Imports

kernel32

DeleteFileW
MultiByteToWideChar
CreateMutexW
WaitForSingleObject
ReleaseMutex
CreateEventW
SetEvent
CloseHandle
ResetEvent
ReadFile
SetNamedPipeHandleState
GetCurrentProcess
WriteFile
CreateNamedPipeW
WaitForMultipleObjects
CreateFileW
DisconnectNamedPipe
GetOverlappedResult
GetCurrentThreadId
WideCharToMultiByte
SwitchToThread
FlushFileBuffers
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
OutputDebugStringA
HeapQueryInformation
WriteConsoleW
ReadConsoleW
SetEndOfFile
SetStdHandle
LoadLibraryExW
DeleteCriticalSection
GetProcessHeap
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
ConnectNamedPipe
HeapFree
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStdHandle
GetACP
GetStringTypeW
ExitProcess
GetModuleFileNameA
GetSystemInfo
HeapValidate
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
LockResource
LocalFree
GetCurrentProcessId
InitializeCriticalSection
LoadResource
SizeofResource
FormatMessageW
FindResourceW
FindResourceExW
HeapCreate
Sleep
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
FreeLibrary
RtlUnwind
InterlockedFlushSList
GetModuleFileNameW
SetLastError
EncodePointer
TlsAlloc

user32

BeginPaint
CopyRect
GetMonitorInfoW
OffsetRect
ShowWindow
wsprintfW
SendMessageW
FillRect
EnumDisplayMonitors
SetWindowPos
FindWindowExW
SetWindowsHookExW
LockWindowUpdate
EndPaint
CallNextHookEx
WindowFromDC
GetWindowRect
GetParent
GetClassNameW
EnumWindows
UnhookWindowsHookEx

gdi32

CreateCompatibleDC
BitBlt

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

SHGetFolderPathW
ShellExecuteW

shlwapi

PathAppendW
StrStrIW
PathFileExistsW

dwmapi

DwmRegisterThumbnail
DwmUnregisterThumbnail
DwmUpdateThumbnailProperties

gdiplus

GdipCreateFromHDC
GdipFree
GdipDisposeImage
GdipDeleteGraphics
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectRect
GdipGetImageHeight
GdipLoadImageFromFile
GdiplusStartup
GdipAlloc

Sections

.text
Size: 343KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ThemeExtension64.dll
.dll windows:5 windows x64 arch:x64

738fb3dabc2bb75517a82037e0098202

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

20:ef:7a:c8:82:73:84:d7:1c:9e:1a:82:33:b0:10:09:c4:57:80:9c:a2:ae:df:b6:c3:a6:e5:d5:e5:d1:0f:d2
Signer

Actual PE Digest

20:ef:7a:c8:82:73:84:d7:1c:9e:1a:82:33:b0:10:09:c4:57:80:9c:a2:ae:df:b6:c3:a6:e5:d5:e5:d1:0f:d2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\.jenkins\workspace\halodesk\ExplorerHook\bin\Release\ThemeExtension64.pdb

Imports

kernel32

DeleteFileW
MultiByteToWideChar
CreateMutexW
WaitForSingleObject
ReleaseMutex
CreateEventW
SetEvent
CloseHandle
ResetEvent
ReadFile
SetNamedPipeHandleState
GetCurrentProcess
WriteFile
CreateNamedPipeW
WaitForMultipleObjects
CreateFileW
DisconnectNamedPipe
GetOverlappedResult
ConnectNamedPipe
WideCharToMultiByte
GetCurrentThreadId
SwitchToThread
FlushFileBuffers
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
OutputDebugStringA
HeapQueryInformation
WriteConsoleW
ReadConsoleW
SetEndOfFile
LoadLibraryExW
DeleteCriticalSection
GetProcessHeap
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStdHandle
GetACP
GetStringTypeW
ExitProcess
GetModuleFileNameA
HeapValidate
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
LockResource
LocalFree
GetCurrentProcessId
InitializeCriticalSection
LoadResource
SizeofResource
FormatMessageW
FindResourceW
FindResourceExW
HeapCreate
Sleep
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
FreeLibrary
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
GetModuleFileNameW
SetLastError
EncodePointer

user32

BeginPaint
CopyRect
GetMonitorInfoW
OffsetRect
ShowWindow
EndPaint
SendMessageW
FillRect
EnumDisplayMonitors
SetWindowPos
FindWindowExW
SetWindowsHookExW
LockWindowUpdate
wsprintfW
WindowFromDC
EnumWindows
CallNextHookEx
GetWindowRect
GetParent
GetClassNameW
UnhookWindowsHookEx

gdi32

CreateCompatibleDC
BitBlt

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

ShellExecuteW
SHGetFolderPathW

shlwapi

PathAppendW
PathFileExistsW
StrStrIW

dwmapi

DwmRegisterThumbnail
DwmUnregisterThumbnail
DwmUpdateThumbnailProperties

gdiplus

GdipCreateFromHDC
GdipFree
GdipDisposeImage
GdipDeleteGraphics
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectRect
GdipGetImageHeight
GdipLoadImageFromFile
GdiplusStartup
GdipAlloc

Sections

.text
Size: 424KB - Virtual size: 423KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ThemeHelper.dll
.dll windows:5 windows x86 arch:x86

303d818e40c237a3aea612a6b6b00e64

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

68:2d:ac:95:09:02:c7:52:e2:3b:3d:29:cf:62:0e:c5:0e:2a:e9:27:5e:da:d9:dc:03:77:18:16:4d:59:c3:79
Signer

Actual PE Digest

68:2d:ac:95:09:02:c7:52:e2:3b:3d:29:cf:62:0e:c5:0e:2a:e9:27:5e:da:d9:dc:03:77:18:16:4d:59:c3:79

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\build\desk\coral_halotheme\bin\Release\ThemeHelper.pdb

Imports

kernel32

HeapAlloc
HeapDestroy
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
WaitForSingleObject
CreateEventW
SetEvent
CloseHandle
ResetEvent
FindResourceW
ReadFile
SetNamedPipeHandleState
GetCurrentProcess
WriteFile
WaitForMultipleObjects
CreateFileW
GetOverlappedResult
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LoadResource
FindResourceExW
RaiseException
HeapReAlloc
LockResource
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
SizeofResource
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
IsDebuggerPresent

user32

CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__std_type_info_destroy_list
_except_handler4_common
__CxxFrameHandler3
memmove
memset
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
__stdio_common_vswprintf

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_configure_narrow_argv
_seh_filter_dll
_initialize_narrow_environment
_beginthreadex
_cexit
_invalid_parameter_noinfo_noreturn
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initterm_e
_errno
_initterm

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

Exports

Exports

StartHookMouse
StopHook

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebView.dll
.dll windows:5 windows x86 arch:x86

c0443fdc71d2040bd0026a43da503c2d

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dd:30:c3:e9:14:1f:ce:86:f1:4b:12:1d:a3:e6:d2:3e:c2:f0:b9:ad:d9:40:c1:ff:c3:25:61:e5:ec:be:e3:b4
Signer

Actual PE Digest

dd:30:c3:e9:14:1f:ce:86:f1:4b:12:1d:a3:e6:d2:3e:c2:f0:b9:ad:d9:40:c1:ff:c3:25:61:e5:ec:be:e3:b4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\.jenkins\workspace\webview\WebView\webview\Release\WebView.pdb

Imports

kernel32

SizeofResource
GetFileTime
CloseHandle
GetTickCount
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
OutputDebugStringW
FindResourceW
FindResourceExW
GetTempPathW
GetTempFileNameW
CreateFileW
SetFileAttributesW
DeleteFileW
CopyFileW
MoveFileW
MoveFileExW
MultiByteToWideChar
GetCurrentThreadId
OutputDebugStringA
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForMultipleObjects
CreateEventW
RegisterWaitForSingleObject
LoadResource
GetCurrentProcessId
GetFileSizeEx
GetLocalTime
FreeLibrary
ReleaseMutex
CreateMutexW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
CreateProcessW
RtlCaptureStackBackTrace
RaiseException
GetExitCodeProcess
OpenProcess
GetProcessHeap
SetEndOfFile
WriteConsoleW
SetStdHandle
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
UnregisterWait
GetLastError
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
FindFirstFileExW
FindFirstFileExA
FindClose
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetStdHandle
GetFileAttributesExW
CreateProcessA
GetACP
GetStringTypeW
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
ResumeThread
ExitThread
RtlUnwind
ResetEvent
WaitForMultipleObjectsEx
LockResource
DecodePointer
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
TryEnterCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
FormatMessageW
LoadLibraryExW
GetVersionExW
ReadFile
SetFilePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InterlockedExchangeAdd
WaitForSingleObjectEx
Sleep
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
VirtualProtect
SetProcessAffinityMask
DuplicateHandle
ReleaseSemaphore
InterlockedFlushSList

user32

PostMessageW
DefWindowProcW
CallWindowProcW
SendMessageTimeoutW
SendMessageW
UnregisterClassW
RegisterClassExW
CopyRect
WaitForInputIdle
LoadCursorW
FindWindowW
SetWindowLongW
GetWindowLongW
SetWindowTextW
DestroyWindow
IsWindow
CreateWindowExW
GetClassInfoExW

gdi32

GetTextExtentPoint32W
GetStockObject
DeleteObject
SelectObject

advapi32

RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCreateKeyW

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA
ord165
ShellExecuteW
ShellExecuteExW
SHGetFolderPathA
SHGetSpecialFolderPathW

ole32

CoInitialize
CoCreateGuid
StringFromGUID2
CoUninitialize

oleaut32

SysFreeString

shlwapi

PathCombineW
SHGetValueW
PathRemoveFileSpecW
PathFindFileNameW
PathFileExistsW
PathCanonicalizeW
PathAppendW
PathFindExtensionA
PathFindExtensionW
StrStrIW
PathCompactPathW
PathFindFileNameA
StrStrIA

psapi

GetModuleFileNameExW
EnumProcessModules

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CryptStringToBinaryA
CertGetNameStringW
CryptBinaryToStringA
CryptStringToBinaryW
CryptBinaryToStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

Exports

Exports

CreateMultiTabWebView
GetWebViewFactory
IWebViewToIWebViewEx
IsSupportedWebViewEngine

Sections

.text
Size: 990KB - Virtual size: 990KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shared
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
arctrl.dll
.dll windows:5 windows x86 arch:x86

89371d75b55fda7f792cb93cbb8f94e2

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:3a:9f:12:d7:27:bb:f0:11:99:e7:4e:0a:5c:7d:8a
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

30/10/2019, 00:00

Not After

03/11/2020, 12:00

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=Chengdu,ST=Sichuan,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a2:c3:d3:42:a0:5e:b5:82:18:9a:9b:19:2f:d4:8b
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09/11/2017, 00:00

Not After

08/11/2020, 23:59

Subject

SERIALNUMBER=91510100394487762T,CN=Chengdu Qilu Technology Co. Ltd.,OU=IT Dept,O=Chengdu Qilu Technology Co. Ltd.,L=chengdu,ST=sichuan,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130647616f78696e,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:e6:71:e0:c8:e9:0b:ad:50:20:b2:d0:72:c1:f6:a6:2d:b0:53:7f:54:13:7e:40:ea:20:9c:a8:1e:fd:e2:64
Signer

Actual PE Digest

58:e6:71:e0:c8:e9:0b:ad:50:20:b2:d0:72:c1:f6:a6:2d:b0:53:7f:54:13:7e:40:ea:20:9c:a8:1e:fd:e2:64

Digest Algorithm

sha256

PE Digest Matches

true

00:73:ef:7f:75:25:ab:2c:4e:da:af:a5:ab:87:f0:75:67:11:34:78
Signer

Actual PE Digest

00:73:ef:7f:75:25:ab:2c:4e:da:af:a5:ab:87:f0:75:67:11:34:78

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\build\lib_common\arctrl\Release\AutoPullCheck.pdb

Imports

kernel32

GetModuleHandleW
SetEvent
WaitForSingleObject
CloseHandle
CreateEventW
WideCharToMultiByte
GetProcessTimes
LoadLibraryW
SystemTimeToFileTime
GetTickCount
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentProcess
GetProcAddress
FreeLibrary
MultiByteToWideChar
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
DecodePointer
FindResourceExW
FindResourceW
SizeofResource
LoadResource
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LocalFree
OpenProcess
LockResource
IsDebuggerPresent
OutputDebugStringW
GetStringTypeW
EncodePointer
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
LoadLibraryExW
WriteFile
ReadFile
FlushFileBuffers
CreateFileW
InterlockedIncrement
InterlockedDecrement
DeleteFileW
GetCurrentProcessId
GetCurrentThreadId
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
QueryPerformanceCounter
InitializeSListHead
InterlockedCompareExchange
Sleep
FreeResource
GetSystemWindowsDirectoryW
GetVersionExW
DeviceIoControl
lstrcmpA
lstrcmpiA
GetSystemDirectoryW
CreateFileA
RtlUnwind
InterlockedFlushSList
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetFileType
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
ExitProcess
GetModuleFileNameA
GetACP
GetStdHandle
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
SetEndOfFile
ReadConsoleW
WriteConsoleW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA

user32

wsprintfW

shell32

SHGetSpecialFolderPathW
CommandLineToArgvW
ord165

shlwapi

SHSetValueA
SHGetValueW
PathCombineW
PathRemoveFileSpecW
PathAppendW
StrCmpIW
StrCmpNIW
StrStrIW
StrTrimA
StrStrIA
SHGetValueA
PathFileExistsW

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

DeleteUrlCacheEntryW
InternetGetConnectedState

iphlpapi

GetAdaptersInfo

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
OpenProcessToken
GetTokenInformation
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW

ole32

CoCreateGuid

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

Exports

Exports

CheckAutoRun
SetArParm

Sections

.text
Size: 302KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
guardhp.exe
.exe windows:5 windows x86 arch:x86

21e1587a1e37e8ad615ab80c237f9a1e

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b9:4c:82:ef:7b:c7:77:d2:20:93:ad:96:21:27:58:f7:48:fc:53:45:ae:cf:59:72:dc:97:60:f3:ba:21:2c:f2
Signer

Actual PE Digest

b9:4c:82:ef:7b:c7:77:d2:20:93:ad:96:21:27:58:f7:48:fc:53:45:ae:cf:59:72:dc:97:60:f3:ba:21:2c:f2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Jenkins\.jenkins\workspace\lib_common\guardhp\guardhp\Release\guardhp.pdb

Imports

gdiplus

GdipCreateBitmapFromStream
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipDrawImageRectRect
GdipFillRectangleI
GdipSetTextRenderingHint
GdipCreateSolidFill
GdipDeleteBrush
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdiplusShutdown
GdipGetImageWidth
GdiplusStartup
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImagePointRectI
GdipDrawImageRectRectI
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM

kernel32

RemoveDirectoryW
GlobalAddAtomW
GlobalFindAtomW
WriteConsoleW
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetACP
SetConsoleCtrlHandler
ExitProcess
GetTimeZoneInformation
GetConsoleCP
SetFilePointerEx
GetModuleHandleExW
ExitThread
RtlUnwind
VerifyVersionInfoA
GetSystemDirectoryA
VerSetConditionMask
PeekNamedPipe
ExpandEnvironmentStringsA
FormatMessageA
SleepEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
VirtualProtect
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
CreateSemaphoreW
WaitForMultipleObjectsEx
InitializeCriticalSectionEx
WaitNamedPipeW
GetSystemWindowsDirectoryW
FreeResource
CopyFileW
DosDateTimeToFileTime
LocalFileTimeToFileTime
GetShortPathNameW
VirtualFreeEx
VirtualAllocEx
GetComputerNameA
MoveFileExW
FindNextFileW
FindFirstFileW
GetFileAttributesExW
GetFileAttributesW
SetFileAttributesW
GetTempPathW
GetStartupInfoW
CreateProcessW
FindClose
DeviceIoControl
FlushFileBuffers
ReadFile
WriteFile
GetFileSize
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
SetLastError
WriteProcessMemory
LocalFree
TerminateProcess
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleFileNameW
CreateEventW
GetLocalTime
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentThreadId
CreateFileW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetVersionExW
GetModuleHandleW
WideCharToMultiByte
MultiByteToWideChar
GetLastError
QueryDosDeviceW
FindResourceExW
FindResourceW
LoadLibraryW
GetLogicalDriveStringsW
lstrlenW
CloseHandle
SizeofResource
LoadResource
GetCurrentProcessId
OpenProcess
GetLongPathNameW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
LockResource
FindFirstFileExW
OutputDebugStringW
SystemTimeToFileTime
GetSystemTime
SetFileTime
SetEndOfFile
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
GetEnvironmentVariableW
LoadLibraryA
GlobalMemoryStatus
GetFullPathNameW
GetCurrentDirectoryW
SetEnvironmentVariableA
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
GetFileType
GetStdHandle
InterlockedCompareExchange
InterlockedExchange
GetModuleFileNameA
CreateFileA
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
WaitForMultipleObjects
WaitForSingleObject
IsValidCodePage
GetOEMCP
GetCommandLineA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetFileSizeEx
FreeEnvironmentStringsW
OpenFileMappingW
GetCPInfo
GetLocaleInfoW
RaiseException
ReadProcessMemory
LCMapStringW
CompareStringW
GetCurrentThread
DuplicateHandle
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
GetEnvironmentStringsW
CreateDirectoryW
LoadLibraryExW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DecodePointer
GetCurrentProcess
GetTickCount
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCommandLineW
CreateMutexW
WaitForSingleObjectEx
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
Sleep
DeleteFileW
ReleaseMutex

user32

SetTimer
KillTimer
GetWindowLongW
SetWindowLongW
LoadCursorW
SendMessageTimeoutW
FindWindowExW
GetWindowThreadProcessId
SendMessageW
PostMessageW
FindWindowW
GetMessageW
IsWindow
DispatchMessageW
PeekMessageW
CharNextW
GetForegroundWindow
GetWindowRect
WindowFromPoint
GetDesktopWindow
GetShellWindow
GetWindow
MonitorFromPoint
GetMonitorInfoW
GetWindowInfo
GetAncestor
ShowWindow
UpdateLayeredWindow
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
OffsetRect
UnionRect
EqualRect
PtInRect
SetCursor
DrawFocusRect
SetWindowPos
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
DefWindowProcW
TranslateMessage
SetWinEventHook
IsWindowVisible
GetAsyncKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
FillRect
GetWindowTextLengthW
GetWindowTextW
DrawTextW
EnableWindow
GetFocus
PostQuitMessage
RegisterWindowMessageW
GetClassNameA
EnumWindows
GetWindowTextA
WaitForInputIdle
wsprintfW
SystemParametersInfoW
GetParent
CopyRect
ScreenToClient
GetClientRect
InvalidateRect
SetWindowRgn

gdi32

RectVisible
CreateFontW
SetViewportOrgEx
OffsetViewportOrgEx
EnumFontFamiliesW
ExtTextOutW
SetTextColor
SetBkMode
SetBkColor
GetStockObject
GetObjectW
CreateDIBSection
SelectObject
SelectClipRgn
SaveDC
RestoreDC
DeleteObject
DeleteDC
CreateRectRgnIndirect
CreateRectRgn
CreateCompatibleDC
CreateCompatibleBitmap
CombineRgn
BitBlt

advapi32

GetTokenInformation
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegCreateKeyExA
RegQueryValueExA
RegEnumKeyExA
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertSidToStringSidA
RegGetValueW
RegSetValueExA
LookupPrivilegeValueW
LookupAccountNameA
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegGetValueA
RegOpenKeyExA
OpenServiceW
OpenSCManagerW
DeleteService
ControlService
CloseServiceHandle
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptSetKeyParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
CryptExportKey

shell32

CommandLineToArgvW
SHGetSpecialFolderPathW
ord165
SHFileOperationW
SHCreateDirectoryExW
SHLoadInProc
ShellExecuteW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromString
CoCreateGuid
CreateStreamOnHGlobal
StringFromGUID2

oleaut32

VarUI4FromStr
SysFreeString
SysAllocString

shlwapi

StrTrimA
StrCmpNIW
PathRemoveFileSpecA
PathFileExistsA
SHGetValueA
StrStrIA
StrStrIW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
SHGetValueW
SHSetValueW
SHSetValueA
StrCmpIW
PathCombineW
PathIsDirectoryW
PathIsRelativeW
PathIsRootW
PathAppendA

comctl32

_TrackMouseEvent
InitCommonControlsEx

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

ws2_32

recv
freeaddrinfo
WSASetLastError
accept
bind
closesocket
connect
listen
setsockopt
socket
getaddrinfo
WSAGetLastError
ntohs
getsockopt
getsockname
ioctlsocket
WSACleanup
WSAStartup
shutdown
getnameinfo
__WSAFDIsSet
select
getpeername
htons
WSAIoctl
recvfrom
sendto
gethostname
send

netapi32

Netbios

crypt32

CryptStringToBinaryW
CryptStringToBinaryA
CertGetCertificateContextProperty
CryptBinaryToStringW
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetNameStringW
CertFreeCertificateContext

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

wldap32

ord33
ord35
ord79
ord30
ord27
ord200
ord301
ord50
ord60
ord211
ord46
ord217
ord143
ord32
ord22
ord41
ord26

rasapi32

RasGetConnectStatusW
RasEnumConnectionsW

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 656KB - Virtual size: 656KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
js_basic.dll
.dll windows:5 windows x86 arch:x86

578d49142ca93b339032c01a3b66db40

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a0:36:32:c3:10:8b:2a:e5:0f:2e:3d:f6:9e:15:7b:76:70:68:c8:8c:40:46:d0:bc:5c:a4:11:18:d4:c5:9e:ee
Signer

Actual PE Digest

a0:36:32:c3:10:8b:2a:e5:0f:2e:3d:f6:9e:15:7b:76:70:68:c8:8c:40:46:d0:bc:5c:a4:11:18:d4:c5:9e:ee

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\.jenkins\workspace\lib_common\js_basic\js_basic\js_basic\Release\js_basic.pdb

Imports

gdiplus

GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCloneImage
GdipAlloc
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectRect
GdipFree
GdipDrawImagePointRectI
GdiplusStartup
GdipDrawImageRectRectI

kernel32

GetTickCount
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
RaiseException
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
SetLastError
DecodePointer
GetExitCodeProcess
lstrlenW
lstrcmpW
WaitForMultipleObjects
CreateDirectoryW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
Sleep
CreateThread
CreateEventW
WaitForSingleObject
SetEvent
GetModuleFileNameW
WideCharToMultiByte
DeleteFileW
FindResourceExW
FindResourceW
GetModuleHandleW
LoadLibraryW
CloseHandle
SizeofResource
LoadResource
DeleteCriticalSection
GetSystemWindowsDirectoryW
FreeResource
InterlockedCompareExchange
CreateFileA
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
DeviceIoControl
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
LeaveCriticalSection
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
WriteConsoleW
ReadConsoleW
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetStdHandle
GetACP
GetModuleFileNameA
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
ExitThread
RtlUnwind
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
EnterCriticalSection
InitializeCriticalSection
GetLastError
GetCurrentProcess
OpenProcess
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
LockResource
MultiByteToWideChar
SetFileTime
SetFileAttributesW
InterlockedFlushSList
ReleaseSemaphore
DuplicateHandle
VirtualProtect
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
WaitForSingleObjectEx
InterlockedDecrement
FindFirstFileW
GetLongPathNameW
InterlockedIncrement
FlushFileBuffers
WriteFile
GetFileSize
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
QueryDosDeviceW
GetCommandLineA
EncodePointer
IsDebuggerPresent
OutputDebugStringW
SetFilePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
FormatMessageW
TryEnterCriticalSection
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
QueryPerformanceCounter
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
LocalFree
GetCurrentProcessId
ReleaseMutex
CreateMutexW
GetFileSizeEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateFileW
GetTempPathW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
LoadLibraryExW
GetVersionExW
ReadFile
GetLogicalDriveStringsW

user32

TranslateMessage
GetClassNameW
EnumWindows
SetParent
GetParent
SetFocus
LoadIconW
SetClassLongW
OffsetRect
SetWindowTextW
InvalidateRect
SetForegroundWindow
ReleaseCapture
IsZoomed
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DestroyWindow
PostQuitMessage
AttachThreadInput
MonitorFromWindow
DispatchMessageW
GetActiveWindow
GetWindowPlacement
SendMessageW
SystemParametersInfoW
LoadCursorW
SetWindowLongW
GetWindowLongW
CopyRect
GetClientRect
SetWindowRgn
EndPaint
BeginPaint
ReleaseDC
GetDC
KillTimer
SetTimer
SetWindowPos
UpdateLayeredWindow
ShowWindow
CreateWindowExW
MessageBoxW
RegisterClassExW
CallWindowProcW
DefWindowProcW
wsprintfW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetSystemMetrics
EnumDisplaySettingsW
RegisterClassW
UnregisterClassW
PostThreadMessageW
PeekMessageW
GetMessageW
IsWindowVisible
IsWindow
GetAncestor
GetWindowInfo
GetMonitorInfoW
MonitorFromPoint
GetWindow
GetWindowThreadProcessId
GetShellWindow
FindWindowW
GetDesktopWindow
WindowFromPoint
GetWindowRect
PostMessageW
SendMessageTimeoutW
GetForegroundWindow
FindWindowExW
GetClassInfoExW

gdi32

SetBkColor
SelectObject
GetDeviceCaps
BitBlt
CombineRgn
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgn
DeleteDC
DeleteObject
ExtTextOutW
SetViewportOrgEx

comdlg32

GetSaveFileNameW
CommDlgExtendedError

advapi32

RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
DuplicateTokenEx
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW

shell32

SHChangeNotify
SHCreateDirectoryExW
SHGetPathFromIDListW
ord165
SHGetSpecialFolderPathW
SHBrowseForFolderW
ShellExecuteW
SHFileOperationW

ole32

CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
CreateStreamOnHGlobal
CoCreateGuid

oleaut32

VariantClear
SysAllocString
SysFreeString

shlwapi

PathRemoveFileSpecW
StrStrIA
PathAppendW
PathFindFileNameW
StrCmpIW
SHGetValueW
StrCmpNIW
SHSetValueA
SHGetValueA
SHSetValueW
AssocQueryStringW
PathCombineW
PathIsRootW
StrTrimA
PathFileExistsW
StrStrIW
PathIsRelativeW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

Exports

Exports

GetWebWindowFactory

Sections

.text
Size: 733KB - Virtual size: 733KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mirror.ico
product_helper.dll
.dll windows:6 windows x86 arch:x86

d7b1c69b32d4bbee9882043e0009d7b5

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e1:7e:2d:68:2e:3c:53:95:74:47:f0:b6:f7:a7:f9:bc:f5:3a:56:bd:02:bf:77:5d:bc:33:b7:06:44:7e:9a:d7
Signer

Actual PE Digest

e1:7e:2d:68:2e:3c:53:95:74:47:f0:b6:f7:a7:f9:bc:f5:3a:56:bd:02:bf:77:5d:bc:33:b7:06:44:7e:9a:d7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\.jenkins\workspace\lib_common\product_helper\product_helper\target\i686-pc-windows-msvc\release\deps\product_helper.pdb

Imports

advapi32

RegQueryValueExW
SystemFunction036
RegCloseKey
RegOpenKeyExW

kernel32

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetModuleFileNameW
ReleaseMutex
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
GetProcAddress
TlsSetValue
TlsGetValue
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
CloseHandle
QueryPerformanceCounter
GetCurrentThreadId
GetStdHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
GetSystemTimeAsFileTime
QueryPerformanceFrequency
Sleep
GetModuleHandleA
InitializeCriticalSection
LeaveCriticalSection
FreeEnvironmentStringsW
FindClose
ReleaseSRWLockShared
CompareStringOrdinal
GetLastError
SwitchToThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetTempPathW
GetCommandLineW
WriteFile
FlushFileBuffers
DuplicateHandle
ReadFile
SetFilePointerEx
EnterCriticalSection
WaitForSingleObject
GetExitCodeProcess
TerminateProcess
CreateEventW
WaitForMultipleObjects
GetOverlappedResult
GetCurrentProcessId
TlsAlloc
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
AcquireSRWLockShared
FindNextFileW
CreateFileW
GetFileInformationByHandle
DeviceIoControl
CreateDirectoryW
CancelIo
DeleteCriticalSection
GetModuleHandleW
FormatMessageW
ExitProcess
CreateProcessW
CreateNamedPipeW
GetConsoleMode
WriteConsoleW
GetConsoleCP
SetStdHandle
HeapSize
GetStringTypeW
GetFileType
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
DecodePointer
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer

Exports

Exports

DllMain
free_str
get_activate_url
get_app
get_app_path
get_appdata_config_file_path
get_appdata_dir
get_cfg_center_detail_url
get_cfg_center_msg_wnd_class
get_cfg_center_single_mutex
get_cfg_center_stub_msg_wnd_class
get_cfg_center_ver_url
get_channel_id
get_config_file
get_default_stat_url
get_dump_url
get_general_value
get_install_date
get_install_dir
get_installed_prduct_id_list
get_prduct_id
get_product_info_ver
get_public_cfg_dir
get_service_name
get_service_path
get_services_url
get_short_app
get_short_name
rust_eh_personality

Sections

.text
Size: 567KB - Virtual size: 567KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
product_helper_x64.dll
.dll windows:6 windows x64 arch:x64

f71e281f510549a2f91a62e94375c57e

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:e6:41:47:09:92:f3:2d:d7:4f:cd:c0:ab:ed:4d:d1:b7:06:69:a6:64:4f:f3:bb:73:17:bd:02:4e:52:63:7e
Signer

Actual PE Digest

13:e6:41:47:09:92:f3:2d:d7:4f:cd:c0:ab:ed:4d:d1:b7:06:69:a6:64:4f:f3:bb:73:17:bd:02:4e:52:63:7e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\.jenkins\workspace\lib_common\product_helper\product_helper\target\release\deps\product_helper.pdb

Imports

advapi32

RegQueryValueExW
SystemFunction036
RegCloseKey
RegOpenKeyExW

kernel32

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetModuleFileNameW
ReleaseMutex
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
CloseHandle
GetCurrentThreadId
GetStdHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetModuleHandleA
InitializeCriticalSection
LeaveCriticalSection
FreeEnvironmentStringsW
FindClose
ReleaseSRWLockShared
CompareStringOrdinal
GetLastError
SwitchToThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetTempPathW
GetCommandLineW
WriteFile
FlushFileBuffers
DuplicateHandle
ReadFile
SetFilePointerEx
EnterCriticalSection
WaitForSingleObject
GetExitCodeProcess
TerminateProcess
CreateEventW
WaitForMultipleObjects
GetOverlappedResult
GetCurrentProcessId
TlsGetValue
TlsSetValue
TlsAlloc
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
AcquireSRWLockShared
FindNextFileW
CreateFileW
GetFileInformationByHandle
DeviceIoControl
CreateDirectoryW
CancelIo
DeleteCriticalSection
GetModuleHandleW
FormatMessageW
ExitProcess
CreateProcessW
CreateNamedPipeW
GetConsoleMode
WriteConsoleW
GetConsoleCP
SetStdHandle
HeapSize
GetStringTypeW
GetFileType
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
InitializeCriticalSectionAndSpinCount
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
EncodePointer

Exports

Exports

DllMain
free_str
get_activate_url
get_app
get_app_path
get_appdata_config_file_path
get_appdata_dir
get_cfg_center_detail_url
get_cfg_center_msg_wnd_class
get_cfg_center_single_mutex
get_cfg_center_stub_msg_wnd_class
get_cfg_center_ver_url
get_channel_id
get_config_file
get_default_stat_url
get_dump_url
get_general_value
get_install_date
get_install_dir
get_installed_prduct_id_list
get_prduct_id
get_product_info_ver
get_public_cfg_dir
get_service_name
get_service_path
get_services_url
get_short_app
get_short_name
rust_eh_personality

Sections

.text
Size: 604KB - Virtual size: 603KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

491a909a888f345e4596a474c658b0a1

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

03:fd:3e:81:a2:3e:67:96:8b:af:99:9b:7a:1b:3b:bcCertificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

c3:77:dd:1b:88:8f:fc:2b:a4:e7:34:ca:3b:eb:78:91:de:5d:0a:87:2c:3e:66:1a:bf:e3:50:72:66:77:44:cfSigner

1b:08:fd:ad:bf:c9:62:16:ed:a0:86:32:35:59:cd:1a:b7:72:f1:5bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

crypt32

wintrust

version

Sections

.text Size: 514KB - Virtual size: 514KB

.rdata Size: 123KB - Virtual size: 122KB

.data Size: 7KB - Virtual size: 14KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 25KB - Virtual size: 24KB

79e6bc575f20a95d354de2a12428c062

Code Sign

61:1c:b2:8a:00:00:00:00:00:26Certificate

Key Usages

0a:3a:9f:12:d7:27:bb:f0:11:99:e7:4e:0a:5c:7d:8aCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

68:a2:c3:d3:42:a0:5e:b5:82:18:9a:9b:19:2f:d4:8bCertificate

Extended Key Usages

Key Usages

33:90:20:77:61:c4:26:dd:94:50:03:0dCertificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

03:fd:3e:81:a2:3e:67:96:8b:af:99:9b:7a:1b:3b:bc
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

c3:77:dd:1b:88:8f:fc:2b:a4:e7:34:ca:3b:eb:78:91:de:5d:0a:87:2c:3e:66:1a:bf:e3:50:72:66:77:44:cf
Signer

1b:08:fd:ad:bf:c9:62:16:ed:a0:86:32:35:59:cd:1a:b7:72:f1:5b
Signer

.text
Size: 514KB - Virtual size: 514KB

.rdata
Size: 123KB - Virtual size: 122KB

.data
Size: 7KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 25KB - Virtual size: 24KB

61:1c:b2:8a:00:00:00:00:00:26
Certificate

0a:3a:9f:12:d7:27:bb:f0:11:99:e7:4e:0a:5c:7d:8a
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

68:a2:c3:d3:42:a0:5e:b5:82:18:9a:9b:19:2f:d4:8b
Certificate

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

31:36:cb:0e:c0:7a:d8:9d:57:0f:eb:65:16:dc:30:52:6d:c0:85:88:8e:47:39:d0:04:a2:0b:98:cf:d4:e6:d5
Signer

e4:04:c9:13:26:76:5d:06:45:06:8e:ed:b8:cc:7d:25:cf:75:ef:e7
Signer

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

84:b4:e8:e7:e6:bb:d2:6b:08:44:49:34:3f:28:f3:af:d1:51:db:61:9e:19:3b:a8:b3:2e:bb:91:67:95:13:92
Signer

.text
Size: 343KB - Virtual size: 343KB

.rdata
Size: 122KB - Virtual size: 121KB

.data
Size: 5KB - Virtual size: 10KB

.rsrc
Size: 1024B - Virtual size: 904B

.reloc
Size: 17KB - Virtual size: 17KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

20:ef:7a:c8:82:73:84:d7:1c:9e:1a:82:33:b0:10:09:c4:57:80:9c:a2:ae:df:b6:c3:a6:e5:d5:e5:d1:0f:d2
Signer