e275e8febf42d63d37ded05b4e6aacc1b36b9ace6318cd09d65b822037464c37

Sharing

Copy URL

Twitter E-mail

General

Target

e275e8febf42d63d37ded05b4e6aacc1b36b9ace6318cd09d65b822037464c37
Size

6.3MB
MD5

9190aaff6a444edb896ed5c228c26276
SHA1

e7a1745c17b141159e87a6d8ade23ac7815c74d9
SHA256

e275e8febf42d63d37ded05b4e6aacc1b36b9ace6318cd09d65b822037464c37
SHA512

aa75ce03ef8594f066ffc2d16e0658637a6d9544c81555b8199a4d17fd42e35980e8a676f9f5b700ba966f3563cdd4816714014bcf5533e42b16379540c9a6b8
SSDEEP

196608:z6xePNL9ONBrYuU7yBCiAYPnGjzJIerhV5Q:zAA99ONuC5AYPnYJIe1V5

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$SYSDIR/InterPass2000P11_s.dll
unpack002/$0/$8
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsExec.dll

Files

e275e8febf42d63d37ded05b4e6aacc1b36b9ace6318cd09d65b822037464c37
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11-12-2023 00:00

Not After

30-12-2024 23:59

Subject

SERIALNUMBER=9111000070003202XF,CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:45:c1:fb:ed:f1:bb:a4:ae:77:16:83:af:26:cc:d4:45:c1:44:6e:06:92:d7:04:4b:e1:af:6c:bd:9f:0a:01
Signer

Actual PE Digest

b4:45:c1:fb:ed:f1:bb:a4:ae:77:16:83:af:26:cc:d4:45:c1:44:6e:06:92:d7:04:4b:e1:af:6c:bd:9f:0a:01

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 676KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:5 windows x86 arch:x86

45d25ca52c312b2254c60dbcb30342d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynW
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 753B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CEA_Crypt.dll
.dll windows:4 windows x86 arch:x86

6e2260b809850e0def413542d0f68b21

Code Sign

19:9d:f8:72
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=Time-Stamping Authority WoSign,O=WoSign eCommerce Services Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2012 01:00

Not After

08-08-2027 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:3b:57:9f:1a:65:cb
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

12-11-2013 06:31

Not After

14-11-2014 04:48

Subject

CN=深圳手付通科技有限公司,O=深圳手付通科技有限公司,L=深圳市,ST=广东省,C=CN,1.2.840.113549.1.9.1=#0c107366745f68656c70403132362e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01-03-2011 01:00

Not After

01-03-2016 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17-09-2006 19:46

Not After

17-09-2036 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

94:99:fa:bc:87:f4:8e:47:10:53:59:b3:44:47:c2:ac:e0:8c:e2:38
Signer

Actual PE Digest

94:99:fa:bc:87:f4:8e:47:10:53:59:b3:44:47:c2:ac:e0:8c:e2:38

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileType
HeapFree
GetCommandLineA
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
HeapAlloc
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Exports

Exports

CEA_decrypt
CEA_encrypt
base64Decode
base64Encode

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/FTInitlize_bank.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

ccf0cfbb2fcc9b07080b154f4faf840b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11-12-2023 00:00

Not After

30-12-2024 23:59

Subject

SERIALNUMBER=9111000070003202XF,CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:49:45:ae:83:30:f4:52:01:ff:05:44:d2:27:f3:9f:08:58:87:8b:17:0b:36:31:20:55:88:2c:d8:87:5b:65
Signer

Actual PE Digest

d7:49:45:ae:83:30:f4:52:01:ff:05:44:d2:27:f3:9f:08:58:87:8b:17:0b:36:31:20:55:88:2c:d8:87:5b:65

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

mfc42

ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3401
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3670
ord561
ord825
ord3952
ord2724
ord6354
ord1216
ord1168
ord6467
ord1227
ord823
ord1877
ord4249
ord2486
ord2687
ord6364
ord3326
ord6365
ord4472
ord5498
ord3278
ord3353
ord3681
ord446
ord743
ord1177
ord1226
ord1210
ord2439
ord1693
ord5618
ord994
ord4342
ord4687
ord4639
ord5674
ord2156
ord4856
ord4920
ord6002
ord2137
ord1963
ord5213
ord2953
ord3868
ord5150
ord4705
ord4707
ord2876
ord2998
ord5649
ord4113
ord4661
ord4660
ord4768
ord4650
ord4903
ord4548
ord4521
ord4594
ord4988
ord4925
ord4930
ord4935
ord4659
ord4909
ord4908
ord4668
ord4667
ord4666
ord4648
ord4689
ord5023
ord4654
ord4643
ord4354
ord2554
ord4649
ord4637
ord4636
ord5060
ord4584
ord4371
ord4361
ord4356
ord4739
ord4741
ord4738
ord4409
ord4603
ord1131
ord4415
ord4992
ord4979
ord2488
ord3404
ord4539
ord2954
ord6055
ord4078
ord1776
ord4407
ord5241
ord2384
ord5163
ord6370
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2983
ord3148
ord3260
ord4466
ord2986
ord3080
ord4624
ord5825
ord723
ord3946
ord423
ord4006
ord2727
ord2730
ord2729
ord2860
ord2541
ord4949
ord641
ord2514
ord324
ord1601
ord800
ord2818
ord540
ord537
ord1892
ord4252
ord1212
ord4570
ord4672
ord4843
ord5011
ord5265
ord4376
ord4853
ord4998
ord4713
ord6052
ord1775
ord2385
ord6371
ord5286
ord4438
ord3279
ord4625
ord4425
ord449
ord746
ord2278
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord4486
ord6375
ord815
ord1575
ord1176
ord1116
ord1132
ord4780
ord5008

msvcrt

_strlwr
__CxxFrameHandler
memmove
??0exception@@QAE@ABV0@@Z
_adjust_fdiv
malloc
_initterm
strncpy
??0exception@@QAE@XZ
free
??1type_info@@UAE@XZ
_onexit
__dllonexit
_EH_prolog
??1exception@@UAE@XZ
_CxxThrowException

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
LocalAlloc
LocalFree

user32

FillRect
EnableWindow
PostMessageA

gdi32

GetStockObject
Ellipse

oleaut32

LoadRegTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/InterPass2000P11.dll
.dll windows:4 windows x86 arch:x86

e521f0de7833c7bff5e92107c3d20918

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11-12-2023 00:00

Not After

30-12-2024 23:59

Subject

SERIALNUMBER=9111000070003202XF,CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b0:11:c3:a1:68:cf:13:23:c0:0a:56:2f:b3:bd:9d:be:ea:84:f7:66:a4:83:9e:8f:b5:b1:85:35:1d:9c:a6:cc
Signer

Actual PE Digest

b0:11:c3:a1:68:cf:13:23:c0:0a:56:2f:b3:bd:9d:be:ea:84:f7:66:a4:83:9e:8f:b5:b1:85:35:1d:9c:a6:cc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertFreeCertificateContext
CertCreateCertificateContext
CryptDecodeObject
CertFindExtension
CertGetNameStringW
CertNameToStrA
CryptVerifyCertificateSignature
CertGetEnhancedKeyUsage

msimg32

AlphaBlend

msvcp60

?compare@?$char_traits@G@std@@SAHPBG0I@Z

mfc42u

ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord3733
ord561
ord815
ord3948
ord2717
ord942
ord940
ord537
ord858
ord5706
ord5679
ord538
ord2855
ord2559
ord3688
ord4128
ord4292
ord4124
ord2606
ord6770
ord941
ord6640
ord2567
ord4279
ord860
ord3605
ord656
ord4273
ord5784
ord922
ord2910
ord2385
ord665
ord1971
ord1560
ord5438
ord268
ord3313
ord5180
ord354
ord1172
ord6466
ord4118
ord3697
ord501
ord1083
ord613
ord289
ord536
ord2746
ord5596
ord2574
ord4396
ord3365
ord3635
ord693
ord2281
ord6896
ord5296
ord6898
ord3281
ord342
ord1240
ord1194
ord1563
ord1248
ord1250
ord1571
ord600
ord826
ord269
ord5777
ord540
ord3871
ord5568
ord800
ord3568
ord3701
ord3658
ord1634
ord5871
ord2406
ord3621
ord3614
ord4270
ord609
ord567
ord3569
ord4418
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord1115
ord6370
ord5157
ord2377
ord5237
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord4269
ord470
ord755
ord3084
ord2634
ord2078
ord1761
ord2810
ord4219
ord2293
ord773
ord4294
ord2859
ord6376
ord6193
ord4470
ord6211
ord4370
ord5949
ord5947
ord3087
ord5977
ord2294
ord795
ord3716
ord3397
ord2637
ord2371
ord6451
ord4704
ord4282
ord6330
ord4229
ord2362
ord324
ord861
ord1165
ord1143
ord641
ord3592
ord4419
ord5276
ord4401
ord1767
ord6048
ord2506
ord4992
ord4847
ord5261
ord283
ord323
ord1633
ord5781
ord640
ord3566
ord3591
ord5860
ord6057
ord5567
ord5575
ord5732
ord5674
ord5790
ord5785
ord5869
ord6168
ord6017
ord6185
ord4324
ord6182
ord5752
ord6188
ord5755
ord2966
ord2854
ord6003
ord472
ord4390
ord1768
ord4073
ord6051
ord823
ord1179
ord1570
ord1568
ord1173
ord6195

msvcrt

??1type_info@@UAE@XZ
memcpy
memset
__CxxFrameHandler
_EH_prolog
sprintf
wcslen
strcmp
wcscpy
_CxxThrowException
memmove
??0exception@@QAE@ABV0@@Z
strlen
strncpy
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcmp
wcscmp
strchr
_wcslwr
swprintf
_wcsicmp
rand
srand
time
wcsstr
toupper
difftime
_wcsupr
mbstowcs
strcpy
free
malloc
strstr
isprint
fclose
fwrite
_wfopen
fread
_wtol
_vsnprintf
strftime
localtime
strcat
_beginthreadex
_strcmpi
_endthreadex
_purecall
abs
_ftol
_strlwr
fgets
printf
_snprintf
fopen
sscanf
ftell
fseek
__dllonexit
_onexit
_initterm
_adjust_fdiv

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
lstrlenA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
IsBadReadPtr
TlsSetValue
DeleteFileW
GetTempPathW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TerminateThread
UnmapViewOfFile
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
InterlockedDecrement
InterlockedIncrement
ReleaseMutex
OpenMutexW
OpenEventW
GetVersionExW
GetSystemInfo
SetEvent
ResetEvent
FindResourceW
LoadResource
SizeofResource
LockResource
GlobalAlloc
ResumeThread
GlobalLock
GlobalUnlock
MulDiv
GlobalFree
CreateEventW
GetUserDefaultLangID
lstrcmpiW
SetLastError
GetStdHandle
SetConsoleTextAttribute
OutputDebugStringA
GetCurrentProcessId
GetFileSize
ReadFile
lstrcatW
MultiByteToWideChar
WideCharToMultiByte
CreateMutexW
GetProcessHeap
HeapAlloc
HeapFree
CompareFileTime
lstrlenW
GetSystemDirectoryW
GetShortPathNameW
lstrcmpW
VirtualQuery
GetModuleFileNameW
CreateFileW
WaitForMultipleObjects
DeviceIoControl
LoadLibraryW
FreeLibrary
TlsFree
TlsAlloc
GetModuleHandleW
GetProcAddress
lstrcpyW
GetCurrentProcess
ExitThread
Sleep
WaitForSingleObject
CloseHandle
GetCurrentThreadId
GetSystemDefaultLangID
GetTickCount
CreateThread
GetLastError
TlsGetValue
FormatMessageA
LocalFree
LocalAlloc

user32

EnableWindow
GrayStringW
DrawTextW
TabbedTextOutW
GetClientRect
SetWindowRgn
SetRect
CopyRect
FillRect
GetSysColor
SetWindowPos
MessageBoxW
IsWindowVisible
DialogBoxParamW
EndDialog
GetDlgItem
IsDlgButtonChecked
GetDlgItemTextW
CheckDlgButton
SetDlgItemTextW
UpdateWindow
CloseDesktop
GetDesktopWindow
SystemParametersInfoW
GetThreadDesktop
OpenDesktopW
CreateDesktopW
SetThreadDesktop
SwitchDesktop
GetMenuItemCount
SetMenuItemInfoW
GetWindowTextLengthW
SetWindowTextW
GetWindow
GetDlgCtrlID
GetClassNameW
DefWindowProcW
RegisterClassExW
UnregisterClassW
CreateWindowExW
ShowWindow
GetMessageW
TranslateMessage
DispatchMessageW
wsprintfW
ReleaseDC
GetDC
InflateRect
CallWindowProcW
GetPropW
GetParent
SetPropW
SetWindowLongW
RegisterWindowMessageW
FindWindowW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetFocus
GetSystemMetrics
InvalidateRect
GetKeyState
GetMenuItemInfoW
PtInRect
SetTimer
SendMessageW
KillTimer
SetFocus
ShowCursor
GetAsyncKeyState
GetKeyboardState
ToAscii
GetWindowTextW
GetWindowLongW
SetForegroundWindow
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
SetActiveWindow
GetWindowRect
SetDlgItemInt
IsWindow
PostMessageW
MoveWindow
LoadIconW

gdi32

Ellipse
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
GetStockObject
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateSolidBrush
Arc
CreateEllipticRgn
CreatePen
GetDeviceCaps
DeleteObject
DeleteDC
GetDIBits
CreateRectRgnIndirect
GetTextExtentPoint32W
PtVisible
CreateFontW

advapi32

RegOpenKeyExA
SetNamedSecurityInfoW
AllocateAndInitializeSid
EqualSid
LookupAccountSidW
FreeSid
GetLengthSid
CopySid
GetAclInformation
GetAce
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityInfo
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetSecurityInfo
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
OpenSCManagerW
CreateServiceW
OpenServiceW
DeleteService
StartServiceW
CloseServiceHandle
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
GetTokenInformation
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW

shell32

ShellExecuteExW
SHChangeNotify

ole32

CreateStreamOnHGlobal
CoCreateGuid

olepro32

ord251

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW

ws2_32

recv
send
shutdown
ioctlsocket
WSAGetLastError
accept
setsockopt
bind
listen
WSAStartup
gethostbyname
socket
connect
closesocket
select

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
C_CancelFunction
C_CloseAllSessions
C_CloseSession
C_CopyObject
C_CreateObject
C_Decrypt
C_DecryptDigestUpdate
C_DecryptFinal
C_DecryptInit
C_DecryptUpdate
C_DecryptVerifyUpdate
C_DeriveKey
C_DestroyObject
C_Digest
C_DigestEncryptUpdate
C_DigestFinal
C_DigestInit
C_DigestKey
C_DigestUpdate
C_Encrypt
C_EncryptFinal
C_EncryptInit
C_EncryptUpdate
C_Finalize
C_FindObjects
C_FindObjectsFinal
C_FindObjectsInit
C_GenerateKey
C_GenerateKeyPair
C_GenerateRandom
C_GetAttributeValue
C_GetFunctionList
C_GetFunctionStatus
C_GetInfo
C_GetMechanismInfo
C_GetMechanismList
C_GetObjectSize
C_GetOperationState
C_GetSessionInfo
C_GetSlotInfo
C_GetSlotList
C_GetTokenInfo
C_InitPIN
C_InitToken
C_Initialize
C_Login
C_Logout
C_OpenSession
C_SeedRandom
C_SetAttributeValue
C_SetOperationState
C_SetPIN
C_Sign
C_SignEncryptUpdate
C_SignFinal
C_SignInit
C_SignRecover
C_SignRecoverInit
C_SignUpdate
C_UnwrapKey
C_Verify
C_VerifyFinal
C_VerifyInit
C_VerifyRecover
C_VerifyRecoverInit
C_VerifyUpdate
C_WaitForSlotEvent
C_WrapKey
E_GetAuxFunctionList
E_SetTokenLabel
eb_RunNoElevated
eb_service

Sections

.text
Size: 648KB - Virtual size: 647KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ve_share
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/InterPass2000P11.sig
$SYSDIR/InterPass2000P11_s.dll
.dll windows:4 windows x86 arch:x86

894193b67f2a7c5e553d03c0be56f0cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

free
_adjust_fdiv
_initterm
malloc

advapi32

CryptHashData
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptImportKey
CryptDestroyHash
CryptDestroyKey
CryptVerifySignatureA

kernel32

lstrcmpiA
LoadLibraryA
FreeLibrary
SetLastError
GetFileSize
MapViewOfFile
DisableThreadLibraryCalls
GetModuleFileNameA
VirtualQuery
CloseHandle
lstrlenA
lstrcatA
lstrcpyA
GetProcAddress
GetProcessHeap
CreateFileMappingA
CreateFileA
GetSystemDirectoryA
UnmapViewOfFile
HeapFree
ReadFile
HeapAlloc

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 614B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/PassGuardCtrl.dll
.dll regsvr32 windows:5 windows x86 arch:x86

2e9ad455536ab95b227573a53a3652a2

Code Sign

19:9d:f8:72
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=Time-Stamping Authority WoSign,O=WoSign eCommerce Services Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2012 01:00

Not After

08-08-2027 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:3b:57:9f:1a:65:cb
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

12-11-2013 06:31

Not After

14-11-2014 04:48

Subject

CN=深圳手付通科技有限公司,O=深圳手付通科技有限公司,L=深圳市,ST=广东省,C=CN,1.2.840.113549.1.9.1=#0c107366745f68656c70403132362e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01-03-2011 01:00

Not After

01-03-2016 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17-09-2006 19:46

Not After

17-09-2036 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

2c:22:01:0d:d2:24:40:ca:26:63:e1:9c:e5:9e:50:a8:b7:ed:c3:29
Signer

Actual PE Digest

2c:22:01:0d:d2:24:40:ca:26:63:e1:9c:e5:9e:50:a8:b7:ed:c3:29

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
SetPriorityClass
DeviceIoControl
CreateFileA
GetLastError
SetEndOfFile
SetEnvironmentVariableA
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetStdHandle
LoadLibraryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleCP
GetStartupInfoW
SetHandleCount
GetLocaleInfoW
HeapDestroy
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LCMapStringW
GetCPInfo
CompareStringW
GetVersionExA
LoadLibraryA
GlobalMemoryStatus
QueryPerformanceCounter
FlushConsoleInputBuffer
GetStdHandle
GetFileType
GetModuleHandleA
GetThreadLocale
SetThreadLocale
WaitForSingleObject
lstrcpyW
TerminateThread
GetTickCount
GetCurrentProcessId
OpenProcess
lstrlenA
OutputDebugStringW
DebugBreak
WideCharToMultiByte
Sleep
LocalAlloc
LocalFree
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
SetLastError
GetModuleFileNameW
GetCurrentThreadId
GlobalAlloc
MulDiv
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InterlockedIncrement
GetVersion
InterlockedDecrement
FindResourceW
LoadResource
SizeofResource
CreateFileW
WriteFile
GetSystemDirectoryW
lstrcmpiW
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
lstrlenW
GetVersionExW
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
SetConsoleCtrlHandler
ExitProcess
GetCommandLineA
CloseHandle
CreateThread
ExitThread
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
GetStringTypeW
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
GlobalLock
GlobalUnlock
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
FreeLibrary
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
HeapSize
LoadLibraryA
GetLocaleInfoA
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

DrawEdge
ShowWindow
GetWindowLongW
IsWindowEnabled
KillTimer
SetWindowLongW
DestroyWindow
DefWindowProcW
CharNextW
MessageBoxA
SetCapture
SetTimer
GetClassInfoExW
GetCapture
DrawFocusRect
InflateRect
GetMenu
SystemParametersInfoW
GetDlgItem
CreateDialogParamW
AdjustWindowRectEx
ReleaseCapture
GetSystemMetrics
GetDlgCtrlID
UnregisterClassA
LoadCursorW
IsChild
SetFocus
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
LoadBitmapW
UpdateWindow
FillRect
GetSysColorBrush
GetWindowDC
DrawTextW
SetRectEmpty
LoadStringW
ClientToScreen
SendMessageW
SetWindowTextW
GetWindowRect
SetCursor
MoveWindow
MessageBoxW
CreateWindowExW
RegisterClassExW
GetKeyState
InvalidateRect
IsWindow
GetParent
GetFocus
UnionRect
PtInRect
CallWindowProcW
BeginPaint
GetClientRect
EndPaint
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
GetDC
ReleaseDC
MessageBoxW
CharUpperBuffW
wsprintfW

gdi32

GetDeviceCaps
GetObjectW
CreateCompatibleDC
BitBlt
CreateFontIndirectW
SetTextColor
SetBkMode
SetBkColor
CreateSolidBrush
SelectObject
DeleteObject
LPtoDP
SetMapMode
SetViewportOrgEx
DeleteDC
CreateDCW
CreateMetaFileW
SaveDC
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
SetTextAlign
TextOutW
CreateRectRgn
GetStockObject
GetPixel
CombineRgn

advapi32

QueryServiceStatus
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumKeyW
RegQueryValueExW
ControlService
StartServiceW
RegQueryInfoKeyW
DeleteService
CloseServiceHandle
OpenSCManagerW
CreateServiceW
OpenServiceW
QueryServiceConfigW
ChangeServiceConfigW
RegEnumKeyExW
RegOpenKeyExW

shell32

ShellExecuteExW

ole32

CreateDataAdviseHolder
WriteClassStm
OleSaveToStream
StringFromGUID2
ReadClassStm
OleRegGetUserType
OleRegGetMiscStatus
OleRegEnumVerbs
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CreateOleAdviseHolder

oleaut32

UnRegisterTypeLi
RegisterTypeLi
SysFreeString
VariantInit
VariantClear
OleTranslateColor
VariantCopy
VarUI4FromStr
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
SysStringLen
SysAllocString
LoadRegTypeLi
LoadTypeLi
OleCreatePropertyFrame

shlwapi

StrCmpIW
PathFileExistsW

iphlpapi

GetAdaptersInfo

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

comctl32

ImageList_Destroy
_TrackMouseEvent
ImageList_GetIconSize
ImageList_LoadImageW
ImageList_Draw

Exports

Exports

DecryptWKByKey
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
EncodeAmountByPK
EncryptAlphaPinByPK
EncryptDataByWK
EncryptLoginPinByPK
EncryptNumPinByPK
EncryptPin01ByPK
EncryptPin01ByWK
EncryptPin03ByPK
GenerateKeyByPk
ƪ;��Y(�=̙բ��l�: )5V�O^��HJ��h��_ѯqZ��`ĕC��w��d�1��7��P0w�D9oh��lm��٬�h|2~��IQX��Ql��ZԵ��EM�?Od6��)�ă@�q}D�l��n��H��y,~U��;�́[��&9��)5��A�`L "�@�d��dO�ZW��8�ݫ��i �l "��I\�*Z��2Pw��5��T��T��M��z~��l�m;Ј-cG��d�)�aȋJ�� jq��7�y�F�ʪ� H͑�G��!,%��;r��0KDET:�s��O�ƻh녠�a�8UNF��=MpB��(& �8D�A1�4�ͭ7;��7O=$:�p|�բw sBlƕ��=��Md;��Tr�֚hI�$��Y!��>�g� >��p��y�+��}W��?�(�B�,�G��g�H=��y΀h��ϒ��rOӨ�_)v� `�-�2\FY�PGp��d5ts�[�Q��F%Ҝ+�c��:��U��l��g�Ɉe�C1��wp��!#4;.�JO�F�n��?Y|�S�� ˫&��NK`DZ%�*�3��L=.�?�܁�c��H�L�-�@��U��z��8�E��J�X�"�lel��=��(|pFd ��"�~�x�ђ��Sƍ��q¬Ӆ��nX{2^��(C�h�:ߛ�F��X�W�ɏ��H"��}\u̟�iG{��4��1�|v�3��ⰻyF�(B�l ��wK�}b��R-Mkץ}R$��c��@7T؇wE�Ssd�O��J(ݮb��]s]��#�Ȼ��A5�ξ_�~��K��|g(Q�c(��9�(${��v��G�@bH)�L�P�� 9�5��˪[�6�7e�Z?��9��{�l]*� ��$��{�l��ޓ�(]��e�=�+�i��M�B�z�Yi��`��}>� Sœ��k�2�L�a#�/oB]��Td�F�@� ��`ġz*s��ܜY?enn��UBr��t�&��Y!̩ FH��Ч�O L�Z`"��b��^z��[;��e�>Gպ��v�R�**s�3�y��lV�l�y`�9��k�vTY{n$⑚�<_*Ӟ��Mu�f��à�/��Bq�o�3ON*��y�2��ݕ�b0Q^`)��L��}�3^��B� ��\/��K,� �`#Ҏ8X<_��vH6�@�zX43�D��$:&Ʒ&Ã��`�4�D�$>a!��S֩�c%��_�O�?��{BϷ*�~�J9@�q�Zl�%m�� y�E�^�3B�O�I�%�a`Cu�6ѽ� T1��>�%�4M��L?� �)�H��e��{ �MS��x��[��&�&]�m# ��g2�D�R��]�mk��*~/՗?E��'��*��1��k%��Qr�cQ� Ȉ�Ⲫ�@�=��+�Eϫ�aK��JJ��T��g�Rz/�K'�(,��ُ�2�>�΅��+ᐈ�̖>��y�y��e�?QP�)�N�{��. x��zW��=37�76J4x��@�`ï��>�k"��l�픫��B70��ELy3��ו�UO�ч�wL3r��;b3/��b�%�|8�:F��d�fC��v� ��]p��lBig�7ܶhP o��3m{t_ש��Q��_��",�#�� b9�m�C�C"q��Q�$��O�$?Zx�:�k��MIS��5�e��+*o+Z�y��"�CѣR$� ��=\ 9R��i�~i��q*��y�` 2� ^&|C��P�l܉�H+��u$P$��B�HѲBCT_�n�?3/j(��~�Aʀe��C��瑻 $��jbQ8<��q�|�߶��`^��w��@�M��E��i]�a��=��N�d�4+P��.�\��޼V��h*e6�wZ�" � F�Zi�QռėY�ʏd��J~c_��i4� q3v*��4� �|R/ �{�[�>��L��4�ӹʏ��ң�[_Bj��R5'AM��7�~&/��)�Pw��1��D¶�=�ɥ{+6�� W| x%RsJȷ��`L�,�ba��1��`�J���G�(�)N4��@��*��Y�O&�xW��&�®��I�/;#A�MpY >ʝ��^�p��bf��D&�B-�.�/Pn�.�<NH*��|��O]��-��N��1��Bh�@��>&٤Q*�٩��&t�XA�df��D~��V̈́�V^� �uv�sa��#�4�Ɩ��i��*|G\��@,jfl�9� B��l�.ʂ�_�P�98�m�C��]�C�ct�=t�2�ӳw�i��Ö��;�ZAo�0�켕��0��%�m��.dnW��͜V�J�+��ֆ� '.�z˵�MdNeF�hM��h}4�ɼ�㏂��(�ew��j�v\�� ?I`�w=��i4��kF��N��Ve>��A��¥�o��z쫣(��>Tm� ��˂�YkQ�xI��Ƽ� �ۀ��k�F�?��G��==�iO�C۩��iO��7��,B��)xH�g��v�V �L�xK�Ht!�q�@�VM��.O��2��l�m��M"�@�N��k!@�Tf^��L�c�Լfy��e�.ҹ@8)np\Ln�7��ٟ��6��K�n��^.�wh�b� ��/�F��kK��7��y�c$[R��@�ͽ�G�k(۲;�Kz@HK�LA<G>l��#oKR`�k��3Uגe��٩x�1��k�?��pdhƩ-�I�`��/�Z6�,,ѝA/��J�]f�c��[&��U�Բ}g��˫J��{p�4^�A�2>�{I,$г�vL�.A�$'@�XsgQY7n+�B��yrH� ��IM��U��n�I'�j�

Sections

.text
Size: 660KB - Virtual size: 660KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mic0
Size: 915KB - Virtual size: 915KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mic1
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/PassGuardCtrl.inf
$SYSDIR/PassGuardCtrlForYBXY/PassGuardCtrl.dll
.dll regsvr32 windows:5 windows x86 arch:x86

2e9ad455536ab95b227573a53a3652a2

Code Sign

19:9d:f8:72
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=Time-Stamping Authority WoSign,O=WoSign eCommerce Services Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2012 01:00

Not After

08-08-2027 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:3b:57:9f:1a:65:cb
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

12-11-2013 06:31

Not After

14-11-2014 04:48

Subject

CN=深圳手付通科技有限公司,O=深圳手付通科技有限公司,L=深圳市,ST=广东省,C=CN,1.2.840.113549.1.9.1=#0c107366745f68656c70403132362e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01-03-2011 01:00

Not After

01-03-2016 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17-09-2006 19:46

Not After

17-09-2036 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

2c:22:01:0d:d2:24:40:ca:26:63:e1:9c:e5:9e:50:a8:b7:ed:c3:29
Signer

Actual PE Digest

2c:22:01:0d:d2:24:40:ca:26:63:e1:9c:e5:9e:50:a8:b7:ed:c3:29

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
SetPriorityClass
DeviceIoControl
CreateFileA
GetLastError
SetEndOfFile
SetEnvironmentVariableA
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetStdHandle
LoadLibraryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleCP
GetStartupInfoW
SetHandleCount
GetLocaleInfoW
HeapDestroy
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LCMapStringW
GetCPInfo
CompareStringW
GetVersionExA
LoadLibraryA
GlobalMemoryStatus
QueryPerformanceCounter
FlushConsoleInputBuffer
GetStdHandle
GetFileType
GetModuleHandleA
GetThreadLocale
SetThreadLocale
WaitForSingleObject
lstrcpyW
TerminateThread
GetTickCount
GetCurrentProcessId
OpenProcess
lstrlenA
OutputDebugStringW
DebugBreak
WideCharToMultiByte
Sleep
LocalAlloc
LocalFree
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
SetLastError
GetModuleFileNameW
GetCurrentThreadId
GlobalAlloc
MulDiv
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InterlockedIncrement
GetVersion
InterlockedDecrement
FindResourceW
LoadResource
SizeofResource
CreateFileW
WriteFile
GetSystemDirectoryW
lstrcmpiW
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
lstrlenW
GetVersionExW
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
SetConsoleCtrlHandler
ExitProcess
GetCommandLineA
CloseHandle
CreateThread
ExitThread
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
GetStringTypeW
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
GlobalLock
GlobalUnlock
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
FreeLibrary
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
HeapSize
LoadLibraryA
GetLocaleInfoA
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

DrawEdge
ShowWindow
GetWindowLongW
IsWindowEnabled
KillTimer
SetWindowLongW
DestroyWindow
DefWindowProcW
CharNextW
MessageBoxA
SetCapture
SetTimer
GetClassInfoExW
GetCapture
DrawFocusRect
InflateRect
GetMenu
SystemParametersInfoW
GetDlgItem
CreateDialogParamW
AdjustWindowRectEx
ReleaseCapture
GetSystemMetrics
GetDlgCtrlID
UnregisterClassA
LoadCursorW
IsChild
SetFocus
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
LoadBitmapW
UpdateWindow
FillRect
GetSysColorBrush
GetWindowDC
DrawTextW
SetRectEmpty
LoadStringW
ClientToScreen
SendMessageW
SetWindowTextW
GetWindowRect
SetCursor
MoveWindow
MessageBoxW
CreateWindowExW
RegisterClassExW
GetKeyState
InvalidateRect
IsWindow
GetParent
GetFocus
UnionRect
PtInRect
CallWindowProcW
BeginPaint
GetClientRect
EndPaint
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
GetDC
ReleaseDC
MessageBoxW
CharUpperBuffW
wsprintfW

gdi32

GetDeviceCaps
GetObjectW
CreateCompatibleDC
BitBlt
CreateFontIndirectW
SetTextColor
SetBkMode
SetBkColor
CreateSolidBrush
SelectObject
DeleteObject
LPtoDP
SetMapMode
SetViewportOrgEx
DeleteDC
CreateDCW
CreateMetaFileW
SaveDC
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
SetTextAlign
TextOutW
CreateRectRgn
GetStockObject
GetPixel
CombineRgn

advapi32

QueryServiceStatus
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumKeyW
RegQueryValueExW
ControlService
StartServiceW
RegQueryInfoKeyW
DeleteService
CloseServiceHandle
OpenSCManagerW
CreateServiceW
OpenServiceW
QueryServiceConfigW
ChangeServiceConfigW
RegEnumKeyExW
RegOpenKeyExW

shell32

ShellExecuteExW

ole32

CreateDataAdviseHolder
WriteClassStm
OleSaveToStream
StringFromGUID2
ReadClassStm
OleRegGetUserType
OleRegGetMiscStatus
OleRegEnumVerbs
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CreateOleAdviseHolder

oleaut32

UnRegisterTypeLi
RegisterTypeLi
SysFreeString
VariantInit
VariantClear
OleTranslateColor
VariantCopy
VarUI4FromStr
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
SysStringLen
SysAllocString
LoadRegTypeLi
LoadTypeLi
OleCreatePropertyFrame

shlwapi

StrCmpIW
PathFileExistsW

iphlpapi

GetAdaptersInfo

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

comctl32

ImageList_Destroy
_TrackMouseEvent
ImageList_GetIconSize
ImageList_LoadImageW
ImageList_Draw

Exports

Exports

DecryptWKByKey
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
EncodeAmountByPK
EncryptAlphaPinByPK
EncryptDataByWK
EncryptLoginPinByPK
EncryptNumPinByPK
EncryptPin01ByPK
EncryptPin01ByWK
EncryptPin03ByPK
GenerateKeyByPk
ƪ;��Y(�=̙բ��l�: )5V�O^��HJ��h��_ѯqZ��`ĕC��w��d�1��7��P0w�D9oh��lm��٬�h|2~��IQX��Ql��ZԵ��EM�?Od6��)�ă@�q}D�l��n��H��y,~U��;�́[��&9��)5��A�`L "�@�d��dO�ZW��8�ݫ��i �l "��I\�*Z��2Pw��5��T��T��M��z~��l�m;Ј-cG��d�)�aȋJ�� jq��7�y�F�ʪ� H͑�G��!,%��;r��0KDET:�s��O�ƻh녠�a�8UNF��=MpB��(& �8D�A1�4�ͭ7;��7O=$:�p|�բw sBlƕ��=��Md;��Tr�֚hI�$��Y!��>�g� >��p��y�+��}W��?�(�B�,�G��g�H=��y΀h��ϒ��rOӨ�_)v� `�-�2\FY�PGp��d5ts�[�Q��F%Ҝ+�c��:��U��l��g�Ɉe�C1��wp��!#4;.�JO�F�n��?Y|�S�� ˫&��NK`DZ%�*�3��L=.�?�܁�c��H�L�-�@��U��z��8�E��J�X�"�lel��=��(|pFd ��"�~�x�ђ��Sƍ��q¬Ӆ��nX{2^��(C�h�:ߛ�F��X�W�ɏ��H"��}\u̟�iG{��4��1�|v�3��ⰻyF�(B�l ��wK�}b��R-Mkץ}R$��c��@7T؇wE�Ssd�O��J(ݮb��]s]��#�Ȼ��A5�ξ_�~��K��|g(Q�c(��9�(${��v��G�@bH)�L�P�� 9�5��˪[�6�7e�Z?��9��{�l]*� ��$��{�l��ޓ�(]��e�=�+�i��M�B�z�Yi��`��}>� Sœ��k�2�L�a#�/oB]��Td�F�@� ��`ġz*s��ܜY?enn��UBr��t�&��Y!̩ FH��Ч�O L�Z`"��b��^z��[;��e�>Gպ��v�R�**s�3�y��lV�l�y`�9��k�vTY{n$⑚�<_*Ӟ��Mu�f��à�/��Bq�o�3ON*��y�2��ݕ�b0Q^`)��L��}�3^��B� ��\/��K,� �`#Ҏ8X<_��vH6�@�zX43�D��$:&Ʒ&Ã��`�4�D�$>a!��S֩�c%��_�O�?��{BϷ*�~�J9@�q�Zl�%m�� y�E�^�3B�O�I�%�a`Cu�6ѽ� T1��>�%�4M��L?� �)�H��e��{ �MS��x��[��&�&]�m# ��g2�D�R��]�mk��*~/՗?E��'��*��1��k%��Qr�cQ� Ȉ�Ⲫ�@�=��+�Eϫ�aK��JJ��T��g�Rz/�K'�(,��ُ�2�>�΅��+ᐈ�̖>��y�y��e�?QP�)�N�{��. x��zW��=37�76J4x��@�`ï��>�k"��l�픫��B70��ELy3��ו�UO�ч�wL3r��;b3/��b�%�|8�:F��d�fC��v� ��]p��lBig�7ܶhP o��3m{t_ש��Q��_��",�#�� b9�m�C�C"q��Q�$��O�$?Zx�:�k��MIS��5�e��+*o+Z�y��"�CѣR$� ��=\ 9R��i�~i��q*��y�` 2� ^&|C��P�l܉�H+��u$P$��B�HѲBCT_�n�?3/j(��~�Aʀe��C��瑻 $��jbQ8<��q�|�߶��`^��w��@�M��E��i]�a��=��N�d�4+P��.�\��޼V��h*e6�wZ�" � F�Zi�QռėY�ʏd��J~c_��i4� q3v*��4� �|R/ �{�[�>��L��4�ӹʏ��ң�[_Bj��R5'AM��7�~&/��)�Pw��1��D¶�=�ɥ{+6�� W| x%RsJȷ��`L�,�ba��1��`�J���G�(�)N4��@��*��Y�O&�xW��&�®��I�/;#A�MpY >ʝ��^�p��bf��D&�B-�.�/Pn�.�<NH*��|��O]��-��N��1��Bh�@��>&٤Q*�٩��&t�XA�df��D~��V̈́�V^� �uv�sa��#�4�Ɩ��i��*|G\��@,jfl�9� B��l�.ʂ�_�P�98�m�C��]�C�ct�=t�2�ӳw�i��Ö��;�ZAo�0�켕��0��%�m��.dnW��͜V�J�+��ֆ� '.�z˵�MdNeF�hM��h}4�ɼ�㏂��(�ew��j�v\�� ?I`�w=��i4��kF��N��Ve>��A��¥�o��z쫣(��>Tm� ��˂�YkQ�xI��Ƽ� �ۀ��k�F�?��G��==�iO�C۩��iO��7��,B��)xH�g��v�V �L�xK�Ht!�q�@�VM��.O��2��l�m��M"�@�N��k!@�Tf^��L�c�Լfy��e�.ҹ@8)np\Ln�7��ٟ��6��K�n��^.�wh�b� ��/�F��kK��7��y�c$[R��@�ͽ�G�k(۲;�Kz@HK�LA<G>l��#oKR`�k��3Uגe��٩x�1��k�?��pdhƩ-�I�`��/�Z6�,,ѝA/��J�]f�c��[&��U�Բ}g��˫J��{p�4^�A�2>�{I,$г�vL�.A�$'@�XsgQY7n+�B��yrH� ��IM��U��n�I'�j�

Sections

.text
Size: 660KB - Virtual size: 660KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mic0
Size: 915KB - Virtual size: 915KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mic1
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/PassGuardCtrlForYBXY/PassGuardCtrl.inf
$SYSDIR/PassGuardCtrlForYBXY/passguardwin7ins.exe
.exe windows:5 windows x86 arch:x86

190ee72e6b20b1938f1aba668a774940

Code Sign

19:9d:f8:72
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=Time-Stamping Authority WoSign,O=WoSign eCommerce Services Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2012 01:00

Not After

08-08-2027 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:3b:57:9f:1a:65:cb
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

12-11-2013 06:31

Not After

14-11-2014 04:48

Subject

CN=深圳手付通科技有限公司,O=深圳手付通科技有限公司,L=深圳市,ST=广东省,C=CN,1.2.840.113549.1.9.1=#0c107366745f68656c70403132362e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01-03-2011 01:00

Not After

01-03-2016 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17-09-2006 19:46

Not After

17-09-2036 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

32:23:bc:a1:98:8a:e6:59:e3:1c:1e:8b:98:0e:c0:70:10:09:ca:ba
Signer

Actual PE Digest

32:23:bc:a1:98:8a:e6:59:e3:1c:1e:8b:98:0e:c0:70:10:09:ca:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\workdriver\workspace\PassGuardCtrl_14.0_pin\Release\passguardwin7ins.pdb

Imports

kernel32

GetCurrentProcess
GetModuleHandleW
WriteFile
GetSystemDirectoryW
LoadResource
GetProcAddress
LockResource
FindResourceW
FreeResource
LocalFree
GetVersion
CloseHandle
DeviceIoControl
LocalAlloc
GetLastError
CreateFileW
SizeofResource
Sleep
FlushFileBuffers
IsProcessorFeaturePresent
GetStringTypeW
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
RtlUnwind
HeapAlloc
HeapReAlloc
LoadLibraryW
SetStdHandle
WriteConsoleW
LCMapStringW

user32

MessageBoxW

advapi32

ControlService
ChangeServiceConfigW
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
QueryServiceConfigW

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 461KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/PassGuardX64ForYBXY/PassGuardX64.dll
.dll regsvr32 windows:5 windows x64 arch:x64

f3489b7aea9097013de1e233e0339711

Code Sign

19:9d:f8:72
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=Time-Stamping Authority WoSign,O=WoSign eCommerce Services Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2012 01:00

Not After

08-08-2027 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:3b:57:9f:1a:65:cb
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

12-11-2013 06:31

Not After

14-11-2014 04:48

Subject

CN=深圳手付通科技有限公司,O=深圳手付通科技有限公司,L=深圳市,ST=广东省,C=CN,1.2.840.113549.1.9.1=#0c107366745f68656c70403132362e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01-03-2011 01:00

Not After

01-03-2016 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17-09-2006 19:46

Not After

17-09-2036 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

52:9f:3d:eb:2d:46:87:cc:f3:4c:c1:0f:86:08:c1:66:9d:4b:ba:d8
Signer

Actual PE Digest

52:9f:3d:eb:2d:46:87:cc:f3:4c:c1:0f:86:08:c1:66:9d:4b:ba:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

OpenThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

BeginPaint

gdi32

SetTextAlign

advapi32

RegOpenKeyExW

shell32

ShellExecuteExW

ole32

OleSaveToStream

oleaut32

VariantChangeType

shlwapi

StrCmpIW

iphlpapi

GetAdaptersInfo

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW

comctl32

ImageList_LoadImageW

Exports

Exports

DecryptWKByKey
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
EncodeAmountByPK
EncryptAlphaPinByPK
EncryptDataByWK
EncryptLoginPinByPK
EncryptNumPinByPK
EncryptPin01ByPK
EncryptPin01ByWK
EncryptPin03ByPK
GenerateKeyByPk
ҟYeb��_o��N=t��rq��F��Qb��3�03��p��Q��ɷ�м�$�� `�a[]xl��=1\�j�;�Ef�,�wD}MB�.��ٶ��ld��i�b��ʚ[a�T��1��暲��N�7�=��R�:�V��M �4��B�׿f��Mp�qG��qT�i��c��'��4d�|��1�GZT��N�t�Y^g} � �� if��E��!3��L-�^�� u`e��1��D��7ԋ�<�Wq��P��xI�[�H��h�Q��&=_�a {�b��u��i}ؿ�_ZNK`�O�e��q��H��P�{v�8�ZȎ'ϧZu��5]�=ho �� \7tL��<��ڠci��;�N�y��,�mݟ�&�Uxf;&�� &o#�wHW`��U��b��ы�eC;��/�eL� qXX��C��5�w}�o_<�6��h��lB6��C��.�h�kXW)��w��#5��O�p�w]�R^k ��`1�o&�9�Pq��Nm&V�t��>�Y��!��hPh�j�$��Уt&:��~��I�u�'��L�:0Hg�A|�4��QN�W��Tp4�^b�HƋ**ɏ&⻼��"#�p羴��D�0f1��ߚ��w� �� I�fnTQs�7�lYׇ�GB�D��Go�8p��,�1y3a�k��s��T��e1c�/&�̭+��}F�sG82�/�S��i\��њ�q ��+Yp�Z�@խt�*Lk��x��%:8��9��-��lkt&r��I|2?��767��3�@�+0�w�Kvя{�Uy�zt��~^9n �b��uJ�<g.1��3�K�HD��~wV��3��M��k��F�d��c�Bְ�6 (đ< 2`��`�[2��_ŜN�V��f�`$�4 ~ȼ�(Ǵ�+�+�Y� �QF7V��#��T !�pS�l.��Kk��h��ڍ@S q��b}G薱,��*��.��e��6bs[��"��lw{Ԃ��Pnq�]~e.<��3 ��3F�"a�r��%��m0�)1��ޚ �L�Q��0��h`��i'#ܵEE/,J�դ�N�;��)}�;g�)��?�s��^A;0��cظ�1L��@�Y!��C��Z�kI�8�bf�$9k��xwvN��2�� D]z��y��+�K0��-��U�۞2��"O��0�� #��kC5��촀'j�ę��_S1�u5Kۛ�G�Cg�]j�T:�NI4#��Xdx#>�2>Ɛ�ѿ�?%��#D � �� 97�]�.i�6�I��c&�1�/b��ʉ��l}��$��+��ǹU�7U:��[b��-��`�d-�OD�ҺuD8jfK��G?` I�#�M��m_n��Kz��UhJ�[p��|[K��rp��$��!��m�T��̳� �-��ñ�f��V2�jn�\��$ �|�#�M��\�%��%��|�u�Y[��[� ��a�)f7�ޞ�S�� T�3d�l��T�� +�6�x�}oG�)�v��T��~�/B`�#�h��}-ګXF�ݜ��\��xq�l��96�J��m��5l�D�ܭ�^��ʾH~���6iF`�"XH�^��2�� :c ӝ?��}H��%�⮱��@��*�C�&��a�,2j�g"#��X� LP8��9�w_a�`3˩P��h{2�m��y�� S�J�`�zt��Y 4��:��s�q/W��+��cʜf�?��S*ɤ8iO�[��>�,p|��~�zj��{�|�_��B��Y}� �6š�t�_@�2�#�q/v�k��㉧l,ǹ{E��Y*�~�<�*�#MD��5�j�� M�@��v� h4\��&txc[n��I�^�0BF#��n%��o��/ã��ۛ1Q��Y�qmKT�N�A�*��,��Ym�w|?O1Ρ��'��+��\j��[�Z��yG�\�]<[6 �9�1/=�5��/�3Rs䁢>cm�4��HZ�b�9F�3�f9:6R}��Z,��iԁF�|\��"ܤW�8��І}�� wd?^/(=��Sw)�� rM1�k��k��t�b��@3��7�¹�jI2��.O�9C~�#��M[�)gg�粍��q Kڄ��u��Ň�{�IrǱ��(��G�߽��)��Ԩ�sˏQ�5HA]�F7�Aq��[i��W��Ecd��o�ۂ��%5��G̋�6�R�.��4Ԉ��4`�%��:O��0ĳ2�Ϛ��d�HuX�?�7J��䀽��h��֍Q��oOw�n2��h�E�-ً��̴m��p"tIq� ߮� 4>Z��pT��|Q�hI5![ZT9��ng��4��0��# ��%�Z� )qc�_,�^��RAllc+��L�}��8�c4A �s)��/ 2*ڏؿ��/�U=��D>�+��u���U5 K��FU�S2��k� ��-n"��%9Qr�E�a�FC),��r��4��ۡ=��;1�?�tRj�;�^�X�6�:�|��k��%!h�Fȃ��,�!,��g<��_Z��>��%�]��ܮn4��͑�^�K�u�KPZ��U��.�7��W3�(��D~IV�7J�kK�j�3c�[`ϣ�. ��:��Wi h=�_]ͣ��"Ե0�`vڻ%:�$�D�:Q��Y4[yZ��7sԟΙ^\�8Yv�Y@p�B��1�Ke��4��mW9��k�\�L�cr�h3 IWE:|��zb��G�h#ڢ �(�?Nd[v��QGVMwG��,��qK �~�S?֓��

Sections

.text
Size: 802KB - Virtual size: 801KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SHARED
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/PassGuardX64ForYBXY/PassGuardX64.inf
$SYSDIR/PassGuardX64ForYBXY/passguardwin7ins.exe
.exe windows:5 windows x86 arch:x86

190ee72e6b20b1938f1aba668a774940

Code Sign

19:9d:f8:72
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=Time-Stamping Authority WoSign,O=WoSign eCommerce Services Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2012 01:00

Not After

08-08-2027 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:3b:57:9f:1a:65:cb
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

12-11-2013 06:31

Not After

14-11-2014 04:48

Subject

CN=深圳手付通科技有限公司,O=深圳手付通科技有限公司,L=深圳市,ST=广东省,C=CN,1.2.840.113549.1.9.1=#0c107366745f68656c70403132362e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01-03-2011 01:00

Not After

01-03-2016 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17-09-2006 19:46

Not After

17-09-2036 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

13:1f:ca:82:77:88:4d:0f:79:a0:bf:58:14:9d:cc:a3:15:53:b8:22
Signer

Actual PE Digest

13:1f:ca:82:77:88:4d:0f:79:a0:bf:58:14:9d:cc:a3:15:53:b8:22

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\workdriver\workspace\PassGuardX64_pin\Release\passguardwin7ins.pdb

Imports

kernel32

GetCurrentProcess
GetModuleHandleW
WriteFile
GetSystemDirectoryW
LoadResource
GetProcAddress
LockResource
FindResourceW
FreeResource
LocalFree
GetVersion
CloseHandle
DeviceIoControl
LocalAlloc
GetLastError
CreateFileW
SizeofResource
Sleep
FlushFileBuffers
IsProcessorFeaturePresent
GetStringTypeW
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
RtlUnwind
HeapAlloc
HeapReAlloc
LoadLibraryW
SetStdHandle
WriteConsoleW
LCMapStringW

user32

MessageBoxW

advapi32

ControlService
ChangeServiceConfigW
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
QueryServiceConfigW

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/default.INF
$SYSDIR/passguardwin7ins.exe
.exe windows:5 windows x86 arch:x86

190ee72e6b20b1938f1aba668a774940

Code Sign

19:9d:f8:72
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=Time-Stamping Authority WoSign,O=WoSign eCommerce Services Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2012 01:00

Not After

08-08-2027 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:3b:57:9f:1a:65:cb
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

12-11-2013 06:31

Not After

14-11-2014 04:48

Subject

CN=深圳手付通科技有限公司,O=深圳手付通科技有限公司,L=深圳市,ST=广东省,C=CN,1.2.840.113549.1.9.1=#0c107366745f68656c70403132362e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01-03-2011 01:00

Not After

01-03-2016 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17-09-2006 19:46

Not After

17-09-2036 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

32:23:bc:a1:98:8a:e6:59:e3:1c:1e:8b:98:0e:c0:70:10:09:ca:ba
Signer

Actual PE Digest

32:23:bc:a1:98:8a:e6:59:e3:1c:1e:8b:98:0e:c0:70:10:09:ca:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\workdriver\workspace\PassGuardCtrl_14.0_pin\Release\passguardwin7ins.pdb

Imports

kernel32

GetCurrentProcess
GetModuleHandleW
WriteFile
GetSystemDirectoryW
LoadResource
GetProcAddress
LockResource
FindResourceW
FreeResource
LocalFree
GetVersion
CloseHandle
DeviceIoControl
LocalAlloc
GetLastError
CreateFileW
SizeofResource
Sleep
FlushFileBuffers
IsProcessorFeaturePresent
GetStringTypeW
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
RtlUnwind
HeapAlloc
HeapReAlloc
LoadLibraryW
SetStdHandle
WriteConsoleW
LCMapStringW

user32

MessageBoxW

advapi32

ControlService
ChangeServiceConfigW
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
QueryServiceConfigW

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 461KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/printCtl4RA.dll
.dll regsvr32 windows:4 windows x86 arch:x86

cc129fdc8d7b0907e4a0f2b760ee31ce

Code Sign

19:9d:f8:72
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=Time-Stamping Authority WoSign,O=WoSign eCommerce Services Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2012 01:00

Not After

08-08-2027 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:3b:57:9f:1a:65:cb
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

12-11-2013 06:31

Not After

14-11-2014 04:48

Subject

CN=深圳手付通科技有限公司,O=深圳手付通科技有限公司,L=深圳市,ST=广东省,C=CN,1.2.840.113549.1.9.1=#0c107366745f68656c70403132362e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01-03-2011 01:00

Not After

01-03-2016 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17-09-2006 19:46

Not After

17-09-2036 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

11:5e:d4:8b:e1:c3:19:8a:01:e9:74:c5:50:3f:d4:33:b4:0a:d9:d0
Signer

Actual PE Digest

11:5e:d4:8b:e1:c3:19:8a:01:e9:74:c5:50:3f:d4:33:b4:0a:d9:d0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
InitializeCriticalSection
DisableThreadLibraryCalls
lstrlenA
GlobalUnlock
GlobalLock
DeleteCriticalSection
MultiByteToWideChar
SetLastError
GlobalAlloc
GlobalFree
GetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
HeapDestroy
lstrcatA
lstrcpyA
lstrcmpiA
IsDBCSLeadByte
lstrcpynA
LoadResource
LoadLibraryExA
FindResourceA
GetShortPathNameA
SizeofResource
GetModuleFileNameA
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LoadLibraryA
LeaveCriticalSection
GetProcAddress
WideCharToMultiByte
GetStdHandle
DeleteFileA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
ReadFile
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetOEMCP
GetACP
SetFilePointer
GetCPInfo
CreateFileA
FlushFileBuffers
SetStdHandle
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
IsBadCodePtr
IsBadReadPtr
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
lstrlenW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetTimeZoneInformation
SetHandleCount
SetUnhandledExceptionFilter
CloseHandle
GetFileAttributesA
TerminateProcess
IsBadWritePtr
VirtualAlloc
ExitProcess
VirtualFree
HeapCreate
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
GetVersion
GetCommandLineA
HeapAlloc
HeapFree
RtlUnwind
GetSystemTime
GetLocalTime
RaiseException
HeapReAlloc

user32

GetKeyState
SendMessageTimeoutA
DispatchMessageA
GetClientRect
BeginPaint
EndPaint
InvalidateRect
GetDC
ReleaseDC
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
IsWindow
GetParent
SetFocus
TranslateMessage
PeekMessageA
LoadStringA
DefWindowProcA
GetClassInfoExA
PtInRect
UnionRect
ShowWindow
SetWindowLongA
GetFocus
IsChild
DestroyWindow
GetWindowLongA
MessageBoxA
CallWindowProcA
CharNextA
CreateWindowExA
LoadCursorA
wsprintfA
RegisterClassExA

gdi32

StartPage
EndDoc
EndPage
SetAbortProc
SetTextAlign
Rectangle
TextOutA
DeleteMetaFile
CloseMetaFile
CreateRectRgnIndirect
SetWindowExtEx
SetWindowOrgEx
RestoreDC
CreateMetaFileA
GetDeviceCaps
SaveDC
SetViewportOrgEx
SetMapMode
DeleteDC
CreateDCA
LPtoDP
StartDocA

winspool.drv

SetPrinterA
ClosePrinter
DocumentPropertiesA
GetPrinterA
OpenPrinterA
ord201

comdlg32

PrintDlgA
CommDlgExtendedError

advapi32

RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA

ole32

OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
CreateDataAdviseHolder
CoCreateGuid
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
OleLoadFromStream
WriteClassStm
OleSaveToStream
CreateOleAdviseHolder

oleaut32

VariantChangeType
VarUI4FromStr
VariantClear
RegisterTypeLi
OleCreatePropertyFrame
LoadTypeLi
SysAllocString
SysStringLen
SysAllocStringLen
SysFreeString
SysAllocStringByteLen
SysStringByteLen
LoadRegTypeLi

cea_crypt

CEA_decrypt
base64Decode

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/stwebdll.dll
.dll regsvr32 windows:4 windows x86 arch:x86

ffc717189b2c1883d919ce4ecab38c6d

Code Sign

19:9d:f8:72
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=Time-Stamping Authority WoSign,O=WoSign eCommerce Services Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2012 01:00

Not After

08-08-2027 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:3b:57:9f:1a:65:cb
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

12-11-2013 06:31

Not After

14-11-2014 04:48

Subject

CN=深圳手付通科技有限公司,O=深圳手付通科技有限公司,L=深圳市,ST=广东省,C=CN,1.2.840.113549.1.9.1=#0c107366745f68656c70403132362e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01-03-2011 01:00

Not After

01-03-2016 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17-09-2006 19:46

Not After

17-09-2036 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

12:2d:18:0b:c5:4e:c6:4d:ad:2c:a5:31:36:ad:a4:e0:44:87:9c:87
Signer

Actual PE Digest

12:2d:18:0b:c5:4e:c6:4d:ad:2c:a5:31:36:ad:a4:e0:44:87:9c:87

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
DisableThreadLibraryCalls
HeapAlloc
GetSystemInfo
HeapCreate
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcpyA
FindResourceA
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
PurgeComm
SetCommState
GetCommState
CreateFileA
SetCommTimeouts
GetCommTimeouts
WriteFile
CloseHandle
ReadFile
IsBadCodePtr
LoadResource
SizeofResource
FreeLibrary
WideCharToMultiByte
GetModuleFileNameA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrcatA
lstrlenW
SetUnhandledExceptionFilter
HeapSize
RaiseException
LocalFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
RtlUnwind
HeapFree
HeapReAlloc
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
VirtualFree
ExitProcess
VirtualAlloc
FlushFileBuffers
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetFilePointer
SetStdHandle
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

CharNextA

advapi32

RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegEnumValueA

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysStringLen
LoadRegTypeLi
SysAllocStringLen
LoadTypeLi
SysAllocString
RegisterTypeLi
VarUI4FromStr
SysFreeString
VariantClear

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/CMCAEn.cer
$TEMP/CMCAPer.cer
$TEMP/CMCARootCA.cer
$TEMP/EsWebSocketKit.exe
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11-12-2023 00:00

Not After

30-12-2024 23:59

Subject

SERIALNUMBER=9111000070003202XF,CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:b4:48:b1:c9:34:71:e9:a7:d7:b4:7c:06:37:d5:4c:15:97:69:d1:ed:af:6c:53:b4:81:56:1b:08:b3:e9:f6
Signer

Actual PE Digest

f9:b4:48:b1:c9:34:71:e9:a7:d7:b4:7c:06:37:d5:4c:15:97:69:d1:ed:af:6c:53:b4:81:56:1b:08:b3:e9:f6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 612KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$0/$8
.dll windows:4 windows x86 arch:x86

e64cf421ac763abffc1e5aa263e39f13

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Process32FirstW
Process32NextW
OutputDebugStringW
CreateToolhelp32Snapshot
GlobalFree
lstrcpyW
FlushFileBuffers
GetStringTypeW
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
LCMapStringW
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
HeapDestroy
HeapCreate
VirtualFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
DisableThreadLibraryCalls
WriteFile
VirtualAlloc
RtlUnwind
GetLastError
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetStdHandle
GetStringTypeA
CloseHandle

user32

wsprintfW

Exports

Exports

FindProc

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/defaults/pref/root_cert_setting_for_websocket.js
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:5 windows x86 arch:x86

8700d0ebbb41c81ea52718af1ab70a93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW
MultiByteToWideChar
lstrlenA
lstrcmpiW
lstrlenW
ExitProcess
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
lstrcpynW
GetCommandLineW
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
GetModuleHandleW
GetTickCount
GetStartupInfoW
CreatePipe
GetVersionExW
GlobalLock
DeleteFileW
lstrcatW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CopyFileW
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
GetProcAddress
PeekNamedPipe
GetCurrentProcess

user32

CharPrevW
CharNextW
SendMessageW
FindWindowExW
wsprintfW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 454B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/ca.crt
$TEMP/cert.cer
$TEMP/nssFirefox64.dll
.dll windows:5 windows x64 arch:x64

01b7b93f5aea67366bcb4faee69d01c7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

71:6a:fd:9f:73:20:99:a3:98:94:48:64:be:9e:fd:a3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

04-09-2017 00:00

Not After

04-09-2018 23:59

Subject

CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d0:a9:46:0a:ad:42:10:7a:65:a3:b8:8c:73:65:4b:f4:06:96:4e:80
Signer

Actual PE Digest

d0:a9:46:0a:ad:42:10:7a:65:a3:b8:8c:73:65:4b:f4:06:96:4e:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\output\x64\Release\IS3000\nssFirefox64.pdb

Imports

kernel32

ReadFile
CreateFileW
SetCurrentDirectoryA
Sleep
LoadLibraryA
CloseHandle
WideCharToMultiByte
FreeLibrary
GetProcAddress
GetFileSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapAlloc
GetLastError
HeapFree
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
RaiseException
RtlPcToFileHeader
GetModuleHandleW
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
CreateFileA
SetStdHandle
FlushFileBuffers
HeapSize
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetEndOfFile
GetProcessHeap

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

SHGetSpecialFolderPathA

Exports

Exports

AddP11Module
CheckP11Module
DeleteP11Module
ImportCACert
ImportServerCert
PluginInit
PluginUnInit

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/regFirefox64.exe
.exe windows:5 windows x64 arch:x64

5147aa1c47b4d837766a320ead12069a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

71:6a:fd:9f:73:20:99:a3:98:94:48:64:be:9e:fd:a3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

04-09-2017 00:00

Not After

04-09-2018 23:59

Subject

CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9e:64:cb:7c:4f:15:d1:15:1f:c4:a2:d2:1c:16:60:29:08:f1:3c:52
Signer

Actual PE Digest

9e:64:cb:7c:4f:15:d1:15:1f:c4:a2:d2:1c:16:60:29:08:f1:3c:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

nssfirefox64

PluginInit
CheckP11Module
AddP11Module
ImportCACert
PluginUnInit
DeleteP11Module
ImportServerCert

kernel32

GetCurrentProcessId
LCMapStringW
LCMapStringA
GetStringTypeW
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwindEx
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetLastError
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
WideCharToMultiByte
HeapAlloc
HeapReAlloc
GetStringTypeA
MultiByteToWideChar

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 566B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EsFtWebSocket.exe
.exe windows:5 windows x86 arch:x86

9c610c44e94a4ebad778c1d37bb5d3d8

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11-12-2023 00:00

Not After

30-12-2024 23:59

Subject

SERIALNUMBER=9111000070003202XF,CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:67:65:3b:b5:b5:3c:7e:e3:df:ba:22:4e:d8:c6:d4:1f:f8:74:91:92:bb:7a:6f:ec:96:2a:38:3e:8c:5e:cb
Signer

Actual PE Digest

29:67:65:3b:b5:b5:3c:7e:e3:df:ba:22:4e:d8:c6:d4:1f:f8:74:91:92:bb:7a:6f:ec:96:2a:38:3e:8c:5e:cb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

J:\source_ft\EsWebSocket_forTWCX_BUG0194278\output\Release_OLDCERT\EsWebSocket.pdb

Imports

kernel32

CreateMutexW
PostQueuedCompletionStatus
GetCurrentThreadId
TlsFree
SetWaitableTimer
TlsSetValue
SetLastError
CreateWaitableTimerW
InterlockedCompareExchange
WaitForMultipleObjects
GetQueuedCompletionStatus
ReleaseMutex
GetModuleHandleA
TerminateThread
QueueUserAPC
GetProcAddress
VerSetConditionMask
GetCurrentProcessId
SetEvent
SleepEx
VerifyVersionInfoW
TlsGetValue
CreateIoCompletionPort
LoadLibraryW
FreeLibrary
GetStdHandle
GetFileType
MultiByteToWideChar
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GlobalMemoryStatus
FlushConsoleInputBuffer
GetFullPathNameW
GetCurrentDirectoryW
FileTimeToSystemTime
WaitForSingleObject
TlsAlloc
CloseHandle
CreateEventW
GetLastError
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FormatMessageA
LocalFree
InterlockedExchangeAdd
InterlockedExchange
InterlockedDecrement
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
InterlockedIncrement
SetEndOfFile
HeapSize
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetProcessHeap
CreateFileW
SetStdHandle
SetFilePointerEx
TryEnterCriticalSection
FormatMessageW
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
GetCurrentThread
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InitializeSListHead
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RaiseException
RtlUnwind
SetConsoleCtrlHandler
ExitThread
GetModuleHandleExW
ExitProcess
ReadFile
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetTimeZoneInformation
HeapAlloc
HeapFree
HeapReAlloc
WriteFile
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
ReadConsoleW

user32

GetProcessWindowStation
MessageBoxA
GetUserObjectInformationW

advapi32

SystemFunction036
ReportEventA
RegisterEventSourceA
DeregisterEventSource

ws2_32

listen
WSASetLastError
WSASocketW
getaddrinfo
getpeername
ntohs
WSAAddressToStringW
WSARecv
ntohl
htons
freeaddrinfo
ioctlsocket
recv
send
shutdown
setsockopt
WSAGetLastError
WSACleanup
WSAStartup
WSASend
closesocket
htonl
bind
getsockopt

mswsock

GetAcceptExSockaddrs
AcceptEx

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EsHttpServer.exe
.exe windows:5 windows x86 arch:x86

47e4ed94c00565463ff0b4a9a5ac1d1f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11-12-2023 00:00

Not After

30-12-2024 23:59

Subject

SERIALNUMBER=9111000070003202XF,CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:b8:87:ae:dd:d6:e9:6a:fe:b5:3e:b2:5e:96:85:6d:51:9b:68:83:35:9f:ac:b2:06:42:7c:f1:69:36:9c:e3
Signer

Actual PE Digest

0b:b8:87:ae:dd:d6:e9:6a:fe:b5:3e:b2:5e:96:85:6d:51:9b:68:83:35:9f:ac:b2:06:42:7c:f1:69:36:9c:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\worksrc\常用工具的代码\EsWebSocket_forTWCX_BUG0194278\output\Release\EsHttpServer.pdb

Imports

advapi32

RegOpenKeyExW
RegCloseKey
RegCreateKeyW
RegSetValueExW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

kernel32

LoadLibraryW
GetProcAddress
FreeLibrary
CreateMutexW
GetLastError
CloseHandle
WaitForSingleObject
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetModuleHandleW
MultiByteToWideChar
SwitchToFiber
DeleteFiber
CreateFiber
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
LoadLibraryA
FindClose
FindFirstFileW
FindNextFileW
GetSystemTime
SystemTimeToFileTime
SetEndOfFile
HeapSize
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetProcessHeap
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFullPathNameW
GetCurrentDirectoryW
GetACP
GetCommandLineW
GetCommandLineA
GetModuleFileNameA
TryEnterCriticalSection
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
GetCurrentThread
GetExitCodeThread
GetNativeSystemInfo
CreateEventW
GetTickCount
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
InitializeSListHead
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RaiseException
RtlUnwind
CreateFileW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
ExitProcess
SetConsoleCtrlHandler
HeapAlloc
HeapFree
ExitThread
HeapReAlloc

user32

GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW

ws2_32

WSASetLastError
socket
WSASocketW
accept
getsockname
listen
WSACleanup
WSAStartup
getpeername
ntohs
freeaddrinfo
bind
getaddrinfo
WSAGetLastError
ioctlsocket
shutdown
select
send
recv
closesocket
setsockopt
getnameinfo

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 510KB - Virtual size: 510KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EsWebSocket.exe
.exe windows:5 windows x86 arch:x86

9c610c44e94a4ebad778c1d37bb5d3d8

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11-12-2023 00:00

Not After

30-12-2024 23:59

Subject

SERIALNUMBER=9111000070003202XF,CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:f4:96:a6:72:05:8e:dd:94:3a:96:50:3c:fb:9a:dd:25:6d:0c:37:48:b8:9e:72:55:66:ce:21:c6:88:38:cb
Signer

Actual PE Digest

3a:f4:96:a6:72:05:8e:dd:94:3a:96:50:3c:fb:9a:dd:25:6d:0c:37:48:b8:9e:72:55:66:ce:21:c6:88:38:cb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

J:\source_ft\EsWebSocket_forTWCX_BUG0194278\output\Release\EsWebSocket.pdb

Imports

kernel32

CreateMutexW
PostQueuedCompletionStatus
GetCurrentThreadId
TlsFree
SetWaitableTimer
TlsSetValue
SetLastError
CreateWaitableTimerW
InterlockedCompareExchange
WaitForMultipleObjects
GetQueuedCompletionStatus
ReleaseMutex
GetModuleHandleA
TerminateThread
QueueUserAPC
GetProcAddress
VerSetConditionMask
GetCurrentProcessId
SetEvent
SleepEx
VerifyVersionInfoW
TlsGetValue
CreateIoCompletionPort
LoadLibraryW
FreeLibrary
GetStdHandle
GetFileType
MultiByteToWideChar
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GlobalMemoryStatus
FlushConsoleInputBuffer
GetFullPathNameW
GetCurrentDirectoryW
FileTimeToSystemTime
WaitForSingleObject
TlsAlloc
CloseHandle
CreateEventW
GetLastError
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FormatMessageA
LocalFree
InterlockedExchangeAdd
InterlockedExchange
InterlockedDecrement
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
InterlockedIncrement
SetEndOfFile
HeapSize
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetProcessHeap
CreateFileW
SetStdHandle
SetFilePointerEx
TryEnterCriticalSection
FormatMessageW
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
GetCurrentThread
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InitializeSListHead
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RaiseException
RtlUnwind
SetConsoleCtrlHandler
ExitThread
GetModuleHandleExW
ExitProcess
ReadFile
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetTimeZoneInformation
HeapAlloc
HeapFree
HeapReAlloc
WriteFile
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
ReadConsoleW

user32

GetProcessWindowStation
MessageBoxA
GetUserObjectInformationW

advapi32

SystemFunction036
ReportEventA
RegisterEventSourceA
DeregisterEventSource

ws2_32

listen
WSASetLastError
WSASocketW
getaddrinfo
getpeername
ntohs
WSAAddressToStringW
WSARecv
ntohl
htons
freeaddrinfo
ioctlsocket
recv
send
shutdown
setsockopt
WSAGetLastError
WSACleanup
WSAStartup
WSASend
closesocket
htonl
bind
getsockopt

mswsock

GetAcceptExSockaddrs
AcceptEx

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 363KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FirefoxMOIT.exe
.exe windows:5 windows x86 arch:x86

bf95d1fc1d10de18b32654b123ad5e1f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11-12-2023 00:00

Not After

30-12-2024 23:59

Subject

SERIALNUMBER=9111000070003202XF,CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:25:22:2c:cb:bc:25:cd:28:7c:b1:f0:97:26:6f:22:0d:7a:2a:81:b6:fd:d7:00:89:90:cb:47:de:9c:2a:68
Signer

Actual PE Digest

4d:25:22:2c:cb:bc:25:cd:28:7c:b1:f0:97:26:6f:22:0d:7a:2a:81:b6:fd:d7:00:89:90:cb:47:de:9c:2a:68

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 452KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 628KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IActiveXCtrl.dll
.dll windows:5 windows x86 arch:x86

7f9ddee5f0a94f8fa72298b23e5063fa

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11-12-2023 00:00

Not After

30-12-2024 23:59

Subject

SERIALNUMBER=9111000070003202XF,CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:db:6c:48:6a:11:e5:0b:58:12:50:7a:c7:ff:cb:ff:46:51:74:eb:22:08:56:f1:ea:14:8d:6f:17:f3:78:53
Signer

Actual PE Digest

54:db:6c:48:6a:11:e5:0b:58:12:50:7a:c7:ff:cb:ff:46:51:74:eb:22:08:56:f1:ea:14:8d:6f:17:f3:78:53

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\worksrc\常用工具的代码\EsWebSocket_forTWCX_BUG0194278\output\Release\IActiveXCtrl.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
GetUserDefaultLCID
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
GetStdHandle
GetModuleFileNameA
ExitProcess
HeapQueryInformation
GetModuleHandleExW
GetCommandLineA
InterlockedFlushSList
RtlUnwind
GetCPInfo
LCMapStringW
GetStringTypeW
OutputDebugStringW
GetFileAttributesExW
FileTimeToLocalFileTime
GetCurrentProcess
WriteFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
FileTimeToSystemTime
DeleteFileW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentProcessId
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateEventW
SetEvent
CloseHandle
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GlobalFindAtomW
GlobalAddAtomW
LoadLibraryA
GetSystemDirectoryW
EncodePointer
FormatMessageW
LocalFree
GlobalFree
GlobalUnlock
SetErrorMode
FindResourceW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
LoadLibraryExW
FreeLibrary
GetVersionExW
GetCurrentThreadId
GetCurrentThread
LoadLibraryW
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
SetLastError
OutputDebugStringA
GetACP
WideCharToMultiByte
MultiByteToWideChar
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
GetLastError
GetCommandLineW
GetEnvironmentStringsW
WriteConsoleW
GetModuleHandleW

user32

SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetCursorPos
GetActiveWindow
TranslateMessage
GetMessageW
SetWindowTextW
IsWindowEnabled
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
LoadIconW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
CopyRect
GetSysColor
LoadBitmapW
ScreenToClient
MessageBoxW
AdjustWindowRectEx
GetWindowRect
RemovePropW
GetPropW
SetPropW
RedrawWindow
ValidateRect
EndPaint
BeginPaint
DrawTextExW
GetForegroundWindow
UpdateWindow
SetMenu
UnregisterClassW
GetClientRect
SetRectEmpty
GetMenu
EnableWindow
GetCapture
GetKeyState
GetFocus
GetDlgCtrlID
GetDlgItem
IsIconic
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPos
SetCursor
GetWindowThreadProcessId
ClientToScreen
RealChildWindowFromPoint
SetTimer
KillTimer
InvalidateRect
MapWindowPoints
DrawTextW
OffsetRect
GetParent
PostMessageW
PostQuitMessage
GetSubMenu
GetMenuItemID
GetMenuItemCount
SendMessageW
GetScrollPos
GetWindowTextW
GetWindowLongW
GetWindow
RegisterWindowMessageW
DispatchMessageW
PeekMessageW
GetMessagePos
GetMessageTime
DefWindowProcW
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsWindow
GrayStringW
TabbedTextOutW
GetDC
ReleaseDC
GetSystemMetrics
GetSysColorBrush
LoadCursorW
DestroyMenu
CharUpperW
SetForegroundWindow
IsMenu
DestroyWindow

gdi32

DeleteDC
Escape
GetClipBox
GetStockObject
PtVisible
RectVisible
RestoreDC
SaveDC
SelectObject
SetMapMode
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
DeleteObject
CreateBitmap
SetTextColor
SetBkColor
GetDeviceCaps

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

ShellExecuteW

shlwapi

PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathFindExtensionW

ole32

CoTaskMemFree
CoCreateGuid
CoUninitialize
CLSIDFromString
CoCreateInstance
CoInitialize

oleaut32

VariantChangeType
SysAllocString
VariantInit
VariantClear
SysStringLen
SysFreeString

oleacc

LresultFromObject
CreateStdAccessibleObject

Exports

Exports

Invoke

Sections

.text
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cert.cer
cert.key
dh.pem
server.crt
server.key
$TEMP/ROOTCA.cer
$TEMP/startCom.cer
AddTrustSite.exe
.exe windows:4 windows x86 arch:x86

be15e11e24a457e56b4a36f41a76ee27

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

67:d9:ad:7c:c8:27:52:c6:83:e8:33:b2:28:3a:3c:1e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-05-2014 00:00

Not After

13-08-2017 23:59

Subject

CN=Feitian Technologies Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Feitian Technologies Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:ff:c3:6c:af:5f:f4:5e:80:52:e5:12:99:66:68:e5:ca:b0:30:5d
Signer

Actual PE Digest

51:ff:c3:6c:af:5f:f4:5e:80:52:e5:12:99:66:68:e5:ca:b0:30:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
GetStringTypeW

advapi32

RegOpenKeyExA
RegCloseKey
RegSetValueExA

ole32

CoCreateInstance
CoInitialize

oleaut32

SysAllocString

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
certd2ka_YBXY.exe
.exe windows:4 windows x86 arch:x86

4c19efb601200d4ccb17f94b74e65938

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11-12-2023 00:00

Not After

30-12-2024 23:59

Subject

SERIALNUMBER=9111000070003202XF,CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:12:12:29:05:bc:4b:ff:88:a5:f3:f3:09:dc:ab:65:98:c3:67:91:dc:74:b7:9d:05:f9:34:72:b1:20:3e:8f
Signer

Actual PE Digest

80:12:12:29:05:bc:4b:ff:88:a5:f3:f3:09:dc:ab:65:98:c3:67:91:dc:74:b7:9d:05:f9:34:72:b1:20:3e:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord6193
ord2371
ord755
ord470
ord6211
ord6451
ord3806
ord538
ord4215
ord2576
ord3649
ord2430
ord6266
ord3658
ord3282
ord3285
ord2634
ord6004
ord1637
ord4270
ord3614
ord3621
ord2406
ord5871
ord1634
ord3701
ord3568
ord5568
ord3871
ord5777
ord5784
ord472
ord2854
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6017
ord6168
ord5869
ord5785
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord2637
ord640
ord5781
ord1633
ord323
ord283
ord4219
ord6195
ord4294
ord1761
ord3084
ord2859
ord5949
ord2281
ord5706
ord537
ord858
ord535
ord2855
ord2559
ord3688
ord4128
ord4292
ord4124
ord2606
ord6770
ord941
ord6640
ord2445
ord6871
ord6166
ord2756
ord2755
ord3792
ord2444
ord922
ord4282
ord2235
ord5783
ord547
ord4273
ord2910
ord3697
ord501
ord1083
ord613
ord289
ord536
ord2746
ord5596
ord773
ord2810
ord2858
ord6330
ord2362
ord2293
ord540
ord861
ord800
ord4704
ord4229
ord641
ord825
ord324
ord3592
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord1569
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5276
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4847
ord4370
ord2089
ord2857
ord3087
ord5977
ord2294
ord567
ord384
ord1165
ord1143
ord609
ord795
ord810
ord686
ord3716
ord3397
ord5286
ord1768
ord6051
ord3569
ord4390
ord2567
ord3728
ord3393
ord2717
ord1131
ord2613
ord2078
ord1197
ord815
ord561
ord3733
ord4418
ord4616
ord5710
ord5285
ord5303
ord4692
ord4074
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord4269
ord4667
ord4279
ord823
ord3566
ord5261

msvcrt

_EH_prolog
_CxxThrowException
memmove
??0exception@@QAE@ABV0@@Z
strlen
strncpy
__CxxFrameHandler
??1exception@@UAE@XZ
memset
wcschr
wcslen
_wtol
wcsstr
memcpy
printf
??0exception@@QAE@XZ
memcmp
wcscpy
_beginthreadex
swprintf
strcpy
wcscmp
rand
srand
time
abs
_ftol
_strcmpi
_endthreadex
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
??1type_info@@UAE@XZ
__dllonexit
_onexit
_controlfp
_wcsicmp

kernel32

TerminateThread
GetVersionExW
GetSystemInfo
GetUserDefaultLangID
lstrcmpiW
GetTickCount
CreateFileW
GetFileSize
ReadFile
WideCharToMultiByte
GetModuleHandleW
LocalAlloc
LocalFree
MultiByteToWideChar
EnterCriticalSection
TerminateProcess
LeaveCriticalSection
CreateProcessW
DeleteCriticalSection
InitializeCriticalSection
GetProcAddress
SetEvent
WaitForMultipleObjects
FindResourceW
LoadResource
LockResource
LoadLibraryW
FreeLibrary
Sleep
CreateEventW
CreateThread
CreateMutexW
GetLastError
CloseHandle
GetCommandLineW
GetModuleFileNameW
lstrcatW
lstrcpynW
lstrlenW
GetSystemDefaultLangID
lstrcpyW
GetStartupInfoW

user32

RedrawWindow
OffsetRect
SetCursor
SetWindowTextW
CallNextHookEx
ToAscii
GetKeyboardState
GetAsyncKeyState
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowTextLengthW
GetKeyState
SetPropW
GetDlgCtrlID
GetWindow
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemCount
RegisterWindowMessageW
EnableWindow
GetParent
InflateRect
GetFocus
GrayStringW
TabbedTextOutW
SetRect
CopyRect
FillRect
GetSysColor
LoadMenuW
DestroyIcon
GetActiveWindow
MessageBoxW
GetCursorPos
GetSubMenu
SetMenuDefaultItem
LoadImageW
wsprintfW
IsIconic
DrawIcon
CreateDialogIndirectParamW
DestroyWindow
LoadStringW
GetWindowTextW
GetDlgItemTextW
GetDlgItem
EnumWindows
SendMessageW
ScreenToClient
SetForegroundWindow
GetWindowLongW
SetWindowLongW
LoadIconW
PostMessageW
GetDC
SetWindowRgn
ReleaseDC
CallWindowProcW
GetPropW
IsWindow
LoadCursorW
RegisterClassExW
CreateWindowExW
UpdateWindow
DefWindowProcW
ShowWindow
GetClientRect
PtInRect
InvalidateRect
BeginPaint
DrawTextW
EndPaint
KillTimer
LoadBitmapW
SetTimer
GetSystemMenu
DeleteMenu
GetWindowRect
GetSystemMetrics
MoveWindow
GetClassNameW
SetWindowPos

gdi32

CreateRectRgnIndirect
Rectangle
GetObjectW
GetViewportOrgEx
SetViewportOrgEx
Ellipse
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
BitBlt
CreateCompatibleBitmap
Arc
CreateEllipticRgn
CreateFontW
CreatePolygonRgn
GetStockObject
GetTextExtentPoint32W
SetBkMode
CreateCompatibleDC
SelectObject
Polygon
DeleteDC
DeleteObject
CreateSolidBrush
CreateFontIndirectW
CreatePen

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExW
RegOpenKeyExW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW

shell32

ShellExecuteW
Shell_NotifyIconW

msvcp60

?compare@?$char_traits@G@std@@SAHPBG0I@Z

crypt32

CertCloseStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CertGetIntendedKeyUsage
CertOpenStore
CryptDecodeObject
CertFindExtension
CryptVerifyCertificateSignature
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertGetNameStringW
CertCreateCertificateContext

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 343KB - Virtual size: 343KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
lang/escertd_1033.lng
lang/escertd_2052.lng
lang/escsp_1033.lng
lang/escsp_2052.lng
lang/esmgr_1033.lng
lang/esmgr_2052.lng
uninst.exe.nsis

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

b4:45:c1:fb:ed:f1:bb:a4:ae:77:16:83:af:26:cc:d4:45:c1:44:6e:06:92:d7:04:4b:e1:af:6c:bd:9f:0a:01Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 676KB

.rsrc Size: 18KB - Virtual size: 17KB

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 963B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 588B

45d25ca52c312b2254c60dbcb30342d1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 696B

.rdata Size: 1024B - Virtual size: 753B

.data Size: 512B - Virtual size: 48B

.reloc Size: 512B - Virtual size: 240B

6e2260b809850e0def413542d0f68b21

Code Sign

19:9d:f8:72Certificate

Extended Key Usages

Key Usages

19:6d:f8:a7Certificate

Key Usages

21:3b:57:9f:1a:65:cbCertificate

Extended Key Usages

Key Usages

3dCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b4:45:c1:fb:ed:f1:bb:a4:ae:77:16:83:af:26:cc:d4:45:c1:44:6e:06:92:d7:04:4b:e1:af:6c:bd:9f:0a:01
Signer

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 676KB

.rsrc
Size: 18KB - Virtual size: 17KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

.text
Size: 1024B - Virtual size: 696B

.rdata
Size: 1024B - Virtual size: 753B

.data
Size: 512B - Virtual size: 48B

.reloc
Size: 512B - Virtual size: 240B

19:9d:f8:72
Certificate

19:6d:f8:a7
Certificate

21:3b:57:9f:1a:65:cb
Certificate

3d
Certificate

01
Certificate

94:99:fa:bc:87:f4:8e:47:10:53:59:b3:44:47:c2:ac:e0:8c:e2:38
Signer

.text
Size: 24KB - Virtual size: 20KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 16KB - Virtual size: 17KB

.reloc
Size: 4KB - Virtual size: 3KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

d7:49:45:ae:83:30:f4:52:01:ff:05:44:d2:27:f3:9f:08:58:87:8b:17:0b:36:31:20:55:88:2c:d8:87:5b:65
Signer

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 2KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b0:11:c3:a1:68:cf:13:23:c0:0a:56:2f:b3:bd:9d:be:ea:84:f7:66:a4:83:9e:8f:b5:b1:85:35:1d:9c:a6:cc
Signer