hijackloader | tmp5ccud765

Sharing

Copy URL Twitter E-mail

General

Target
tmp5ccud765
Size 7.7MB
Sample260601-rssysaht2j
SHA256 27a6ce271f7c798592dabbe5a7e0249190222595575119b9fd7c931d80019628
MD5 ba85897da1d86c29127571f05cdcf4b1
SHA1 9e54a57e674d25484a4eae0a7bbbf5a2fb781ab8
SHA512 efebdb4c2a09992a1ad23939c7acf593ae1261bf5c3baf4a03f6956ac9e54ea03735ee3ce2b3ffaf86e4ef9ae8e58e9f7dd2cfe5890cf691f2dae065575b241a
SSDEEP 196608:4x8vzhX5x98lZMH5B5ORRkfaYbJ79BGgzOEf6x:4ivzhX5TlB5kRkTbR9Fzv6x
TLSH
T1E486335EC2BF77C55AB2ADFE58F95FB7329595A3C2322A000D5DB210563237C325A28C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

loader hijackloader

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\syncfast
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
static1/unpack001/Package/Closkleelthou.tz	family_hijackloader

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Package/COMSupport.dll
unpack001/Package/DVDSetting.dll
unpack001/Package/ExceptionHandler.dll
unpack001/Package/NLEResource.dll
unpack001/Package/NLEService.dll
unpack001/Package/NLETransitionMgr.dll
unpack001/Package/WSMHook.dll
unpack001/Package/WSUtilities.dll
unpack001/Package/WS_ImageProc.dll
unpack001/Package/WS_Log.dll
unpack001/Package/WsBurn.dll

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/Package/BugSplat.dll

File Explorer

tmp5ccud765

.zip 7.7MB
Package/BugSplat.dll

.dll 296KB
Package/COMSupport.dll

.dll 59KB
Package/Closkleelthou.tz

4.3MB
Package/DVDSetting.dll

.dll 41KB
Package/ExceptionHandler.dll

.dll 128KB
Package/ModSolar.exe

.exe 4.2MB
Package/ModSolar.ini

47B
Package/NLEResource.dll

.dll 167KB
Package/NLEService.dll

.dll 289KB
Package/NLETransitionMgr.dll

.dll 124KB
Package/Seertmeanjail.nnti

53KB
Package/WSMHook.dll

.dll 89KB
Package/WSUtilities.dll

.dll 182KB
Package/WS_ImageProc.dll

.dll 222KB
Package/WS_Log.dll

.dll 219KB
Package/WsBurn.dll

.dll 2.4MB
Package/cdid3.dll

.dll 690KB

tmp5ccud765

SHA256 27a6ce271f7c798592dabbe5a7e0249190222595575119b9fd7c931d80019628
MD5 ba85897da1d86c29127571f05cdcf4b1
SHA1 9e54a57e674d25484a4eae0a7bbbf5a2fb781ab8
SHA512 efebdb4c2a09992a1ad23939c7acf593ae1261bf5c3baf4a03f6956ac9e54ea03735ee3ce2b3ffaf86e4ef9ae8e58e9f7dd2cfe5890cf691f2dae065575b241a
SSDEEP 196608:4x8vzhX5x98lZMH5B5ORRkfaYbJ79BGgzOEf6x:4ivzhX5TlB5kRkTbR9Fzv6x
TLSH
T1E486335EC2BF77C55AB2ADFE58F95FB7329595A3C2322A000D5DB210563237C325A28C
MD5 SHA1 SHA512 SSDEEP TLSH

Package/BugSplat.dll

IMPHASH 0dac91d571710abf1256a743c4b815f1
SHA256 4b33ee0e8a4153c0c8ccd945adb18d8f91b5b824746a15986bf6781f081f9968
MD5 27d48c6c48d5259a4e2ad7be369ce906
SHA1 66ea6266024a66826a9dd57a1420b8ce6fd13b0c
SHA512 a037c86bb33b98d768c27d975bc27be348382e75f4bf96d736d2f3bbcc02b7da9dc922994502fad1eb8f80d4df791c2c0e826b55b68c20580a46b1a0fe2cb43f
SSDEEP 6144:zKNX3re4rLmb8Gh8cGLdutlE7ZWeyFEq0DQtzYtRVljQ:zKN6emgGh6LdGwWJFE9ls
TLSH
T1AC549E12B6C0D030D1BB02B65534FB6206FEBD719AB1CA8BBBEC0D5D1E74581A72A753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b3:09:89:96:66:be:f3:d4:ae:1f:fe:16:d1:94:c7:3a:35:88:43:67

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=BugSplat LLC,O=BugSplat LLC,L=Henniker,ST=NH,C=US

Chains

Apr 27, 2015

CN=BugSplat LLC,O=BugSplat LLC,L=Henniker,ST=NH,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

03:01

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 16, 2006 - Nov 16, 2026

Subject

CN=BugSplat LLC,O=BugSplat LLC,L=Henniker,ST=NH,C=US

Serial Number

07:ff:9e:4e:18:62:cf

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 2, 2012 - May 29, 2015

Minor OS version

Major OS version

Entry point

61821

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\www\src\BugSplat\bin\BugSplat.pdb

wininet

InternetWriteFile InternetConnectA HttpAddRequestHeadersA HttpSendRequestA InternetCloseHandle HttpOpenRequestA InternetReadFile InternetAttemptConnect InternetOpenA HttpQueryInfoA HttpEndRequestA HttpSendRequestExA

shlwapi

PathAppendA PathFileExistsA PathRemoveExtensionA PathStripPathA

kernel32

IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW InterlockedIncrement InterlockedDecrement GetProcAddress LocalFree GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetProcessId OpenThread GetLastError GetThreadContext SuspendThread ResumeThread CloseHandle FormatMessageA lstrlenA LoadLibraryA GetTempPathA CreateFileA DeleteFileA CreateToolhelp32Snapshot Thread32First Thread32Next LocalAlloc GetFileSize ReadFile InterlockedExchange FreeLibrary GlobalLock GlobalFree FlushInstructionCache VirtualProtect GetUserDefaultLCID OpenProcess TerminateProcess SetUnhandledExceptionFilter SetErrorMode DebugBreak WaitForSingleObject GetSystemTime SystemTimeToFileTime GetModuleFileNameA GetModuleHandleA CreateProcessA OutputDebugStringA WritePrivateProfileStringA WideCharToMultiByte DecodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadResource SizeofResource lstrcmpiA LoadLibraryExA FindResourceA IsDBCSLeadByte MultiByteToWideChar FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter HeapReAlloc GetProcessHeap GetTimeZoneInformation DeleteFileW GetFileType GetStringTypeW EnumSystemLocalesW GetConsoleCP GetConsoleMode SetFilePointerEx SetEnvironmentVariableA SetStdHandle FlushFileBuffers WriteConsoleW CreateFileW SetEndOfFile ReadConsoleW VirtualQuery HeapSize GetCurrentThread GetCPInfo GetOEMCP GetACP IsValidCodePage GetModuleFileNameW WriteFile GetStdHandle CreateSemaphoreW GetModuleHandleW GetTickCount GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc IsDebuggerPresent OutputDebugStringW EncodePointer ExitProcess GetModuleHandleExW AreFileApisANSI RtlUnwind IsProcessorFeaturePresent CreateThread ExitThread LoadLibraryExW SetConsoleCtrlHandler GetSystemTimeAsFileTime HeapFree HeapAlloc GetSystemInfo VirtualAlloc GetCommandLineA FatalAppExitA UnhandledExceptionFilter SetLastError CreateEventW Sleep

user32

CharUpperA MessageBoxA LoadStringA wvsprintfA CharLowerA CharNextA UnregisterClassA DestroyWindow

advapi32

RegOpenKeyA RegQueryInfoKeyW RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegSetValueExA RegCreateKeyA RegQueryValueExA RegOpenKeyExA RegCloseKey

ole32

CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateGuid

oleaut32

SysFreeString VarUI4FromStr

urlmon

URLDownloadToFileA

version

GetFileVersionInfoSizeA GetFileVersionInfoA

rpcrt4

RpcStringFreeA UuidToStringA

??0BugSplatImp@@QAE@XZ ??0MiniDmpSender@@QAE@ABV0@@Z ??0MiniDmpSender@@QAE@PBD000K@Z ??0MiniDmpSender@@QAE@PBG000K@Z ??0MiniDmpSender@@QAE@PB_W000K@Z ??1MiniDmpSender@@UAE@XZ ??4BugSplatImp@@QAEAAV0@ABV0@@Z ??4MiniDmpSender@@QAEAAV0@ABV0@@Z ??_7MiniDmpSender@@6B@ ?CreateMiniDump@BugSplatImp@@QAEHPAUHINSTANCE__@@KPAXKPAU_EXCEPTION_POINTERS@@PBDPADK@Z ?DoFullMemoryDumpThenExit@BugSplatImp@@2_NA ?GetReducedGuid@BugSplatImp@@QAEXPADK@Z ?MiniDumpType@BugSplatImp@@2W4_MINIDUMP_TYPE@@A ?ReduceGuidString@BugSplatImp@@QAEXPADK@Z ?ResumeSuspendedThreads@BugSplatImp@@QAEXXZ ?SetDbghelpFlags@MiniDmpSender@@QAEXW4dbghelpFlags@1@@Z ?SuspendAllThreadsInProcess@BugSplatImp@@QAEXPAX@Z ?SuspendThreadsInCurrentProcess@BugSplatImp@@QAEXXZ ?createReport@MiniDmpSender@@QAEXPAU_EXCEPTION_POINTERS@@@Z ?createReport@MiniDmpSender@@QAEXPBD@Z ?createReport@MiniDmpSender@@QAEXPB_W@Z ?createReport@MiniDmpSender@@QAEXXZ ?createReportAndExit@MiniDmpSender@@QAEXXZ ?enableExceptionFilter@MiniDmpSender@@QAE_N_N@Z ?enableFullMemoryDumpAndExit@MiniDmpSender@@QAE_N_N@Z ?getFlags@MiniDmpSender@@QBEKXZ ?imp@MiniDmpSender@@QAEPAXXZ ?isExceptionFilterEnabled@MiniDmpSender@@QBE_NXZ ?isFullMemoryDumpAndExitEnabled@MiniDmpSender@@QBE_NXZ ?resetAppIdentifier@MiniDmpSender@@QAEXPBD@Z ?resetAppIdentifier@MiniDmpSender@@QAEXPB_W@Z ?resetVersionString@MiniDmpSender@@QAEXPBD@Z ?resetVersionString@MiniDmpSender@@QAEXPB_W@Z ?setCallback@MiniDmpSender@@QAEXP6A_NIPAX0@Z@Z ?setDefaultUserEmail@MiniDmpSender@@QAEXPBD@Z ?setDefaultUserEmail@MiniDmpSender@@QAEXPBG@Z ?setDefaultUserEmail@MiniDmpSender@@QAEXPB_W@Z ?setDefaultUserName@MiniDmpSender@@QAEXPBD@Z ?setDefaultUserName@MiniDmpSender@@QAEXPBG@Z ?setDefaultUserName@MiniDmpSender@@QAEXPB_W@Z ?setFlags@MiniDmpSender@@QAE_NK@Z ?setUserZipPath@MiniDmpSender@@QAEXPBD@Z ?setUserZipPath@MiniDmpSender@@QAEXPBG@Z ?setUserZipPath@MiniDmpSender@@QAEXPB_W@Z ?storeUserLog@MiniDmpSender@@QAEXPBD@Z ?storeUserLog@MiniDmpSender@@QAEXPB_W@Z ?unhandledExceptionHandler@MiniDmpSender@@QAEJPAU_EXCEPTION_POINTERS@@@Z CreateMiniDmpSender DestroyMiniDmpSender MDSGetFlags MDSResetAppIdentifier MDSResetVersionString MDSSetFlags

Package/COMSupport.dll

IMPHASH b196abf09e30eabcd24a4d23b2fd07e5
SHA256 b1038928a6da2a1b5064a27187403563f3ab7e8d4ec034dfa8d5d3f6be231191
MD5 976ef4af05e92e4dbb612756e6798a37
SHA1 b6eeeab344272c6e9965820d35ca596703a311d6
SHA512 dde2923cf55dbd7a9eecd4a114d475008123d433a003ea71da0c50e9ec557fe6dc270e26d97c9076546ba225a9388e303330e601ecaa11dda4e812809a9665db
SSDEEP 768:8qr8sIYRM5ZJi9nCJELr6p0KkR7Dp4iUcj3QcYUyQaQIbPYTdRcmt3uo:8qvMi9T6fGmbcbjqmI8TdC03
TLSH
T12E535B107690C0B3C51B91755452D7A19EBEAC112BF591CBBFA90B3E5F213C2AB3A31B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11266

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\svn_code\Common\MultimediaPlatform\Branch\4.2.5_DVDCreator221957\Src\SymbolTable\Release\COMSupport.pdb

Package/DVDSetting.dll

IMPHASH b1ef5315be487f2c21eade374734763b
SHA256 718cfb5195d0e43e795627c781fb3f427856f1cf29f33eedbbc6059b6f214549
MD5 05c88530d48f20ec24dbc4df3470e57d
SHA1 44cd6ee8ca8c0ffaf9313a0c24bb781dbc4f3849
SHA512 e7654ee6a45ac5c150b9c1b98d530e2c9ca6e89a836408d1435826979b5e009bb6d630c9ab9b6ed124511449754c5ec67181d91c8f96c3e00c7f5179bf2a9675
SSDEEP 768:/8qXvDbWzd3vbJEl6s1Tl4jxl01SGoMRuuwV:Eq6dfbJE1T2aSwRuuwV
TLSH
T14F135B107541C073C0476578949ADAA48EBE7D022BF5A05BBFFA076E9F312D0A73E35A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\Wondershare2018\DVDCreator\MediaAuthorLib\Trunk\Src\DVDCreator\SymbolTable\Release\DVDSetting.pdb

Package/ExceptionHandler.dll

IMPHASH cc439d98e7c816c876845ed90402d8ee
SHA256 6036be1c9a8819998ad10879dff6c04edc787d34a142a3e0841c0fca36fb9c6e
MD5 7c76e3100bd67c47f176a0edde3ef79a
SHA1 bff22f39f3ba61cddd695b8a27b5139c5675afba
SHA512 a9508ef760f5bba22aec0f2784258a364b372ff163bebf4fc59cb4d48c7ac6e68a96b7fd64dddb522dfa4c34f7ad652d8779232dd0db7609fb4b60cc1f4c2bbf
SSDEEP 1536:ReLbWzby5i5Zqyt4Q1H9JFXHSFUNNRcZZ36mCcTSkb0EYsKK93BFZ2nQ+iFD+b7:8v+iNPQ1H9JFCsIdjWK9RFZB+iFD+b7
TLSH
T1ECD38D21B250C0B2C4CF663D4466C7656B7FB5358B658ACBB7480B7ABE603D09B3A347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

I:\CompanySource\Plowshare\Src\Symbol\Release\ExceptionHandler.pdb

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

psapi

GetModuleFileNameExW

kernel32

WaitNamedPipeW WriteFile TransactNamedPipe CreateFileW GetLastError ResetEvent SetNamedPipeHandleState WaitForMultipleObjects GetCurrentThreadId CloseHandle GetCurrentProcessId UnregisterWait CreateMutexW GetCurrentProcess ConnectNamedPipe CreateNamedPipeW Sleep ReadFile GetOverlappedResult DisconnectNamedPipe RegisterWaitForSingleObject CreateEventW DuplicateHandle ReleaseMutex UnregisterWaitEx FreeLibrary InitializeCriticalSection LoadLibraryW GetProcAddress GetLocalTime DeleteCriticalSection SetEvent OpenProcess ReadProcessMemory RtlCaptureContext SetUnhandledExceptionFilter InterlockedIncrement InterlockedDecrement WaitForSingleObject LeaveCriticalSection ReleaseSemaphore EnterCriticalSection CreateSemaphoreW GetProcessId AddVectoredExceptionHandler GetModuleFileNameW CreateProcessW AssignProcessToJobObject TerminateProcess ResumeThread InitializeCriticalSectionAndSpinCount GetModuleHandleW WriteConsoleA GetConsoleOutputCP GetProcessTimes InterlockedExchange UnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread ExitProcess GetCommandLineA LoadLibraryA RaiseException RtlUnwind HeapAlloc HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetStdHandle GetModuleFileNameA HeapSize SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime SetStdHandle GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA MultiByteToWideChar LCMapStringW VirtualAlloc HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode GetLocaleInfoA GetModuleHandleA FlushFileBuffers CreateFileA GetStringTypeA GetStringTypeW WriteConsoleW

advapi32

CreateProcessAsUserW

ole32

StringFromGUID2 CoCreateGuid

??0CCrashGenerationServer@exceptionpad@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@P6AXPAXPBVCRemoteClientInfo@1@@Z1P6AX12PBV23@@Z131P6AX1K@Z1_N4@Z ??0CRemoteClientInfo@exceptionpad@@QAE@PAVCCrashGenerationServer@1@KW4_MINIDUMP_TYPE@@PAKPAPAU_EXCEPTION_POINTERS@@ABUCustomClientInfo@@@Z ??1CCrashGenerationServer@exceptionpad@@QAE@XZ ??1CRemoteClientInfo@exceptionpad@@QAE@XZ ?AddClient@CCrashGenerationServer@exceptionpad@@AAE_NPAVCRemoteClientInfo@2@@Z ?CreateClientHandles@CCrashGenerationServer@exceptionpad@@ABE_NABVCRemoteClientInfo@2@PAUProtocolMessage@2@@Z ?EnterErrorState@CCrashGenerationServer@exceptionpad@@AAEXXZ ?EnterStateImmediately@CCrashGenerationServer@exceptionpad@@AAEXW4IPCServerState@12@@Z ?EnterStateWhenSignaled@CCrashGenerationServer@exceptionpad@@AAEXW4IPCServerState@12@@Z ?GenerateDump@CCrashGenerationServer@exceptionpad@@AAE_NABVCRemoteClientInfo@2@PAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?GetClientExceptionInfo@CRemoteClientInfo@exceptionpad@@QBE_NPAPAU_EXCEPTION_POINTERS@@@Z ?GetClientProcessHandle@CRemoteClientInfo@exceptionpad@@QBEPAXXZ ?GetClientProcessID@CRemoteClientInfo@exceptionpad@@QBEKXZ ?GetClientThreadId@CRemoteClientInfo@exceptionpad@@QBE_NPAK@Z ?GetCrashID@CRemoteClientInfo@exceptionpad@@QBEKXZ ?GetCrashServer@CRemoteClientInfo@exceptionpad@@QBEPAVCCrashGenerationServer@2@XZ ?GetCustomInfo@CRemoteClientInfo@exceptionpad@@QBE?AUCustomClientInfo@@XZ ?GetDumpGeneratedHandle@CRemoteClientInfo@exceptionpad@@QBEPAXXZ ?GetDumpRequestedHandle@CRemoteClientInfo@exceptionpad@@QBEPAXXZ ?GetDumpType@CRemoteClientInfo@exceptionpad@@QBE?AW4_MINIDUMP_TYPE@@XZ ?GetExceptionInfo@CRemoteClientInfo@exceptionpad@@QBEPAPAU_EXCEPTION_POINTERS@@XZ ?GetRequsetThreadID@CRemoteClientInfo@exceptionpad@@QBEPAKXZ ?HandleClientProcessExit@CCrashGenerationServer@exceptionpad@@AAEXPAVCRemoteClientInfo@2@@Z ?HandleConnectedState@CCrashGenerationServer@exceptionpad@@AAEXXZ ?HandleConnectingState@CCrashGenerationServer@exceptionpad@@AAEXXZ ?HandleConnectionRequest@CCrashGenerationServer@exceptionpad@@AAEXXZ ?HandleDisconnectingState@CCrashGenerationServer@exceptionpad@@AAEXXZ ?HandleDumpRequest@CCrashGenerationServer@exceptionpad@@AAEXABVCRemoteClientInfo@2@@Z ?HandleErrorState@CCrashGenerationServer@exceptionpad@@AAEXXZ ?HandleInitialState@CCrashGenerationServer@exceptionpad@@AAEXXZ ?HandleReadDoneState@CCrashGenerationServer@exceptionpad@@AAEXXZ ?HandleReadingAckState@CCrashGenerationServer@exceptionpad@@AAEXXZ ?HandleReadingState@CCrashGenerationServer@exceptionpad@@AAEXXZ ?HandleWriteDoneState@CCrashGenerationServer@exceptionpad@@AAEXXZ ?HandleWritingState@CCrashGenerationServer@exceptionpad@@AAEXXZ ?Initialize@CRemoteClientInfo@exceptionpad@@QAE_NXZ ?OnClientEnd@CCrashGenerationServer@exceptionpad@@CGXPAXE@Z ?OnDumpRequest@CCrashGenerationServer@exceptionpad@@CGXPAXE@Z ?OnPipeConnected@CCrashGenerationServer@exceptionpad@@CGXPAXE@Z ?PopulateCustomInfo@CRemoteClientInfo@exceptionpad@@QAE_NXZ ?PrepareReply@CCrashGenerationServer@exceptionpad@@ABE_NABVCRemoteClientInfo@2@PAUProtocolMessage@2@@Z ?RespondToClient@CCrashGenerationServer@exceptionpad@@AAE_NPAVCRemoteClientInfo@2@@Z ?SetWaitDumpRequestHandle@CRemoteClientInfo@exceptionpad@@QAEXPAX@Z ?SetWaitProcessExitHandle@CRemoteClientInfo@exceptionpad@@QAEXPAX@Z ?Start@CCrashGenerationServer@exceptionpad@@QAE_NXZ ?UnregisterWaitDumpRequestAndBlockUntilNoPending@CRemoteClientInfo@exceptionpad@@QAEXXZ ?UnregisterWaitProcessExit@CRemoteClientInfo@exceptionpad@@QAEX_N@Z ?kCustomCallDll@switches@@3QB_WB ?kCustomFromTextLaunchProcess@switches@@3QB_WB ?kCustomLanchProcess@switches@@3QB_WB ?kDebugCrashService@switches@@3QB_WB ?kDumpPath@switches@@3QB_WB ?kServicePipe@switches@@3QB_WB ?kWaitServiceInit@switches@@3QB_WB DumpProcessWithException DumpProcessWithoutCrash InitDumpCrash

Package/ModSolar.exe

IMPHASH e002cd4a165ce70e8a90348e7a100e4b
SHA256 340d84a0bfd03dc58dcfe7c06f655df2a99285627fb36e209c5fadc1710ff0f9
MD5 cde18404f6df8f6eb225f5f4d0f3d1d8
SHA1 7c5b6cf5ff412b46f671ad214885c65e2218655e
SHA512 718ccf61fb61a96f83dce7b4b64f531dc2c4f055c876821ae029b1c8490dfa50f9dd4c2d08ea84d5373bde77f74b4d16cc414949071b8a06b8005f7f33ecfe98
SSDEEP 49152:Eii48G7JQnmoRWvpDU0hJAVAnaRJW3bGjMzaqUj7Nyl4allDPjDT8TAmTIiNIvfT:9G6WFWvW0hl39qICallzZri8fLqqhOm
TLSH
T123165D21A7C9C932D1731F7A4C6AD788AD2ABE202E74D44B7EB85A0C1E39F417D24357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

0c:96:ac:50:5f:d6:d0:ec:0b:40:fd:83:d0:77:f1:20:5b:9d:95:de:04:c8:2a:c1:4b:5b:c9:1e:73:26:e5:3d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Feb 25, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

a7:e7:e6:71:5f:a5:37:59:0c:ba:a6:6c:42:de:c4:8f:42:8c:70:f6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Feb 25, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

Serial Number

05:99:17:fd:77:18:80:8b:c3:4b:e2:24:e4:15:21:6f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 8, 2022 - Apr 5, 2025

Minor OS version

Major OS version

Entry point

2904116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen CreateErrorInfo GetErrorInfo SetErrorInfo GetActiveObject DispGetIDsOfNames LoadRegTypeLib SysFreeString SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW RegQueryValueExW RegOpenKeyExW RegFlushKey RegCreateKeyExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

user32

GetKeyboardType LoadStringW MessageBoxA CharNextW CreateWindowExW WindowFromPoint WaitMessage ValidateRect UpdateLayeredWindow UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenuEx TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups ShowCaret SetWindowRgn SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenuInfo SetMenuDefaultItem SetMenu SetKeyboardState SetForegroundWindow SetFocus SetCursor SetClipboardData SetClassLongW SetCaretPos SetCaretBlinkTime SetCapture SetActiveWindow SendMessageA SendMessageW SendDlgItemMessageW ScrollWindowEx ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassW RedrawWindow PtInRect PostQuitMessage PostMessageW PeekMessageA PeekMessageW OpenClipboard OffsetRect OemToCharA MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MoveWindow MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LockWindowUpdate LoadStringW LoadKeyboardLayoutW LoadImageW LoadIconW LoadCursorFromFileW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsRectEmpty IsIconic IsDialogMessageA IsDialogMessageW IsChild IsCharAlphaNumericW IsCharAlphaW InvalidateRgn InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect HideCaret GetWindowThreadProcessId GetWindowTextW GetWindowRgn GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropW GetParent GetWindow GetMessageTime GetMessagePos GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDoubleClickTime GetDlgItem GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassNameW GetClassLongW GetClassInfoW GetCaretBlinkTime GetCapture GetActiveWindow FrameRect FlashWindowEx FindWindowExW FindWindowW FillRect ExitWindowsEx EnumWindows EnumThreadWindows EnumClipboardFormats EnumChildWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextExW DrawTextA DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DestroyCaret DeleteMenu DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CreateCaret CopyImage CloseClipboard ClipCursor ClientToScreen ChildWindowFromPoint CheckMenuItem CharUpperBuffW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BringWindowToTop BeginPaint CharLowerBuffA CharUpperBuffA CharToOemA AdjustWindowRectEx ActivateKeyboardLayout

kernel32

GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte SetCurrentDirectoryW RemoveDirectoryW MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLastError GetCurrentDirectoryW GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrcpyW lstrcmpW WriteProcessMemory WritePrivateProfileStringA WritePrivateProfileStringW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualProtect VirtualFree VirtualAlloc UnmapViewOfFile TerminateThread TerminateProcess SystemTimeToFileTime SwitchToThread Sleep SizeofResource SignalObjectAndWait SetThreadPriority SetThreadLocale SetLastError SetFileTime SetFilePointer SetFileAttributesW SetEvent SetErrorMode SetEndOfFile ResumeThread ResetEvent RemoveDirectoryW ReleaseMutex ReadFile RaiseException QueryPerformanceFrequency QueryPerformanceCounter OutputDebugStringW OpenProcess MultiByteToWideChar MulDiv MoveFileExA MoveFileExW MoveFileW MapViewOfFile LockResource LocalFileTimeToFileTime LoadResource LoadLibraryW LeaveCriticalSection IsValidLocale IsBadReadPtr InitializeCriticalSection GlobalUnlock GlobalSize GlobalLock GlobalGetAtomNameW GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetVolumeInformationW GetVersionExW GetVersion GetUserDefaultLCID GetTimeZoneInformation GetTickCount GetThreadLocale GetTempPathA GetTempPathW GetSystemInfo GetSystemDirectoryW GetSystemDefaultLCID GetStringTypeExA GetStringTypeExW GetStdHandle GetProcAddress GetPrivateProfileStringA GetPrivateProfileStringW GetModuleHandleA GetModuleHandleW GetModuleFileNameA GetModuleFileNameW GetLogicalDrives GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameA GetFullPathNameW GetFileTime GetFileSize GetFileAttributesExW GetFileAttributesA GetFileAttributesW GetExitCodeThread GetExitCodeProcess GetEnvironmentVariableW GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCurrentDirectoryW GetComputerNameW GetCommandLineW GetCPInfo GetACP FreeResource InterlockedIncrement InterlockedExchangeAdd InterlockedExchange InterlockedDecrement InterlockedCompareExchange FreeLibrary FormatMessageW FlushInstructionCache FlushFileBuffers FindResourceW FindNextFileA FindNextFileW FindFirstFileA FindFirstFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime ExpandEnvironmentStringsW EnumSystemLocalesW EnumResourceNamesW EnumCalendarInfoW EnterCriticalSection DosDateTimeToFileTime DeviceIoControl DeleteFileA DeleteFileW DeleteCriticalSection CreateThread CreateProcessW CreatePipe CreateMutexW CreateFileMappingW CreateFileA CreateFileW CreateEventW CreateDirectoryA CreateDirectoryW CopyFileW CompareStringA CompareStringW CloseHandle Sleep GetVersionExW OpenThread SetThreadExecutionState

msimg32

AlphaBlend

gdi32

UnrealizeObject StretchDIBits StretchBlt SetWorldTransform SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetMapMode SetGraphicsMode SetEnhMetaFileBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SelectPalette SelectObject SelectClipRgn SaveDC RoundRect RestoreDC ResizePalette Rectangle RectVisible RealizePalette PtInRegion Polyline Polygon PlayEnhMetaFile PatBlt OffsetWindowOrgEx OffsetRgn OffsetClipRgn MoveToEx MaskBlt LineTo LPtoDP IntersectClipRect GetWorldTransform GetWindowOrgEx GetWinMetaFileBits GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W GetSystemPaletteEntries GetStretchBltMode GetStockObject GetRgnBox GetRegionData GetPixel GetPaletteEntries GetObjectW GetNearestPaletteIndex GetGraphicsMode GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileDescriptionW GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetCurrentObject GetClipBox GetBrushOrgEx GetBitmapBits GdiFlush FrameRgn ExtTextOutW ExtSelectClipRgn ExtCreateRegion ExcludeClipRect EnumFontFamiliesExW EndPage EndDoc Ellipse DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRoundRectRgn CreateRectRgnIndirect CreateRectRgn CreatePenIndirect CreatePen CreatePalette CreateICW CreateHalftonePalette CreateFontIndirectW CreateEnhMetaFileW CreateEllipticRgn CreateDIBitmap CreateDIBSection CreateDCW CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW CombineRgn CloseEnhMetaFile BitBlt

version

VerQueryValueW GetFileVersionInfoSizeA GetFileVersionInfoSizeW GetFileVersionInfoA GetFileVersionInfoW

mpr

WNetGetConnectionW

ole32

IsEqualGUID CLSIDFromString CoTaskMemFree StringFromCLSID CoCreateGuid CreateStreamOnHGlobal IsAccelerator OleDraw OleSetMenuDescriptor RevokeDragDrop RegisterDragDrop OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc ProgIDFromCLSID StringFromCLSID CoCreateInstance CoGetClassObject CoUninitialize CoInitialize IsEqualGUID

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Replace ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create InitCommonControls

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

shell32

ShellExecuteExW ShellExecuteA ShellExecuteW SHGetFileInfoW SHFileOperationW SHAppBarMessage DragQueryPoint DragQueryFileA DragQueryFileW DragFinish DragAcceptFiles SHGetSpecialFolderPathW SHGetPathFromIDListW SHGetMalloc SHGetDesktopFolder SHBrowseForFolderW

comdlg32

ChooseFontW ChooseColorW GetSaveFileNameW GetOpenFileNameW

winspool.drv

OpenPrinterW EnumPrintersW DocumentPropertiesW ClosePrinter GetDefaultPrinterW

wsock32

__WSAFDIsSet WSACleanup WSAStartup WSAGetLastError getservbyname gethostbyname socket shutdown setsockopt send select recv ntohs ioctlsocket inet_addr htons connect closesocket

gdiplus

GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipGetStringFormatFlags GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipMeasureString GdipDrawString GdipGetFontCollectionFamilyList GdipGetFontCollectionFamilyCount GdipNewInstalledFontCollection GdipGetFontHeight GdipDeleteFont GdipCreateFont GdipGetFamilyName GdipGetGenericFontFamilySansSerif GdipCloneFontFamily GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipGetImageEncoders GdipGetImageEncodersSize GdipEndContainer GdipBeginContainer GdipRestoreGraphics GdipSaveGraphics GdipIsVisibleRect GdipSetClipRect GdipDrawImageRectRectI GdipDrawImageRectRect GdipDrawImageRectI GdipDrawImageRect GdipFillRegion GdipFillEllipse GdipFillRectangleI GdipFillRectangle GdipGraphicsClear GdipDrawEllipse GdipDrawRectangleI GdipDrawRectangle GdipDrawLine GdipSetPageScale GdipSetPageUnit GdipGetWorldTransform GdipRotateWorldTransform GdipTranslateWorldTransform GdipResetWorldTransform GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetCompositingMode GdipReleaseDC GdipGetDC GdipDeleteGraphics GdipCreateFromHDC GdipSetImageAttributesColorKeys GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetPropertyItem GdipGetPropertyItemSize GdipGetImagePaletteSize GdipSetImagePalette GdipGetImagePalette GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageThumbnail GdipGetImagePixelFormat GdipGetImageRawFormat GdipGetImageFlags GdipGetImageVerticalResolution GdipGetImageHorizontalResolution GdipGetImageHeight GdipGetImageWidth GdipGetImageType GdipGetImageBounds GdipGetImageGraphicsContext GdipSaveImageToStream GdipSaveImageToFile GdipDisposeImage GdipLoadImageFromFileICM GdipLoadImageFromStreamICM GdipLoadImageFromFile GdipLoadImageFromStream GdipSetPenDashStyle GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipCreateHatchBrush GdipDeleteBrush GdipCloneBrush GdipDeleteRegion GdipCreateRegionHrgn GdipCreateRegion GdipTransformMatrixPointsI GdipTransformMatrixPoints GdipRotateMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdiplusShutdown GdiplusStartup

ws_log

SetPrivateDllPath SetErrorCallBack LogFileLog LogFileDestroy LogFileCreate WSLog WSLogInit

nleservice

CreateServiceInstance

wsutilities

ReadCustomizeInfoW IsCustomizeLangInfoExistsW LoadCustomizeXMLFileW

nleresource

CreateResourceInstance

dvdsetting

SetDecoderMode

comsupport

WSCreateInstance

ws_imageproc

DISave

wsburn

BDBurn_GetSpeeds DVDBurn_GetSpeeds BDBurn_FromTreeToDisc BDBurn_TrayLock BDBurn_GetDiscSpace BDBurn_GetDiscInformation BDBurn_Erase BDBurn_Eject BDBurnDestroy BDBurnCreate DVDBurn_FromTreeToImage DVDBurn_FromTreeToDisc DVDBurn_FromImageToDisc DVDBurn_TrayLock DVDBurn_GetDiscSpace DVDBurn_GetDiscInformation DVDBurn_Erase DVDBurn_Eject DVDBurnDestroy DVDBurnCreate GetBDBurnEngine GetDVDBurnEngine WSBurnGetDeviceInformation

shlwapi

SHCreateStreamOnFileW SHCreateStreamOnFileEx

winmm

sndPlaySoundW

cdid3

EditId3

wsmhook

Mhook_Unhook Mhook_SetHook

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

546KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

76B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

183KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Package/NLEResource.dll

IMPHASH 83c076d10c8b6bc3619f5e8bbe8110ea
SHA256 7cd5072111581133c5e28b56bef060b3d3b0d8acca3396ef23c6c384eb292d25
MD5 b5b2c99fbe00ce2d3be66890a55640ae
SHA1 5110e90d3ee55f05aee9a56ff510fc286d70ba88
SHA512 ea04c33f6d3a65b45ba88019d1121fb4d368a40b5cfc2afbd2fef4125edd29563ef0509fb70a398276f3c456e2d78115d7948261f93cd9709a5a353dfca7e6db
SSDEEP 3072:EzCjWwbSlOnn1VASbBvdg573gF8z65t1X:Ea1V1ZqLVW
TLSH
T180F38C0176E0C1B2C69B11390435DB69A73B75256BB486CBB7844F7FAE723C09B3A346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

55797

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\project\MediaAuthorLib\NLEPlatform\SymbolTable\Release\NLEResource.pdb

nletransitionmgr

CreateTransitionMgrInstance

ws_log

ord1 ord341 ord2

ws_imageproc

ord301 ord302 ord2 ord7 ord19 ord5 ord1

dvdsetting

GetDecoderMode

kernel32

GetProcessHeap SetEndOfFile GetStringTypeW GetStringTypeA CloseHandle DeleteFileW GetTempPathW CreateDirectoryW GetTempFileNameW MoveFileExW GetShortPathNameW InterlockedIncrement InterlockedDecrement WideCharToMultiByte LoadLibraryW MultiByteToWideChar lstrlenW GetProcAddress lstrcmpiW lstrcpyW CreateFileW LCMapStringW LCMapStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA CreateFileA LoadLibraryA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ReadFile GetLastError GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind HeapFree HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetModuleHandleA EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection SetFilePointer Sleep HeapSize ExitProcess WriteFile GetModuleFileNameA GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc SetStdHandle FlushFileBuffers InitializeCriticalSectionAndSpinCount

gdi32

DeleteObject

ole32

CoInitialize StringFromCLSID CoTaskMemFree CoCreateInstance

oleaut32

VariantClear SysStringLen SysAllocString VariantInit SysFreeString

Package/NLEService.dll

IMPHASH fb8e999c91921d2d6ebe14213963b348
SHA256 15c4860f2e0530bc896f9b07f893b32b13cffe40c909293b6232bd5696a5f71a
MD5 77bffd6a7270bf001aaba999de8394f9
SHA1 132a1823392596f9748667b67f4aaef709b335c1
SHA512 358c82c57ccf73a20b3496ff8fe83959f49283536c8ca7a00f6211e8c67a36c3e6a7029f7a30fcd3de502e6007fd9eec654d922e29e9b15815af208e358d1aa4
SSDEEP 6144:SN5kbdYKDBpH0gMEjN24gai3/svFlWAWKLrJ:nbqKDBHgaivsPNWMl
TLSH
T130548E00FBAAC1F6CDCF2470543AA72DB66A775237A0C6C7E7981A1F5E312C0653925E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

151472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\project\MediaAuthorLib\NLEPlatform\SymbolTable\Release\NLEService.pdb

nleresource

CreateResourceInstance

nletransitionmgr

CreateTransitionMgrInstance

ws_log

ord341 ord2 ord1

ws_imageproc

ord1 ord301 ord37 ord21 ord18 ord5 ord302

kernel32

ReadFile GetProcessHeap CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection LoadLibraryExW GetProcAddress InterlockedIncrement InterlockedDecrement LoadLibraryW MultiByteToWideChar lstrcmpiW lstrcpyW WideCharToMultiByte GetStringTypeW EnterCriticalSection IsDebuggerPresent GetStringTypeA LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount GetLocaleInfoA LoadLibraryA SetFilePointer HeapReAlloc VirtualAlloc GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualFree HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetConsoleMode GetConsoleCP CloseHandle IsValidCodePage GetOEMCP GetACP GetCPInfo ExitProcess HeapSize Sleep GetModuleFileNameA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleHandleA GetLastError GetFileAttributesW GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind HeapFree HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError WriteFile GetStdHandle

user32

ReleaseDC GetDC GetSysColor

gdi32

DeleteObject GetDeviceCaps

ole32

StringFromCLSID CoInitialize CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

gdiplus

GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipMeasureString GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipImageRotateFlip GdipGetImageHeight GdipFree GdipAlloc GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipDisposeImage GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatLineAlign GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetDC GdipReleaseDC GdipSetTextRenderingHint GdipBitmapUnlockBits GdipDrawString GdipCloneImage GdipGetImageWidth

Package/NLETransitionMgr.dll

IMPHASH 1a7449c4d4dfdc584cb0376874526212
SHA256 053eb45670cc02f92dd9584b4aeae8da9aff9f81be89087e79b1a2ba36720309
MD5 23d79af7e2501584f24b91c60bde494f
SHA1 621164723df1c68d797600e587febed33c46fb68
SHA512 7990dc1609f8c24561065c305f33e18a5ce61463c472230b9631888530e52ff05078c1e4d88a6ffaac9b3e35e6ae3230849f0b6b0e5e8df1bfaad2acb7065aed
SSDEEP 1536:+E0XoHqSwFPpx0MIANXJ3Vq+u4taao+CxNpyKAFqKIqp8XbtnXYVX5fBo8:+E8+qSwFtJ31bt7++YRXYh5fBo8
TLSH
T103C3AE1076A0C0B3C5AB283D4865D725A77E6562DFB499C7F7680BBE6F302C05B3634A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\project\MediaAuthorLib\NLEPlatform\SymbolTable\Release\NLETransitionMgr.pdb

ws_log

ord341 ord2

kernel32

WideCharToMultiByte lstrlenW FindFirstFileA FindNextFileA MultiByteToWideChar FindClose LoadLibraryA GetProcAddress FreeLibrary lstrlenA DeleteCriticalSection GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind GetLastError HeapFree HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep HeapSize ExitProcess CloseHandle EnterCriticalSection LeaveCriticalSection ReadFile SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleHandleA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc WriteFile GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CreateFileA GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile

gdi32

DeleteObject

oleaut32

SysAllocString SysFreeString

Package/WSMHook.dll

IMPHASH 5a873bc51f3c384a4a7bf1b31b2864e0
SHA256 130394272e40da790af671753d100031751abd8a56c65af6c55737246b5b9507
MD5 0315a389dee69b1efc3918d149c0bc2e
SHA1 422cbea6099c076747b62ecc2173c635e533827f
SHA512 a9d10ecb828eb97fa79e0a7ab08781343a9d3e3f3caa9fe33f403f95b5195ad81eb79be3b55e532c6a0d76cc7977444e20f427b37d1b47c0820df9e985eab94a
SSDEEP 1536:L+iO0kd4XTxdXyvmgq0Al/qX+cR5THsWjcdoKkm0FVTw:L+iO0NC+k58oKkmMh
TLSH
T176936A0172D19078D8BF4A3D7C6966100B2DBA25DBF8AAD72FDC145D9EB12E06E31B13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15665

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\ws\Desktop\WSMHook\Release\WSMHook.pdb

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Package/WSUtilities.dll

IMPHASH e32e125d57a484b54aa6d2d3aed847ac
SHA256 30b9b877aa1112105069be6b4de794b7a7147a1d968e71fa63f2edc7397e126f
MD5 54b87d3271a4fa9b1e1fea51c2ef9c14
SHA1 fd79e145376a6268827ed9693f276c6bb8bca326
SHA512 88bad2b2137f85e5faef07893bd400fcc4206cbf64655b223e63af743800f13eeb36cae55b5fb3edb907c6e2f623f27075acb10538ecf8bbd597e126a8977ebe
SSDEEP 3072:o1xNna70jpS3wOGvWhLdT24Nz0PPDKv6i2DZ6BTNbcGpDhaupU:KbtS3PGvBqR2l6BTN9JBp
TLSH
T1BD04AD01B2C9C17BC68F1374843BDB7A66797964473487CBE7D81E794F112C2AB3A24A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

79680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

PathFileExistsA StrCmpIW PathFileExistsW

kernel32

CreateFileW CreateFileMappingW WriteFile MapViewOfFile CloseHandle GlobalFree SetFilePointer SetEndOfFile GetFileSize SetLastError lstrcmpiA GetLastError WideCharToMultiByte MultiByteToWideChar UnmapViewOfFile SetUnhandledExceptionFilter CreateFileA LoadLibraryA GetLocaleInfoW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapSize GetModuleFileNameA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID ExitProcess InterlockedIncrement InterlockedDecrement InterlockedExchange Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter GetModuleHandleA IsDebuggerPresent GetCPInfo HeapFree HeapAlloc GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringA LCMapStringW GetStringTypeW GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers GetStringTypeA HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc

advapi32

RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegCloseKey RegQueryValueExW RegOpenKeyExW RegQueryValueExA

shell32

ShellExecuteW

ole32

CLSIDFromProgID CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysAllocString VariantInit VariantClear

winhttp

WinHttpSetOption WinHttpOpenRequest WinHttpConnect WinHttpAddRequestHeaders WinHttpSetTimeouts WinHttpOpen WinHttpCloseHandle WinHttpSendRequest WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpWriteData WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpCrackUrl

Package/WS_ImageProc.dll

IMPHASH 2e9568585d9ce042f15bc3373f174a2d
SHA256 58ef42507d9fc1e8a7b240ef5cddc9f600c3d9a61ee6a42a4045278bb332b86a
MD5 23b3a972dc6e25581b6fa9e01bafc375
SHA1 39b54451f58d16cc76f875c137d72c2fe93bb3af
SHA512 d69e04a8f9ba25dc4bcb4ae9b53122243b8419b658314e92892624b1ee70b3cbb8662be3f0fa9181b1653ddd677c28677e1f8ea212bbb577f1d3ee641921106a
SSDEEP 3072:f8Wacf55wj0XUcz4pEM4rsJLtOsAg0FuLBNEBNz6cQoopW+T7:f89cR5wjtcLbULtOsAO1io4o
TLSH
T1D924AD00B6E3C0F3C9A71474445AFB5A5A25A3178770CAF773E90E7E9E342E05A3625B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69441

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\svn_code\Common\MultimediaPlatform\Branch\4.2.5_DVDCreator221957\Src\SymbolTable\Release\ImageProc.pdb

gdiplus

GdiplusStartup GdiplusShutdown GdipCloneBitmapAreaI GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromFile GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipSaveImageToFile GdipCloneImage GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromGdiDib GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipAlloc GdipFree

kernel32

GetStringTypeA GetLocaleInfoA LoadLibraryA GlobalAlloc GetStringTypeW LockResource LoadResource FindResourceW GetModuleHandleW GlobalFree GetModuleFileNameA InitializeCriticalSectionAndSpinCount CreateFileA MultiByteToWideChar WriteConsoleW GetConsoleOutputCP LCMapStringA LCMapStringW SetEndOfFile GetProcessHeap ReadFile WideCharToMultiByte InterlockedDecrement RtlUnwind GetLastError HeapFree HeapAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException GetCurrentThreadId GetCommandLineA GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError CloseHandle EnterCriticalSection LeaveCriticalSection WriteFile GetConsoleCP GetConsoleMode HeapCreate HeapDestroy VirtualFree DeleteCriticalSection VirtualAlloc HeapReAlloc Sleep ExitProcess GetStdHandle GetModuleHandleA SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle FlushFileBuffers SetFilePointer WriteConsoleA

user32

SetRect CopyRect IntersectRect GetDC ReleaseDC

gdi32

GetRegionData SelectPalette RealizePalette SetDIBitsToDevice CreateDIBitmap CreatePalette DeleteObject CreatePolygonRgn

Package/WS_Log.dll

IMPHASH 88782d69dc039f6c55bccd88c114f35f
SHA256 e841fe9fa09ddc4292f22db95cb2d348d8f37594513f5848d545db92e3b07c66
MD5 c63b86e4e9290bf304e86e03c8a1f235
SHA1 6d75607cf590ae4d65b79ffab3f9f4f56700b932
SHA512 46815f66d49b3f20aa91761178f03d37b60c902882016d1d9f64aae5b21ba302aa064fca2e27609faa957198acf73a017208fc514c3d11f878f21b9b9407d00a
SSDEEP 3072:XFoYyQjQpTJVKp5fSb0pR/grZXEKKdeFazpvhqlMhsR+oTMa5EN5s:gtp3OfSITSZUKKdeFchsSNnM
TLSH
T183247B027786C073D9670134451AC7766A7BF4780B399AC7F7DC0A7A4F266C29E3638A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

76457

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\Wondershare2018\DVDCreator\MultimediaPlatform\4.2.5_DVDCreator\Src\SymbolTable\Release\WS_Log.pdb

d3d9

Direct3DCreate9

bugsplat

??0MiniDmpSender@@QAE@PBG000K@Z ??1MiniDmpSender@@UAE@XZ ?createReport@MiniDmpSender@@QAEXXZ ?setCallback@MiniDmpSender@@QAEXP6A_NIPAX0@Z@Z

kernel32

FindNextFileW FindFirstFileW GlobalUnlock GlobalLock GlobalAlloc CloseHandle GetCurrentProcessId WriteFile SetFilePointer GetCurrentProcess DeleteFileW CreateFileW GetCurrentThreadId FindClose GetPrivateProfileStringW MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GlobalMemoryStatus GetVersionExW GetUserDefaultLangID SetEndOfFile ReadFile LoadLibraryW lstrcatW GetTempPathW FreeLibrary GetProcAddress TerminateProcess GetTickCount GetModuleFileNameW CreateDirectoryW CompareStringA GetProcessHeap CreateFileA GetLocaleInfoW WideCharToMultiByte CompareStringW SetUnhandledExceptionFilter UnhandledExceptionFilter WriteConsoleW GetConsoleOutputCP WriteConsoleA InterlockedIncrement InterlockedDecrement Sleep RtlUnwind SetEnvironmentVariableA IsDebuggerPresent RaiseException GetSystemTimeAsFileTime SetStdHandle GetLastError GetFileType DeleteFileA HeapFree GetCommandLineA LCMapStringA LCMapStringW GetCPInfo HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize ExitProcess GetConsoleCP GetConsoleMode FlushFileBuffers SetHandleCount GetStdHandle GetStartupInfoA GetTimeZoneInformation GetACP GetOEMCP IsValidCodePage GetTimeFormatA GetDateFormatA InitializeCriticalSectionAndSpinCount GetModuleFileNameA GetModuleHandleA HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetLocaleInfoA GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale LoadLibraryA

user32

MessageBoxW wsprintfW GetSystemMetrics

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

winmm

timeKillEvent timeSetEvent

Package/WsBurn.dll

IMPHASH cc377672d892da05d7a9626c80ee4bbb
SHA256 8fcae9719a3f831cb73ef50b587a6222ff73d6c1a6ae617636cb31c6e02d5e3a
MD5 c6328e8342538b7e2502b752e5cb1e28
SHA1 fdbb116ce30ea6a0a61fd0e36084dfb26e683b22
SHA512 3942aa6e7311bef329c049c109e6d9c27a439c3dafa87ec7020c43e878cfa87e741b22d65603bec8d3a0da978405eb64c3a744fd0ac0644680968f682d4aca3a
SSDEEP 24576:abK9oW4egvcZwuRRWRjFj63KP0wCkjgLwG0osspaa:ab+YvcecRCj63KP0wCZaossEa
TLSH
T1CAC5910369928B76C4BC50B485DA527853363C5CAE804F9E7BCCE27434D3574BEA2BAD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\Wondershare2018\DVDCreator\WSBurn\Trunk\Src\SymbolTable\Win32\Release\WSBurn.pdb

ws_log

ord2

kernel32

CreateFileA WriteFile WideCharToMultiByte GetTimeZoneInformation MultiByteToWideChar GetLastError CloseHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP CreateEventW ResetEvent FindClose Sleep SetEvent WaitForSingleObject InterlockedDecrement InterlockedIncrement FindFirstFileW SetEndOfFile GetSystemTime CompareStringA LoadLibraryExA GetTempPathW GetTempFileNameW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind HeapFree HeapAlloc GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetStdHandle GetModuleFileNameA ExitProcess SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA GetLocaleInfoA FreeLibrary InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW GetProcessHeap CompareStringW SetEnvironmentVariableA GetVersionExA GetFileSize SystemTimeToFileTime ReadFile SetFilePointer CreateFileW GetFullPathNameW DeviceIoControl GetLocalTime InitializeCriticalSection GetModuleHandleA FileTimeToSystemTime FileTimeToLocalFileTime FindNextFileA FindFirstFileA DuplicateHandle FlushFileBuffers OutputDebugStringW MoveFileW DeleteFileW CreateEventA CreateThread MulDiv GetFileTime IsBadWritePtr OutputDebugStringA GetFileAttributesA DebugBreak SetFilePointerEx

ole32

CoTaskMemFree CoUninitialize CoCreateInstance CoInitializeEx CoInitialize

oleaut32

SysAllocString SafeArrayGetUBound SysFreeString SysStringByteLen SafeArrayGetVartype SafeArrayGetLBound SysAllocStringByteLen DispGetIDsOfNames SafeArrayDestroy SafeArrayUnlock DispInvoke SafeArrayLock LoadRegTypeLi

shlwapi

PathFileExistsA SHCreateStreamOnFileEx

user32

SystemParametersInfoA LoadIconA LoadCursorA SetWindowPos GetDesktopWindow DestroyCursor GetDC ScreenToClient GetWindowRect GetDlgItem GetClientRect SetWindowTextA GetWindowLongA DialogBoxIndirectParamA DestroyIcon SetCapture BeginPaint DrawIcon EndPaint ReleaseCapture PtInRect EndDialog SetCursor SetWindowLongA DrawTextA GetProcessWindowStation GetUserObjectInformationA MessageBoxA ReleaseDC

gdi32

DeleteObject SetBkMode SetTextColor CreateFontIndirectA GetTextExtentPoint32A SelectObject

advapi32

RegQueryValueExA RegQueryValueExW RegCloseKey RegOpenKeyExA

shell32

ShellExecuteA

Name

.text

Size

524KB

Virtual Size

524KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

SPTD

Size

512B

Virtual Size

233B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Package/cdid3.dll

IMPHASH 21d7c8298419b2b2e8ccb86dfb5c9e3b
SHA256 12b9a086e988c7899c2f24cc6ae0c9b9b5c95e6c5b545c15586f9ad4425f4eef
MD5 f420037d048e9fb65f62f2daca9e8dfb
SHA1 ba9091d6bb30bdeec2e5186aeaa9b33fa17602f6
SHA512 16097d0c49b7f3563d61891a9f5b1b7a685c7c9e30f244db39f5ed2ffb03a39df2effaf5228f653702a591ccacf97c88d07418931c3a68b4c222184f20b65430
SSDEEP 12288:m+HZF6Sg+qf91pJJgqQvAP+Z+1x50hspy888888888888W88888888888xu:V5Fi+I91pPgqdeYkhXu
TLSH
T16AE42A12A7E98432D1736E7B4C6FC5A96C167D311EE4A54A3FB8DF4C0E39B4168342A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

04:9e:71:75:6c:4c:50:c5:da:ee:b6:c2:15:e7:68:54:20:ad:25:09:d9:9f:c1:d0:87:c6:e6:7b:f9:4b:e4:48

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

Chains

May 5, 2019

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

ef:af:8d:09:79:11:8a:51:47:a6:0e:63:c7:d6:9b:7c:62:94:c3:50

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

Chains

May 5, 2019

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

Subject

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

Serial Number

02:f7:b0:7c:55:25:b8:c9:07:01:6c:37:79:8a:63:55

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 27, 2019 - Apr 11, 2020

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

Serial Number

0f:7c:6a:d9:68:4b:16:0a:25:99:89:6f:d7:9a:9e:4d

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Apr 11, 2020

Minor OS version

Major OS version

Entry point

581648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegFlushKey RegCloseKey

user32

GetKeyboardType LoadStringW MessageBoxA CharNextW CreateWindowExW WindowFromPoint WaitMessage UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups SetWindowsHookExW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursor SetClipboardData SetClassLongW SetCapture SetActiveWindow SendMessageA SendMessageW ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassW RedrawWindow PostQuitMessage PostMessageW PeekMessageA PeekMessageW OpenClipboard OffsetRect MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LoadStringW LoadKeyboardLayoutW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsIconic IsDialogMessageA IsDialogMessageW IsChild InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropW GetParent GetWindow GetMessagePos GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassLongW GetClassInfoW GetCapture GetActiveWindow FrameRect FindWindowExW FindWindowW FillRect EnumWindows EnumThreadWindows EnumChildWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextExW DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CloseClipboard ClientToScreen CheckMenuItem CharUpperBuffW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BeginPaint AdjustWindowRectEx ActivateKeyboardLayout

kernel32

GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle CloseHandle TlsSetValue TlsGetValue TlsFree TlsAlloc LocalFree LocalAlloc lstrcpyW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualAlloc SwitchToThread SizeofResource SignalObjectAndWait SetThreadLocale SetLastError SetFilePointer SetEvent SetErrorMode SetEndOfFile ResumeThread ResetEvent ReadFile MultiByteToWideChar MulDiv LockResource LoadResource LoadLibraryW LeaveCriticalSection InitializeCriticalSection GlobalUnlock GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetVersionExW GetVersion GetTickCount GetThreadLocale GetTempPathW GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileAttributesW GetExitCodeThread GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCPInfo FreeResource InterlockedIncrement InterlockedExchangeAdd InterlockedExchange InterlockedDecrement InterlockedCompareExchange FreeLibrary FormatMessageW FindResourceW FindFirstFileW FindClose EnumCalendarInfoW EnterCriticalSection DeleteFileW DeleteCriticalSection CreateThread CreateFileW CreateEventW CompareStringW CloseHandle Sleep

msimg32

AlphaBlend

gdi32

UnrealizeObject StretchBlt SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetEnhMetaFileBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SelectPalette SelectObject SaveDC RestoreDC Rectangle RectVisible RealizePalette PlayEnhMetaFile PatBlt MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectW GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits FrameRgn ExcludeClipRect DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRectRgn CreatePenIndirect CreatePalette CreateHalftonePalette CreateFontIndirectW CreateDIBitmap CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW BitBlt

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ole32

OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc

shell32

ShellExecuteW

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create

wsock32

ntohl htonl

Name

.text

Size

522KB

Virtual Size

522KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

tmp5ccud765

Package/BugSplat.dll

PE Signature issue

wininet

shlwapi

kernel32

user32

advapi32

ole32

oleaut32

urlmon

version

rpcrt4

generic

Package/COMSupport.dll

kernel32

ole32

oleaut32

generic

Package/Closkleelthou.tz

Package/DVDSetting.dll

kernel32

generic

Package/ExceptionHandler.dll

userenv

psapi

kernel32

advapi32

ole32

generic

Package/ModSolar.exe

oleaut32

advapi32

user32

kernel32

msimg32

gdi32

version

mpr

ole32

comctl32

wininet

shell32

comdlg32

winspool.drv

wsock32

gdiplus

ws_log

nleservice

wsutilities

nleresource

dvdsetting

comsupport

ws_imageproc

wsburn

shlwapi

winmm

cdid3

wsmhook

generic

Package/ModSolar.ini

Package/NLEResource.dll

nletransitionmgr

ws_log

ws_imageproc

dvdsetting

kernel32

gdi32

ole32

oleaut32

generic

Package/NLEService.dll

nleresource

nletransitionmgr