tmprin4oekj
- SHA256 d0c05c47ca56329eb65d220b90f65583732ed5873ea318f170a3be3f4b2292d8
Behavioral task
behavioral1
Sample
tmprin4oekj.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmprin4oekj.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmprin4oekj.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target tmprin4oekj
- Size 5.3MB
- Sample260601-rtccesfx2x
- SHA256 d0c05c47ca56329eb65d220b90f65583732ed5873ea318f170a3be3f4b2292d8
- MD5 aae3067578dbdfa7acb7cb8fcbbe5cd1
- SHA1 b05df97ea22c167a6a1553071db54a3edfc71bd2
- SHA512 1c7e74dda9c5969f83f1ec27cdbe856eb491a9ddb975eb7ad5fb9c335f6e43079f1b7bb3fbb7477d4fa428a1240dfec83d6ac135ead829029bb63c098fb76960
- SSDEEP 98304:R89yy48vPGo8K4/u3W8aXFOFlUceXaFDSDNaXhu6P07KmtzDwdrtmSGj4sjwPCtV:R8AKUWGFPhNaXujFDert9sjKCto0FN
- TLSH T13D46339D430B9B33F0E1AA51B4944C96F86FA603D3E51F901B12A957B409BEB0EC39DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\writerFirefox
-
inject_dll
%windir%\SysWOW64\pla.dll
xor.hex
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule static1/unpack001/Package/Prumchartfeen.rl family_hijackloader - Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/Package/ies_Core.dll
File Explorer
-
tmprin4oekj.zip 5.3MB
-
Package/Bunboultheeg.cxy87KB
-
Package/Prumchartfeen.rl4.6MB
-
Package/USilv.exe.exe 1.4MB
-
Package/ies_Core.dll.dll 1.1MB
Package/Bunboultheeg.cxy
- SHA256 989c5db23463d8fa6b56f009e82c094b33089238cac8a734a1bc56be147c89b2
- MD5 3f469bfb720e69e081407aeb1eb96478
- SHA1 95d92e6e20c59ff8a2cde7894362b5c3f266f7e2
- SHA512 fc7375cdaf219342e85a881ade1eb5a903fd90f89d2bf01e0b63a296d538b143880df22d43dc8ab41fe61106b6d26d48dc0ca059d2f1b4467ff0e58d753f84a3
- SSDEEP 1536:req9TIXCaxfx7L9UrhhJrCmqySV80vVclgg5fl8NuFKJ5tV:rRIXCaxZa3JC3V80vVFCl8Nu0XtV
- TLSH T13993CB7167ED2F4BF533BD3A8580B5679985B9B62627C0D5A9821B1F803DC90CF60B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Package/Prumchartfeen.rl
- SHA256 f9796e3694c8a0b9382bb271eed389e1ac238ce25e1eb96a254f795d4448cd07
- MD5 59176b6d68112871846851369a3c4930
- SHA1 d11e8f01771731df059fbc62c09a6282debd50ff
- SHA512 98517c874280873ddd5316f6db0e28d92a2a606a2dfdb2b45292f0d001557b289e75d23bf9b96e74bd91012c684c2ec8ea3980b95a16e5ca4a0a417f850cdaa9
- SSDEEP 98304:+x1WqSrq5qnXJV+rzVRNhDwEBw8T2LdNROH/HKr:+PWqkXevV3qyp2LdNROfKr
- TLSH T17B2623B09586F3F3FC00CABF7FA5294A3994DDE00416814AD23E548B978D745EA4E36E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects HijackLoader (aka IDAT Loader)
Package/USilv.exe
- IMPHASH 7f61c602fd9fa44839cfe6b5fbe08310
- SHA256 a978b51372a5185007be36e7b808fc09d88453188378b34e90ecbd5de726d5a0
- MD5 f4302fe795f09128d6046db4b96ace59
- SHA1 e33a34c57029e1ede8237ae240840fa1b8c6f1f5
- SHA512 a0b818a9d89d3a4a5022683c81c5c14bbd609920ea0d14864556577a621bbb61e860123f1ef09f42aade3b8698842c5ad57536f2e9ab555d3b40c6ccd90479d1
- SSDEEP 24576:lPhHSBvVKWlASFzSTzxJKf+g+J6RhEsDMa9WJzJEbk3RfkZMNp9Bu77Q:ov9lRzSTzxJKf+3sDRfbk3RfkZMNl
- TLSH T159657E83A597A1A1E67F8CF4E021FE2B60797F50D0D0C2F774C82C76B917AA61376612
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
23:d6:76:6c:e6:c9:c2:23:ff:51:37:86:35:54:07:a5:8f:8a:29:8f:9d:eb:cd:5d:3b:cd:ac:fa:bd:a4:0e:7a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE
Chains
Feb 2, 2025
CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Digest
ec:f4:81:1f:47:49:57:88:15:8e:e6:d3:b5:70:6f:11:d7:4b:f1:c8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE
Chains
Feb 2, 2025
CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE
Serial Number
a2:a9:08:26:6d:26:be:22:4f:d6:21:19:fd:95:ae:3c
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 16, 2024 - Sep 16, 2027
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
1
Major OS version
5
Entry point
944397
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SearchPathW
InterlockedDecrement
TerminateThread
InterlockedIncrement
OpenThread
CreateDirectoryW
RemoveDirectoryW
GetCurrentDirectoryW
GetWindowsDirectoryW
SetCurrentDirectoryW
LocalFree
GetFileTime
MultiByteToWideChar
FormatMessageW
FileTimeToLocalFileTime
GetTimeFormatW
SystemTimeToFileTime
WideCharToMultiByte
GetDateFormatW
GetVolumeInformationW
GetProcessId
SetEndOfFile
OpenProcess
GetTimeZoneInformation
GetCurrentProcessId
DecodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
SetFileAttributesW
IsValidCodePage
FindFirstFileExW
LCMapStringW
GetStringTypeW
GetFileType
HeapAlloc
HeapFree
GetACP
GetModuleHandleExW
GetStdHandle
VirtualQuery
VirtualProtect
VirtualAlloc
RaiseException
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
RtlUnwind
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetFileAttributesW
GetTempPathW
GetSystemInfo
GetDiskFreeSpaceW
CopyFileW
SetThreadExecutionState
DeleteCriticalSection
GetLocalTime
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FindNextFileW
EnterCriticalSection
ConnectNamedPipe
GetOverlappedResult
SetEvent
GetLastError
CreateEventW
WaitForSingleObject
CreateNamedPipeW
CancelIo
FreeLibrary
DeleteFileW
GlobalMemoryStatusEx
LoadLibraryW
GetSystemPowerStatus
SetErrorMode
GetCurrentProcess
QueryPerformanceCounter
GetModuleHandleW
ExitProcess
Beep
WriteConsoleW
GetProcAddress
FindResourceW
LoadResource
QueryPerformanceFrequency
LockResource
SizeofResource
GetTickCount
CreateThread
FileTimeToSystemTime
GetExitCodeThread
FindClose
FindFirstFileW
InterlockedExchangeAdd
InterlockedCompareExchange
InterlockedExchange
GlobalUnlock
IsBadReadPtr
GlobalLock
GlobalFlags
IsBadCodePtr
GetExitCodeProcess
CreateProcessW
MoveFileExW
GetCurrentThreadId
TerminateProcess
GetSystemTime
GetFileSize
CloseHandle
GlobalSize
Sleep
CreateFileW
SetFilePointer
WriteFile
ReadFile
GlobalFree
GetOEMCP
GlobalAlloc
user32
SetDlgItemTextW
ValidateRect
GetDlgItemTextW
IsDlgButtonChecked
SetFocus
TranslateAcceleratorW
EnumThreadWindows
GetDlgItem
IsIconic
GetWindowThreadProcessId
GetWindow
WaitForInputIdle
PeekMessageW
SendDlgItemMessageW
DialogBoxIndirectParamW
IsWindowEnabled
EnumWindows
BringWindowToTop
PostQuitMessage
SetForegroundWindow
EnableWindow
MessageBeep
FindWindowExW
DestroyIcon
GetParent
ScreenToClient
ClientToScreen
IsChild
SetMenuInfo
GetSysColor
SystemParametersInfoW
CopyImage
GetDesktopWindow
GetMessageW
PostMessageW
LoadAcceleratorsW
GetCapture
MonitorFromWindow
ReleaseCapture
SetDlgItemInt
EnableMenuItem
GetSysColorBrush
CheckDlgButton
IsZoomed
GetDlgItemInt
DestroyMenu
GetDlgCtrlID
GetClassNameW
TrackPopupMenu
LoadMenuW
EndPaint
BeginPaint
InvalidateRect
GetSubMenu
UpdateWindow
ModifyMenuW
AppendMenuW
SetCapture
CreatePopupMenu
DispatchMessageW
TranslateMessage
KillTimer
GetClientRect
IsRectEmpty
SetTimer
ShowWindow
EndDialog
LoadImageW
InflateRect
LoadIconW
DialogBoxParamW
PtInRect
GetWindowLongW
DefWindowProcW
MonitorFromPoint
GetWindowRect
DestroyWindow
GetDC
IsWindowVisible
SetWindowPos
SetActiveWindow
FillRect
CreateWindowExW
GetIconInfo
GetCursor
UnregisterClassW
RegisterClassExW
WindowFromPoint
IsWindow
GetAsyncKeyState
GetMonitorInfoW
GetWindowDC
SetWindowLongW
UpdateLayeredWindow
DrawIconEx
GetClassInfoExW
ReleaseDC
GetCursorPos
SendMessageW
OffsetRect
IntersectRect
SetRect
GetSystemMetrics
LoadCursorW
SetCursor
GetWindowTextLengthW
GetMenu
MessageBoxW
EnumChildWindows
SetWindowTextW
DrawTextW
GetWindowTextW
GetMenuItemInfoW
GetMenuItemCount
SetMenuItemInfoW
gdi32
GetTextExtentPoint32W
TextOutW
GetTextMetricsW
GetDeviceCaps
CreateFontW
GetTextFaceW
GetTextExtentExPointW
IntersectClipRect
CreateFontIndirectW
SelectClipRgn
BitBlt
GetCurrentObject
SetStretchBltMode
GetDIBits
StretchDIBits
StretchBlt
SetBrushOrgEx
SetTextJustification
GetCharABCWidthsW
GetObjectType
SetTextCharacterExtra
DeleteObject
SetBkColor
SetBkMode
SetTextColor
SelectObject
DeleteDC
CreateCompatibleDC
CreateDIBSection
GetObjectW
GetStockObject
GdiFlush
CreateSolidBrush
comdlg32
GetOpenFileNameW
CommDlgExtendedError
advapi32
RegOpenKeyExW
GetNamedSecurityInfoW
GetUserNameW
RegCloseKey
FreeSid
RegQueryValueExW
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
shell32
SHGetFolderPathW
DragFinish
ord155
DragQueryFileW
ShellExecuteExW
SHGetDesktopFolder
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
comctl32
ord17
mscms
TranslateBitmapBits
CloseColorProfile
DeleteColorTransform
GetStandardColorSpaceProfileW
CreateMultiProfileTransform
OpenColorProfileW
Name
.text
Size
1013KB
Virtual Size
1012KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
306KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=136, id=243, version=40116,
count=36, id=242, version=40116,
count=36, id=261, version=26706,
count=21, id=260, version=26706,
count=26, id=259, version=26706,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=375, id=1, productName=Unmarked objects,
count=42, id=265, version=27053,
count=1, id=255, version=27053,
count=1, id=258, version=27053,
Package/ies_Core.dll
- IMPHASH a9d7ace2c966fc51329d4f58b378bc3e
- SHA256 7697c1d421f447a6b9b4f3b942380d2c479bb03a656fb3c262472b55d4df2bfc
- MD5 562487ace377e0ddd9488d6cce77f00d
- SHA1 02476fea46e90e437cb4e3aee191d9a101c8faeb
- SHA512 a6503030d001814f8d43ccb1c1065c100792762e989400343ebef12643ae5ed210b8640b2c87fddd4d9f1fbbc950555acc84e7e015a91a7b5045eab3cfc1396a
- SSDEEP 24576:+cFvpHsz+jFmXWrg5S3pB0Lo7uncBXQti/JYj9BHM7N:RXHVjFmb5S3pB0U7unKXE+JYQ
- TLSH T18F456C81BA82A2B1EA6E1DB05125FF97813EBB90D1D4C2F779C40C7A5E03ED643B3651
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
fd:8b:3b:fe:5a:c2:09:78:6d:25:fc:40:94:c8:ca:e6:52:7c:52:5a:4d:ec:1f:2c:ba:d7:f5:7c:62:47:5f:59
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE
Chains
Feb 2, 2025
CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
PE Signature issue
Digest
91:f5:8c:43:05:f7:f4:38:81:61:3f:00:5c:2a:6b:f0:e3:42:3a:4a
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE
Chains
Feb 2, 2025
CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=John Paul Chacha,O=John Paul Chacha,ST=Nairobi City,C=KE
Serial Number
a2:a9:08:26:6d:26:be:22:4f:d6:21:19:fd:95:ae:3c
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 16, 2024 - Sep 16, 2027
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
1
Major OS version
5
Entry point
800552
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
OpenThread
CreateDirectoryW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentDirectoryW
SetCurrentDirectoryW
LocalFree
CopyFileW
GetFileTime
MultiByteToWideChar
FormatMessageW
SystemTimeToFileTime
WideCharToMultiByte
GetVolumeInformationW
SetEndOfFile
GetTimeZoneInformation
ExitProcess
GetCurrentProcessId
QueryPerformanceFrequency
QueryPerformanceCounter
DecodePointer
WriteConsoleW
HeapSize
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
SetStdHandle
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
CreateThread
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
HeapReAlloc
GetConsoleMode
LCMapStringW
CompareStringW
GetStringTypeW
GetFileType
GetStdHandle
HeapAlloc
HeapFree
GetACP
GetModuleFileNameA
GetModuleHandleExW
VirtualQuery
VirtualProtect
VirtualAlloc
RaiseException
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
RtlUnwind
InterlockedFlushSList
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
TerminateThread
GetExitCodeThread
InterlockedDecrement
SearchPathW
MoveFileExW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
GetTempPathW
GetTickCount
SetThreadExecutionState
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
EnterCriticalSection
GetExitCodeProcess
ConnectNamedPipe
InterlockedIncrement
CreateProcessW
GetOverlappedResult
SetEvent
CreateEventW
GetCurrentThreadId
WaitForSingleObject
CreateNamedPipeW
TerminateProcess
CancelIo
FreeLibrary
GetVersionExW
GetSystemPowerStatus
GetCurrentProcess
InterlockedExchangeAdd
InterlockedCompareExchange
InterlockedExchange
GlobalUnlock
IsBadReadPtr
GlobalLock
GlobalFlags
IsBadCodePtr
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetSystemInfo
GetLastError
SetErrorMode
GetSystemTime
GetFileSize
CloseHandle
GlobalSize
Sleep
CreateFileW
SetFilePointer
WriteFile
ReadFile
GlobalFree
GetEnvironmentStringsW
GlobalAlloc
user32
PtInRect
GetWindowRect
SystemParametersInfoW
IsDlgButtonChecked
GetMonitorInfoW
SetMenuItemInfoW
GetSubMenu
GetMenuItemCount
GetMenuItemInfoW
GetWindowTextW
MonitorFromWindow
SetWindowTextW
EnumChildWindows
MessageBoxW
GetMenu
GetWindowTextLengthW
GetSystemMetrics
SetWindowPos
SetFocus
DialogBoxIndirectParamW
DestroyIcon
GetCursor
DialogBoxParamW
GetDesktopWindow
InvalidateRect
IsWindow
LoadCursorW
SetCursor
GetWindowLongW
EndDialog
MessageBeep
ShowWindow
GetDlgCtrlID
SetDlgItemTextW
GetDlgItemTextW
SendDlgItemMessageW
GetSysColor
GetDlgItem
GetSysColorBrush
GetParent
IsIconic
gdi32
DeleteDC
GetObjectType
SetTextColor
SetBkColor
DeleteObject
CreateDIBSection
BitBlt
SetBrushOrgEx
CreateFontW
GetTextFaceW
GdiFlush
CreateCompatibleDC
SelectObject
GetCurrentObject
SetStretchBltMode
GetObjectW
SelectClipRgn
StretchBlt
StretchDIBits
advapi32
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
FreeSid
shell32
SHGetFolderPathW
SHGetFileInfoW
ShellExecuteW
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
mscms
CloseColorProfile
DeleteColorTransform
GetStandardColorSpaceProfileW
CreateMultiProfileTransform
OpenColorProfileW
TranslateBitmapBits
core_Entry
core_GetSysInfoStr
core_ImageInfo
core_LoadImage
core_LoadImageGDI
core_LoadThumb
core_LoadThumbGDI
core_MarkupFromEXIF
core_MarkupToEXIF
core_Notify
core_SaveImage
core_ShowDialog
Name
.text
Size
876KB
Virtual Size
875KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
193KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=241, version=40116,
count=154, id=243, version=40116,
count=32, id=242, version=40116,
count=28, id=261, version=26706,
count=19, id=260, version=26706,
count=25, id=259, version=26706,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=325, id=1, productName=Unmarked objects,
count=54, id=265, version=27053,
count=1, id=256, version=27053,
count=1, id=255, version=27053,
count=1, id=258, version=27053,