IZ_LiveLet[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
IZ_LiveLet.exe
Size 8.4MB
Sample260602-anvs5sa18n
SHA256 b98477bb6c6945e25f2293456c47c625dfb2296f467716ecf61d81f991f74d2f
MD5 aa0ad71f9577d74aed8ec3736ae03a9b
SHA1 a4204a4f4910912a10e3605864cf5e7a5b18b602
SHA512 eb3c68244150b7e496001453e6ab0c6c1cc7dfa9270c0a71f81a95815a1b64e649ba491c964f32b17dade9521ed0e641e06d8e72f94a113c6d366443e5908f42
SSDEEP 196608:rtQOigIKAcqYPs9uTGHWjd8IaY8Cy7uFFoI:BQzKATasYOaGv97uToI
TLSH
T1CF96337BF2EAC828DAD1DF304424CA88BA5B0F431C5AC0164F62B95DBD36FEC515685B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/System.dll

Untrusted Codesign Signers 8 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack002/lcaresrv/ISHooks.dll
unpack002/lcaresrv/ISHooks64.dll
unpack002/lcaresrv/ishooks64.exe
unpack001/Livecare_demo.exe
unpack003/lcareview/ishview.exe
unpack001/Livecare_service.exe
unpack004/$APPDATA/Livecare/service/LivecareElevator.exe
unpack004/$APPDATA/Livecare/service/LivecareServiceLivelet.exe

NSIS installer 8 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Livecare_assistance.exe	nsis_installer_1
static1/unpack001/Livecare_assistance.exe	nsis_installer_2
static1/unpack001/Livecare_demo.exe	nsis_installer_1
static1/unpack001/Livecare_demo.exe	nsis_installer_2
static1/unpack001/Livecare_service.exe	nsis_installer_1
static1/unpack001/Livecare_service.exe	nsis_installer_2

File Explorer

IZ_LiveLet.exe

.exe 8.4MB
$PLUGINSDIR/System.dll

.dll 11KB
LiveLet.exe

.exe 11.7MB
Livecare_assistance.exe

.exe 1.9MB
$PLUGINSDIR/System.dll

.dll 11KB
lcaresrv/ISHooks.dll

.dll 169KB
lcaresrv/ISHooks64.dll

.dll 138KB
lcaresrv/RELEASE

6B
lcaresrv/ishooks64.exe

.exe 75KB
lcaresrv/ishsrv.exe

.exe 4.7MB
Livecare_demo.exe

.exe 717KB
lcareview/RELEASE

6B
lcareview/ishview.exe

.exe 1.6MB
Livecare_service.exe

.exe 930KB
$APPDATA/Livecare/service/LivecareElevator.exe

.exe 215KB
$APPDATA/Livecare/service/LivecareServiceLivelet.exe

.exe 2.0MB
$APPDATA/Livecare/service/RELEASE

6B
customicon.ico

140KB
customlogo.bmp

.png 10KB
livelet.ini

209B

IZ_LiveLet.exe

IMPHASH 57e98d9a5a72c8d7ad8fb7a6a58b3daf
SHA256 b98477bb6c6945e25f2293456c47c625dfb2296f467716ecf61d81f991f74d2f
MD5 aa0ad71f9577d74aed8ec3736ae03a9b
SHA1 a4204a4f4910912a10e3605864cf5e7a5b18b602
SHA512 eb3c68244150b7e496001453e6ab0c6c1cc7dfa9270c0a71f81a95815a1b64e649ba491c964f32b17dade9521ed0e641e06d8e72f94a113c6d366443e5908f42
SSDEEP 196608:rtQOigIKAcqYPs9uTGHWjd8IaY8Cy7uFFoI:BQzKATasYOaGv97uToI
TLSH
T1CF96337BF2EAC828DAD1DF304424CA88BA5B0F431C5AC0164F62B95DBD36FEC515685B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

34:b3:b5:53:0f:07:f5:dd:cc:d9:e6:a1:00:79:a5:f5:4c:db:eb:c7:98:a2:e9:13:70:3d:2d:09:07:af:dc:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Icona srl,O=Icona srl,L=Cinisello Balsamo,C=IT

Chains

Sep 25, 2024

CN=Icona srl,O=Icona srl,L=Cinisello Balsamo,C=IT

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Icona srl,O=Icona srl,L=Cinisello Balsamo,C=IT

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Icona srl,O=Icona srl,L=Cinisello Balsamo,C=IT

Serial Number

0c:c8:5d:eb:62:5e:25:c6:34:0f:1d:38:fa:b2:6d:a4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 22, 2024 - May 31, 2027

Minor OS version

Major OS version

Entry point

13096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetCurrentDirectoryA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
TLSH
T107324A5503604AF3E986843C086A3BBF6F796B2196F04E53DFA384C0EE6D5C96D78352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LiveLet.exe

IMPHASH d8c9d4d01a7cb01721ce821974fb491e
SHA256 9c7875f32761176319ddc06180953a8d5b9c0bf13aaaf7c79fcdd98e3fd9813a
MD5 524f37137336b01e133bbcf768eff8ab
SHA1 09a0accb203427694caae5a0acdae5ce87aaebef
SHA512 de61ae295e79d8994ebeecac5f135249c673ee7387975b0c6b78c254c83a719ed440500fbc4b8b732b104b03f31274a97c71168b27164056d64d325c9c3ada3d
SSDEEP 196608:gPyl8icrMQdG/7uIOP8qGntxr9vp/Q206daRzhSmjbKAULD6G5gLErqNjNL:IyUrBmKIOPjGRxtW/HwmLErqNRL
TLSH
T145C6D023BA808476C15302B15E5FF7B950BDEE701B3541C7A3D42B1D6EB06E26B3AA53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

1c:1f:48:e4:c4:96:24:62:0d:82:17:3f:4e:55:c1:3e:88:ab:4c:04:95:ae:27:dc:86:63:8d:9b:8c:e8:6d:ae

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

Chains

Mar 1, 2024

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

0d:f8:bc:8f:57:9a:99:54:69:dc:1c:23:dd:74:2d:fb:3e:8a:79:ee

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

Chains

Mar 1, 2024

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

Serial Number

09:f4:70:e1:62:51:cd:e6:6a:49:97:37:b8:aa:08:24

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - May 27, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6485237

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Sviluppo\livecare\lvs-livelet-win-master\Release Static\LiveLetApp.pdb

ws2_32

WSASetLastError WSAGetLastError WSARecv WSASend WSASocketW WSAStringToAddressW getaddrinfo freeaddrinfo getsockname ntohs WSACleanup getnameinfo recv send socket accept WSARecvFrom FreeAddrInfoW WSAStartup shutdown setsockopt select ntohl listen htons htonl getsockopt ioctlsocket connect closesocket GetAddrInfoW WSAIoctl gethostbyname bind WSADuplicateSocketW

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertGetCertificateContextProperty CertFreeCertificateContext CertOpenStore CertCloseStore

kernel32

GetLogicalDriveStringsW GetVolumeInformationW GetStartupInfoW VirtualAlloc VirtualFree lstrcmpW GetThreadPriority GetVersionExW VirtualProtect GetThreadLocale SetThreadLocale GetUserDefaultLangID GetExitCodeThread GetFileTime OutputDebugStringA GetDiskFreeSpaceExA GetDriveTypeA GetLogicalDrives GetVolumeInformationA GetDateFormatA GetTimeFormatA SetPriorityClass GetPriorityClass IsProcessorFeaturePresent GetNativeSystemInfo GetProcessAffinityMask SetThreadAffinityMask GetLogicalDriveStringsA RemoveDirectoryA DeleteFileA FindFirstFileA FindNextFileA CreateDirectoryA MoveFileA CopyFileA SuspendThread FileTimeToLocalFileTime GetFileAttributesExA GetFileSizeEx LocalFileTimeToFileTime SetFileAttributesA SystemTimeToTzSpecificLocalTime GlobalReAlloc GlobalHandle GetLongPathNameW lstrcmpA GlobalGetAtomNameA EncodePointer GetSystemDirectoryW FreeResource GlobalDeleteAtom FindResourceA GlobalFindAtomA GetFullPathNameA LockFile UnlockFile lstrcmpiA GlobalFlags GetUserDefaultUILanguage GetOEMCP GetACP lstrcpyA GetCurrentDirectoryA FindResourceExW GetWindowsDirectoryA GetProfileIntA SearchPathA WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeSListHead FreeEnvironmentStringsW GetEnvironmentStringsW IsValidCodePage FindFirstFileExW EnumSystemLocalesW IsValidLocale HeapQueryInformation VirtualQuery GetConsoleCP SetStdHandle FreeLibraryAndExitThread ExitThread SetCurrentDirectoryA SetEnvironmentVariableA GetDriveTypeW InterlockedFlushSList InterlockedPushEntrySList RtlUnwind AreFileApisANSI SetFileAttributesW GetFileAttributesExW DeleteFileW GetStringTypeW GlobalMemoryStatusEx SetEnvironmentVariableW ReadDirectoryChangesW GlobalAddAtomA GetShortPathNameW CreateHardLinkW MoveFileExW CopyFileW DeviceIoControl SetFileTime SetFilePointerEx RemoveDirectoryW GetFileInformationByHandle CreateDirectoryW LCMapStringW SetInformationJobObject AssignProcessToJobObject CreateJobObjectW UnregisterWaitEx CreateProcessW TerminateProcess GetCurrentDirectoryW SetConsoleCtrlHandler WriteConsoleW ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleTextAttribute SetConsoleCursorInfo SetConsoleCursorPosition GetConsoleCursorInfo GetConsoleScreenBufferInfo FillConsoleOutputAttribute FillConsoleOutputCharacterW WriteConsoleInputW SetThreadPriority CreateThread lstrlenW LocalSize LocalAlloc GlobalFree GlobalAlloc GetCPInfo GetFileAttributesW ExitProcess UnmapViewOfFile FlushViewOfFile MapViewOfFile CreateFileMappingW SetFilePointer SetEndOfFile GetFileSize CreateNamedPipeA QueueUserWorkItem GetCurrentThread SwitchToThread GetNamedPipeHandleStateW WaitNamedPipeW CreateNamedPipeW PeekNamedPipe SetNamedPipeHandleState ConnectNamedPipe DuplicateHandle FlushFileBuffers CreateFileW UnregisterWait RegisterWaitForSingleObject CancelIo SetHandleInformation GetModuleHandleA SetErrorMode DebugBreak LoadLibraryExA AllocConsole GlobalLock GlobalUnlock GlobalSize GetTempFileNameA GetTempPathA OutputDebugStringW GetUserDefaultLCID GetSystemDefaultLCID GetCurrencyFormatW GetNumberFormatW CompareStringA CompareStringW VerifyVersionInfoW GetComputerNameW GetModuleFileNameW QueryPerformanceFrequency GetFullPathNameW FindNextFileW FindFirstFileW FindClose ResumeThread CreateSemaphoreW ReleaseSemaphore ResetEvent TryEnterCriticalSection GetLocaleInfoW GetTimeFormatW GetDateFormatW GetTimeZoneInformation SystemTimeToFileTime FileTimeToSystemTime GetLocalTime GetSystemTime LoadLibraryExW SetConsoleMode ReadConsoleW ReadConsoleA GetConsoleMode GetEnvironmentVariableW LoadLibraryW ConvertThreadToFiber ConvertFiberToThread GlobalMemoryStatus QueryPerformanceCounter CreateFiber DeleteFiber SwitchToFiber GetSystemTimeAsFileTime GetModuleHandleExW GetModuleHandleW WriteFile GetFileType GetStdHandle GetSystemInfo GetExitCodeProcess GetCurrentProcess OpenProcess CreateProcessA GetTickCount MulDiv FindResourceW GetCommandLineW SizeofResource LoadResource LockResource FormatMessageA GetComputerNameExA GetComputerNameA GetCommandLineA SetProcessShutdownParameters CreateMutexA lstrcpynA ReleaseMutex MultiByteToWideChar VerifyVersionInfoA SetWaitableTimer CreateEventW SleepEx TlsFree TlsSetValue TlsGetValue TlsAlloc WaitForMultipleObjects QueueUserAPC PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort SetLastError TerminateThread InterlockedCompareExchange InterlockedExchangeAdd InterlockedExchange InterlockedDecrement InterlockedIncrement VerSetConditionMask CreateFileA ReadFile LocalFree FormatMessageW Sleep WideCharToMultiByte GetVersionExA MoveFileExA GetFileAttributesA WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA GetModuleFileNameA LoadLibraryA CreateEventA WinExec CloseHandle WaitForSingleObject SetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError TzSpecificLocalTimeToSystemTime GetCurrentThreadId RaiseException GetCurrentProcessId GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc GetProcAddress FreeLibrary DecodePointer CreateTimerQueue SignalObjectAndWait GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetThreadTimes InterlockedPopEntrySList QueryDepthSList ExpandEnvironmentStringsA lstrcatA lstrlenA GetVersion SetVolumeLabelA GetLocaleInfoA LocalReAlloc

user32

CopyRect RemovePropA GetPropA SetPropA ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow TrackPopupMenu SetMenu GetMenu GetDlgCtrlID SetWindowPlacement IsMenu GetClassInfoExA CallWindowProcA GetMessagePos LoadBitmapW SetMenuItemInfoA GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetWindowTextLengthA GetWindowTextA GetSysColorBrush WaitMessage GetLastActivePopup SetWindowsHookExA ValidateRect RemoveMenu AppendMenuA InsertMenuA GetMenuItemCount GetMenuItemID GetSubMenu GetMenuState GetMenuStringA LoadCursorA GetDlgItemTextA GetDlgItemInt SetDlgItemInt DialogBoxParamA CreateWindowExA RegisterClassExA DefWindowProcA LoadStringA SetWindowTextA SetDlgItemTextA GetDlgItem EndDialog GetClassInfoA RegisterClassA GetUserObjectInformationA CloseDesktop OpenInputDesktop MsgWaitForMultipleObjects GetQueueStatus PostThreadMessageW UpdateLayeredWindow SetWinEventHook MapVirtualKeyW IsClipboardFormatAvailable EmptyClipboard EnumClipboardFormats CountClipboardFormats RegisterClipboardFormatW GetClipboardData SetClipboardData GetClipboardSequenceNumber CloseClipboard OpenClipboard FindWindowW SetCaretPos DestroyCaret CreateCaret EqualRect SetActiveWindow LoadStringW GetIconInfo CreateIconIndirect DrawIconEx DestroyIcon GetDesktopWindow DrawFocusRect EnableScrollBar HideCaret RedrawWindow EndPaint BeginPaint GetForegroundWindow InvertRect CreatePopupMenu GetMenuDefaultItem MapVirtualKeyA GetKeyNameTextA SetLayeredWindowAttributes SetClassLongA AnimateWindow CreateWindowExW RegisterClassW MessageBeep GetDoubleClickTime NotifyWinEvent MonitorFromPoint GetScrollInfo SetScrollInfo LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow GetWindowThreadProcessId EnumThreadWindows GetParent SetClassLongW GetClassLongW SetWindowLongW IsRectEmpty WindowFromPoint MapWindowPoints ScreenToClient ClientToScreen GetCursorPos SetCursor AdjustWindowRectEx GetWindowRect GetClientRect GetWindowTextW SetWindowTextW InvalidateRect GetUpdateRect UpdateWindow EnableWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetAsyncKeyState GetFocus GetActiveWindow SetFocus CallMsgFilterW IsIconic IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos GetWindowPlacement MoveWindow DestroyWindow IsChild IsWindow RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW SendMessageW GetMessageExtraInfo PtInRect GetClassLongA GetClassNameA GetTopWindow WinHelpA GetMonitorInfoA CheckDlgButton SendDlgItemMessageA IsDialogMessageA CharUpperA DrawTextA DrawTextExA GrayStringA TabbedTextOutA GetWindowDC FillRect RealChildWindowFromPoint DestroyMenu GetMenuItemInfoA InflateRect SystemParametersInfoA CopyImage SetRectEmpty OffsetRect CreateDialogIndirectParamA GetMessageTime PeekMessageW DispatchMessageW GetMessageW GetNextDlgTabItem MapDialogRect IntersectRect TrackMouseEvent LoadImageW ShowOwnedPopups DeleteMenu GetKeyboardLayout GetNextDlgGroupItem RegisterWindowMessageW MessageBoxA EnumDisplayMonitors GetMonitorInfoW MonitorFromWindow SystemParametersInfoW EnumDisplayDevicesW GetKeyState DestroyCursor SetWindowRgn SetParent DrawStateA DrawEdge DrawFrameControl IsZoomed LoadMenuW GetSystemMenu GetWindowRgn CreateMenu CharToOemA OemToCharA SubtractRect TranslateMDISysAccel DefMDIChildProcA DefFrameProcA DrawMenuBar CharUpperBuffA RegisterClipboardFormatA ModifyMenuA SetMenuDefaultItem LockWindowUpdate SetRect CopyAcceleratorTableA DestroyAcceleratorTable CreateAcceleratorTableA LoadAcceleratorsW ToAsciiEx RegisterWindowMessageA SendMessageA PostMessageA FlashWindow SetWindowPos SetTimer KillTimer SetForegroundWindow FindWindowA LoadIconA LoadImageA GetMessageA TranslateMessage DispatchMessageA PeekMessageA GetKeyboardState ShowWindow GetDC ReleaseDC GetWindowLongA SetWindowLongA GetSystemMetrics ExitWindowsEx GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetWindowLongW MapVirtualKeyExA IsCharLowerA PostThreadMessageA GetComboBoxInfo ReuseDDElParam UnpackDDElParam InsertMenuItemA LoadMenuA TranslateAcceleratorA LoadAcceleratorsA UnionRect DrawIcon FrameRect CopyIcon SetCursorPos GetSysColor LoadCursorW LoadCursorFromFileA IsWindowEnabled BringWindowToTop

gdi32

MoveToEx TextOutA ExtTextOutA SetViewportExtEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx GetTextExtentPoint32A CombineRgn CreateRectRgnIndirect PatBlt SetRectRgn DPtoLP GetTextMetricsA EnumFontFamiliesExA CreatePalette SelectPalette GetPaletteEntries GetSystemPaletteEntries RealizePalette GetBkColor CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesA GetTextCharsetInfo SetPixel StretchBlt SetDIBColorTable CreateEllipticRgn Ellipse GetTextColor CreatePolygonRgn Polygon Polyline CreateRoundRectRgn LPtoDP Rectangle GetRgnBox OffsetRgn RoundRect FillRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceA SetTextAlign ExtSelectClipRgn SelectClipRgn RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel GetObjectType ExcludeClipRect Escape CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush SetTextColor SetBkColor CreateDCA CreateFontA CreateFontIndirectA SetViewportOrgEx SaveDC RestoreDC GetClipBox StretchDIBits GetObjectA GetFontUnicodeRanges EnumFontFamiliesExW CreateFontW GetGlyphIndicesW SetROP2 SetPolyFillMode GetLayout FrameRgn SetBkMode CreateBitmap SetLayout GetStockObject CreateSolidBrush EndPage StartPage EndDoc StartDocW CreateDIBSection SetMapMode DeleteObject CreateDCW BitBlt GetObjectW SelectObject GetDIBits DeleteDC CreateCompatibleDC AddFontMemResourceEx GetNearestPaletteIndex CopyMetaFileA GetDeviceCaps

msimg32

TransparentBlt AlphaBlend

comdlg32

PrintDlgW GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

winspool.drv

ord203 DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegQueryValueExW SetServiceStatus SetKernelObjectSecurity IsValidSid IsValidSecurityDescriptor IsValidAcl GetSecurityDescriptorSacl GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorControl GetSecurityDescriptorLength GetKernelObjectSecurity StartServiceCtrlDispatcherA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA GetUserNameA RegQueryInfoKeyA RegEnumKeyExA ImpersonateLoggedOnUser RevertToSelf CheckTokenMembership CreateProcessAsUserA LookupAccountSidA GetSidSubAuthority CreateWellKnownSid GetTokenInformation RegisterServiceCtrlHandlerA RegOpenKeyExW GetUserNameW CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey CreateProcessWithLogonW LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken StartServiceA QueryServiceStatusEx OpenServiceA OpenSCManagerA DeleteService CreateServiceA ControlService CloseServiceHandle

shell32

SHGetFileInfoA SHGetSpecialFolderLocation SHGetSpecialFolderPathA ShellExecuteExA Shell_NotifyIconA CommandLineToArgvW ShellExecuteA SHGetSpecialFolderPathW SHGetPathFromIDListW SHAppBarMessage SHBrowseForFolderA DragFinish DragQueryFileA SHGetDesktopFolder SHGetPathFromIDListA SHGetFolderPathA ShellExecuteW DragQueryFileW ord74 ord727 SHGetFileInfoW ShellExecuteExW Shell_NotifyIconW SHBrowseForFolderW

comctl32

ImageList_GetIconSize ImageList_DrawEx ImageList_Destroy

shlwapi

PathIsRelativeW UrlUnescapeA PathIsUNCA PathStripToRootA PathFindExtensionA PathFindFileNameA PathRemoveFileSpecW StrFormatKBSizeA

uxtheme

DrawThemeParentBackground GetThemeColor SetWindowTheme IsThemeBackgroundPartiallyTransparent GetThemePartSize DrawThemeBackground CloseThemeData OpenThemeData DrawThemeText GetWindowTheme IsAppThemed GetCurrentThemeName GetThemeSysColor

ole32

OleInitialize CoTaskMemFree OleUninitialize OleTranslateAccelerator CoCreateGuid CoCreateInstance RegisterDragDrop RevokeDragDrop DoDragDrop ReleaseStgMedium CreateStreamOnHGlobal CoTaskMemAlloc IsAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning CoLockObjectExternal OleGetClipboard CoDisconnectObject OleDuplicateData CoSetProxyBlanket CoInitializeEx CoInitialize CoFreeUnusedLibraries CoUninitialize

oleaut32

SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElement VariantClear SysAllocStringByteLen LoadTypeLi SysStringLen SystemTimeToVariantTime SysAllocString SysFreeString VariantInit VariantCopy VariantChangeType VarBstrFromDate VariantTimeToSystemTime SysAllocStringLen

gdiplus

GdipFillEllipse GdipFillPie GdipFillPath GdipDrawImageRectRect GdipSetClipRect GdipSetClipRectI GdipGetClipBoundsI GdipSaveGraphics GdipRestoreGraphics GdipBeginContainer2 GdipEndContainer GdiplusStartup GdiplusShutdown GdipDeleteFontFamily GdipGetEmHeight GdipGetCellAscent GdipGetLineSpacing GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipGetFontSize GdipCreateBitmapFromGraphics GdipCreateHBITMAPFromBitmap GdipDrawImageI GdipDrawDriverString GdipGetImagePixelFormat GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdipCreateBitmapFromHBITMAP GdipDrawImageRectI GdipFillRectanglesI GdipDrawLine GdipTransformPoints GdipSetPageUnit GdipGetWorldTransform GdipTranslateWorldTransform GdipAlloc GdipFree GdipMultiplyWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipGetSmoothingMode GdipSetSmoothingMode GdipSetCompositingQuality GdipDeleteGraphics GdipCreateFromHWNDICM GdipCreateFromHWND GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipSetPenDashArray GdipSetPenDashOffset GdipSetPenDashStyle GdipSetPenMiterLimit GdipSetPenLineJoin GdipSetPenEndCap GdipCreatePath GdipClonePath GdipFillRectangleI GdipFillRectangle GdipGraphicsClear GdipDrawPath GdipDrawPie GdipDrawEllipse GdipDrawRectangle GdipDrawArc GdipSetPenStartCap GdipDeletePen GdipCreatePen2 GdipCreatePen1 GdipSetPathGradientTransform GdipSetPathGradientWrapMode GdipSetPathGradientPresetBlend GdipSetPathGradientCenterPoint GdipCreatePathGradientFromPath GdipMultiplyLineTransform GdipSetLineWrapMode GdipSetLinePresetBlend GdipCreateLineBrush GdipCreateSolidFill GdipCreateTexture GdipDeleteBrush GdipCloneBrush GdipGetMatrixElements GdipShearMatrix GdipRotateMatrix GdipScaleMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix2 GdipCreateMatrix GdipIsVisiblePathPoint GdipGetPathWorldBounds GdipAddPathRectangleI GdipAddPathArcI GdipAddPathLineI GdipAddPathEllipse GdipAddPathBezier ord1 GdipAddPathLine GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipResetPath GdipDeletePath

psapi

GetModuleFileNameExA

urlmon

FindMimeFromData

winmm

timeBeginPeriod timeKillEvent timeGetTime timeEndPeriod timeSetEvent PlaySoundA

oleacc

LresultFromObject CreateStdAccessibleObject AccessibleObjectFromWindow

imm32

ImmIsIME ImmReleaseContext ImmAssociateContextEx ImmGetCompositionStringW ImmNotifyIME ImmSetCandidateWindow ImmGetOpenStatus ImmGetContext

usp10

ScriptApplyDigitSubstitution ScriptBreak ScriptPlace ScriptShape ScriptItemize ScriptFreeCache

wsock32

inet_addr sendto ioctlsocket recvfrom __WSAFDIsSet gethostname getpeername

wininet

InternetSetOptionW HttpOpenRequestA HttpSendRequestA HttpQueryInfoA HttpQueryInfoW InternetErrorDlg InternetCrackUrlA InternetCanonicalizeUrlA InternetOpenUrlA InternetSetFilePointer InternetWriteFile InternetQueryDataAvailable InternetQueryOptionW InternetReadFile InternetCloseHandle InternetOpenA InternetConnectA InternetSetStatusCallback InternetGetLastResponseInfoA InternetSetOptionA InternetQueryOptionA

iphlpapi

GetAdaptersAddresses GetIpAddrTable

msi

ord67 ord44

netapi32

NetShareEnum NetApiBufferFree NetServerGetInfo NetWkstaGetInfo

pdh

PdhCloseQuery PdhLookupPerfNameByIndexA PdhRemoveCounter PdhAddCounterA PdhOpenQueryA PdhCollectQueryData PdhGetFormattedCounterValue

mpr

WNetGetConnectionA WNetEnumResourceA WNetCloseEnum WNetOpenEnumA

Name

.text

Size

7.7MB

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

323KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

217B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

506KB

Virtual Size

506KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=51, id=241, version=40116,

count=245, id=243, version=40116,

count=43, id=242, version=40116,

count=5, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=26, id=199, version=41118,

count=2, id=261, version=23013,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=30, id=259, version=24123,

count=42, id=260, version=24123,

count=438, id=261, version=24123,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1315, id=1, productName=Unmarked objects,

count=364, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=527, id=260, version=25830,

count=399, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Livecare_assistance.exe

IMPHASH 57e98d9a5a72c8d7ad8fb7a6a58b3daf
SHA256 66f9c03e6cede3672733babbe9a14ec96ade883116c95f9a16614cbe06d27ee9
MD5 808c7e87c2a371bb8c70c9ce00b9bfe5
SHA1 2bcfc9cc19fb0d76cdab3468bc76baf81f35d90e
SHA512 4fde06914499391af5e07ed5023d12119a8abbab59d71a920796d95d7fee80d60d31aa765cf9797c7e56caa12619e39154c43faa4d62c0fa64576de93ac55cd1
SSDEEP 49152:B/OJzBTOPS1h9pPlHngW38tYPDL1dJc67Tl:B0zBCqvdz3h/rJc67Tl
TLSH
T12095339A63B4FE57EAAA197024B8D335B2B5DF4C7411CA462738BA3FBA33641371D011
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

f2:ac:a5:7b:93:8d:31:97:9a:3e:37:4a:88:e7:ad:e0:61:17:5c:16:d0:83:84:44:69:f5:f5:cb:0d:70:eb:32

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

Chains

Apr 19, 2023

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

22:05:78:fe:90:a4:11:18:fb:3d:3e:08:e9:8d:97:1e:35:f1:ef:fe

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

Chains

Apr 19, 2023

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

Serial Number

09:f4:70:e1:62:51:cd:e6:6a:49:97:37:b8:aa:08:24

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - May 27, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

13096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
TLSH
T107324A5503604AF3E986843C086A3BBF6F796B2196F04E53DFA384C0EE6D5C96D78352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

lcaresrv/ISHooks.dll

IMPHASH c079ab71c28f252a44afe9c272f83d5b
SHA256 6338a0641e94cd96165d92532e912ea0ea0ad373bf18b45fa914079cacd449cf
MD5 d9e2cdb8b3dcc973839871c722d79525
SHA1 a18e44154b3fea8dfd9a74e657cb9f1967a32387
SHA512 59e5f8c333af1c0cb04a4686d3cdbbac3d96f628c40e7d6708c4f1b510817bb4dc41f3080628cfb6eb2250eabfa61d2dfbae921130728340eb5e0f020bdfbc81
SSDEEP 3072:2HyFlEJesXGFKlBzAVYIrl+P9UvxBpv96kG3GSkWNvKr:2QEJRXGFPZjIDFKr
TLSH
T1D7046C02B5D48034D5BB02765479BA4106BDBEA14FBACEDF6BDC4C8D1AB45C1A336B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

53:94:40:38:a9:09:08:ae:d8:fd:a5:81:47:85:bd:5c

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Monza,ST=Milano,C=IT

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Monza,ST=Milano,C=IT

Serial Number

70:7d:0f:be:03:3c:d3:5e:ff:14:79:b1:db:8f:3f:ea

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Mar 4, 2014 - Apr 25, 2016

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

6731

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\sviluppo\livecare\liveshare\winsrc\winvnc\Release_Static_MFC\ISHooks.pdb

kernel32

CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GlobalAddAtomA GlobalDeleteAtom EnumSystemLocalesW Sleep GetCommandLineA GetCurrentThreadId IsDebuggerPresent IsProcessorFeaturePresent GetLastError SetLastError GetCurrentThread EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA HeapFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount CreateEventW GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount GetModuleHandleW CreateSemaphoreW HeapAlloc RaiseException EnterCriticalSection LeaveCriticalSection FatalAppExitA IsValidCodePage GetACP GetOEMCP GetCPInfo WriteFile GetModuleFileNameW SetConsoleCtrlHandler FreeLibrary LoadLibraryExW RtlUnwind HeapReAlloc GetStringTypeW OutputDebugStringW HeapSize CreateFileW

user32

CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA EnumWindows ClientToScreen GetCursor GetWindowRect GetClientRect RemovePropA GetPropA SetPropA GetUpdateRgn IsWindowVisible PostThreadMessageA

gdi32

DeleteObject CreateRectRgn GetRegionData

Name

.text

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.SharedD

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

lcaresrv/ISHooks64.dll

IMPHASH 7ef15bec1435f9daf79ad4c99130b493
SHA256 3ee334fb7b74c833193fe9dac0083d25daf1472395d48fd32e97adbc5b96afc9
MD5 0d25e78db5f28bdbd13062d88b9cf252
SHA1 39a5c826a4dd2334ced7f2a41d15bc8d1c5e35cc
SHA512 603c9bd74f6c3b208ae995c590b37f9c5d25423ebaee63afc3b7b1d4f213647780fd15f63454fe251a61feb3157225fecf5188cb4c27bb52ea2657f19f1b7f2c
SSDEEP 3072:JfAoR+BSoGNpE1/V8jgxvHStJmuNTQ9kbr82jmHwaGt:5kBSoqW/+jgBHStIIQHna
TLSH
T1DED37D4B727544B6E467D135C8C31A8AEB7A7416C371538F02A882D23F637B19E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

75:30:cd:28:ff:3a:77:86:cf:fe:43:8f:49:a2:08:a7

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Monza,ST=Milano,C=IT

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Monza,ST=Milano,C=IT

Serial Number

70:7d:0f:be:03:3c:d3:5e:ff:14:79:b1:db:8f:3f:ea

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Mar 4, 2014 - Apr 25, 2016

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

7372

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\sviluppo\livecare\liveshare\winsrc\winvnc\Release_Static_MFC\ISHooks.pdb

kernel32

CompareStringW CompareStringA GetTimeZoneInformation GetLocaleInfoW LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeFormatA GetDateFormatA GlobalDeleteAtom GlobalAddAtomA MultiByteToWideChar Sleep GetCurrentThreadId FlsSetValue GetCommandLineA EncodePointer DecodePointer TlsAlloc FlsGetValue FlsFree SetLastError GetLastError GetCurrentThread FlsAlloc HeapFree GetModuleHandleW GetProcAddress ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy RtlUnwindEx QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapAlloc RaiseException RtlPcToFileHeader LeaveCriticalSection FatalAppExitA EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc WriteFile TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetConsoleCtrlHandler FreeLibrary LoadLibraryA InitializeCriticalSectionAndSpinCount HeapSize SetEnvironmentVariableA

user32

SetWindowsHookExA CallNextHookEx GetUpdateRgn GetCursor GetPropA SetPropA IsWindowVisible GetWindowRect PostThreadMessageA GetClientRect ClientToScreen EnumWindows UnhookWindowsHookEx RemovePropA

gdi32

GetRegionData DeleteObject CreateRectRgn

Name

.text

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.SharedD

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

lcaresrv/ishooks64.exe

IMPHASH 4d28bbbeee3ca2a4289fdc97a5f2f8ad
SHA256 e2a667a696284034931570630d2449702583248d7373c810d00c1a438927b6b0
MD5 af7402f306a3829c36c24392c1112250
SHA1 505b8cae01ae40c0d34808bf103857bb7ee20314
SHA512 fe297603a77ca47a3817bfd0db960b3aefff818ebc09894e62fa5570e6d1a6091d7e1fd3492eed8be5866f78d121dabc01e2a5737e03b0e8ddfb2737e7ad6a9a
SSDEEP 1536:5gN20Lh/HRqUoZkcWprvfmgupPz56Zl2h3lx3hpA:5gN20LhgUorWp7mLpr56T2dlBA
TLSH
T1D3737C8A676900F6D1938679C8E29B87EEB1F4455BB1838F077882972F637D04E3D315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

5a:6c:91:f3:05:31:6a:6d:be:44:75:8c:37:61:b5:4e:33:16:b0:b8:5c:e7:9e:d0:55:76:2c:68:fb:d0:8e:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Chains

Jan 16, 2020

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

PE Signature issue

Digest

2e:aa:c9:dd:0e:8f:0a:bc:b5:ce:73:90:52:e4:c4:20:37:e2:62:d5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Chains

Jan 16, 2020

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Serial Number

62:22:b1:a5:6e:0f:09:6f:97:73:47:99:9b:29:00:59

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2018 - Apr 24, 2021

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

10076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\sviluppo\livecare\liveshare\winsrc\winvnc\ishooks64\x64\Release\ishooks64.pdb

kernel32

GetCurrentThreadId CreateMutexA GetModuleFileNameA LoadLibraryA GetProcAddress FreeLibrary GetLastError ReleaseMutex CloseHandle CreateEventA WaitForSingleObject Sleep HeapReAlloc InitializeCriticalSectionAndSpinCount GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext HeapAlloc HeapFree RaiseException RtlPcToFileHeader GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsSetValue FlsFree SetLastError FlsAlloc LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetModuleHandleW ExitProcess WriteFile GetStdHandle RtlUnwindEx FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapSetInformation HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapSize GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

PostThreadMessageA RegisterWindowMessageA GetThreadDesktop GetUserObjectInformationA SetThreadDesktop CloseDesktop OpenDesktopA OpenInputDesktop

lcaresrv/ishsrv.exe

IMPHASH 90ee0ae4a4a6aa4355e61e06806e3e2b
SHA256 bef97a5186307b61f7bd5203766a88cb58f57fe64c85f3a6cda9ec55022f6bf3
MD5 119b354e929b8ad73e058aa41213061e
SHA1 ae2ef84e24f0d658e45163d74e2c3e14b42ad1ff
SHA512 36b65757092447665a9bc27ad9dd39bb77c817164d0deb4aa7810410c0a59f1a55c2dd38b02dd9ad1279d99e6af8e078747c316208b98462c99b2c9a2e52e0a2
SSDEEP 98304:q/dz/rx8ek78PkYBTeLaotu73BMovLEmSNM2IKI:yVrKeJBThNvL72
TLSH
T1C836BF12BF818172E6920135D9BDBF7E1A7DAD2817F444D3A39439EA9D301C23B3A356
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

9a:aa:b1:1a:03:f7:bc:f1:0a:2a:7c:78:60:b5:85:e4:6e:08:8a:5d:0b:48:2a:fc:dc:da:7a:ee:4b:97:2b:76

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

Chains

Apr 19, 2023

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

5a:a1:92:9e:d5:44:e0:28:b3:20:fd:0d:07:2f:43:ad:5b:93:e9:99

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

Chains

Apr 19, 2023

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Icona srl,OU=SECURE APPLICATION DEVELOPMENT,O=Icona srl,L=Cinisello Balsamo,C=IT

Serial Number

09:f4:70:e1:62:51:cd:e6:6a:49:97:37:b8:aa:08:24

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - May 27, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

962833

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ishsrv.pdb

winmm

timeGetTime

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead ReleaseSemaphore CreateSemaphoreA GetComputerNameExA GetExitCodeProcess GetExitCodeThread GetLocalTime DebugBreak GetFileType GetModuleHandleExW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetTickCount GlobalMemoryStatus GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode RtlCaptureStackBackTrace ExpandEnvironmentStringsA FindFirstFileW GetUserDefaultLangID SetThreadLocale WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList SetProcessAffinityMask VirtualFree GetVersionExW GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer WaitForSingleObjectEx GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue WriteConsoleW SetFilePointerEx DeleteFileW FreeEnvironmentStringsW GetEnvironmentStringsW IsValidCodePage FindNextFileW FindFirstFileExW FindFirstFileExA GetConsoleCP MoveFileExW EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetTimeZoneInformation PeekNamedPipe CreateFileW GetCommandLineW HeapQueryInformation VirtualQuery VirtualAlloc GetSystemInfo GetCurrentDirectoryW SetCurrentDirectoryW SetCurrentDirectoryA SetEnvironmentVariableW SetEnvironmentVariableA GetFullPathNameW GetDriveTypeW SetStdHandle ExitProcess SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread InterlockedFlushSList InterlockedPushEntrySList RtlUnwind AreFileApisANSI OutputDebugStringW GetStringTypeW LCMapStringW TryEnterCriticalSection QueryPerformanceFrequency GetNativeSystemInfo ResetEvent SetErrorMode SystemTimeToTzSpecificLocalTime SetFileAttributesA LocalFileTimeToFileTime GetFileSizeEx GetFileAttributesExA FileTimeToLocalFileTime GetUserDefaultLCID ReplaceFileA GetTempFileNameA SetFileTime GetDiskFreeSpaceA FindResourceExW GetCurrentDirectoryA WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA GetStringTypeExA GetVolumeInformationA MoveFileA lstrcmpiA GetShortPathNameA LoadLibraryExA DuplicateHandle UnlockFile ReadFile LockFile GetFullPathNameA FlushFileBuffers GetCPInfo GetOEMCP VirtualProtect GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW CompareStringW GetCurrentThread ResumeThread SuspendThread SetThreadPriority CreateEventA GlobalFlags GetThreadLocale SystemTimeToFileTime FileTimeToSystemTime GetAtomNameA lstrcmpA LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc InitializeCriticalSection CompareStringA GlobalGetAtomNameA GlobalFindAtomA GlobalAddAtomA FindResourceA lstrcmpW GlobalDeleteAtom LoadLibraryExW FreeResource GetSystemDirectoryW EncodePointer FindResourceW MulDiv SizeofResource LockResource LoadResource LoadLibraryW GetModuleHandleW GetModuleFileNameW GetACP GetCommandLineA SetThreadExecutionState GetVersionExA GetCurrentProcessId OpenProcess WriteConsoleA AllocConsole MoveFileExA OutputDebugStringA FormatMessageA SetFilePointer SetEndOfFile GetStdHandle CreateMutexA ReleaseMutex CopyFileA DeleteFileA SetProcessShutdownParameters CreateProcessA lstrlenA CreateThread TerminateProcess GetComputerNameA GetModuleFileNameA GetSystemTime WinExec WriteFile Sleep GlobalFree IsBadWritePtr IsBadReadPtr GetModuleHandleA GetCurrentProcess GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy WideCharToMultiByte MultiByteToWideChar VerifyVersionInfoA SetWaitableTimer CreateEventW SleepEx TlsFree TlsSetValue TlsGetValue TlsAlloc FormatMessageW WaitForMultipleObjects WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection QueueUserAPC PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort SetLastError TerminateThread LocalFree InterlockedCompareExchange InterlockedExchangeAdd InterlockedExchange VerSetConditionMask GlobalUnlock GlobalLock GlobalSize GlobalAlloc InterlockedDecrement InterlockedIncrement FindNextFileA FindFirstFileA GetFileAttributesA CreateFileA CloseHandle GetFileTime FindClose GetFileSize GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException FreeLibrary DecodePointer LoadLibraryA GetProcAddress GetFileAttributesExW SetFileAttributesW CreateTimerQueueTimer

user32

MonitorFromWindow WinHelpA GetScrollInfo SetScrollInfo LoadIconW GetLastActivePopup GetTopWindow GetClassLongA PtInRect EqualRect CopyRect GetSysColor MapWindowPoints ScreenToClient AdjustWindowRectEx RemovePropA GetPropA SetPropA ShowScrollBar GetScrollRange SetScrollRange ScrollWindow RedrawWindow ValidateRect SetActiveWindow UpdateWindow TrackPopupMenuEx SetMenu GetMenu EnableWindow GetCapture GetKeyState GetFocus GetDlgItem EndDeferWindowPos GetMonitorInfoA GetMessageA GetWindowDC ClientToScreen DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement IsChild IsMenu IsWindow GetClassInfoExA GetClassInfoA CallWindowProcA GetMessageTime GetMessagePos GetWindow GetWindowTextLengthA GetScrollPos SetScrollPos SetFocus RemoveMenu AppendMenuA InsertMenuA GetMenuItemCount GetMenuState GetMenuStringA GetParent OffsetRect SetRectEmpty SendDlgItemMessageA LoadStringA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA PostThreadMessageA GetUserObjectInformationA GetProcessWindowStation SetProcessWindowStation CloseWindowStation EnumWindowStationsA OpenWindowStationA SetThreadDesktop OpenInputDesktop ExitWindowsEx MoveWindow TrackPopupMenu RealChildWindowFromPoint GetSubMenu DestroyMenu LoadMenuA MapVirtualKeyA SendInput VkKeyScanA ToAscii GetAsyncKeyState WaitMessage SetDlgItemInt GetDlgItemInt SetDlgItemTextA GetDlgItemTextA CheckDlgButton CheckRadioButton IsDlgButtonChecked IsWindowEnabled ScrollWindowEx SetWindowTextA MsgWaitForMultipleObjectsEx TranslateMessage DispatchMessageA DefWindowProcA PostQuitMessage RegisterClassExA CreateWindowExA ShowWindow SetWindowPos SetTimer KillTimer GetSystemMetrics AdjustWindowRect IsRectEmpty GetWindowLongA SetWindowLongA LoadCursorA LoadIconA LoadImageA UnregisterClassA SystemParametersInfoA PostMessageA keybd_event mouse_event RegisterClipboardFormatA GetClipboardFormatNameA RegisterWindowMessageA RegisterClassA SetLayeredWindowAttributes GetMenuItemInfoA InflateRect CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions SetMenuItemInfoA LoadBitmapW CopyImage GetActiveWindow CreateDialogIndirectParamA GetNextDlgTabItem MapDialogRect SetCapture ReleaseCapture SetWindowRgn SetCursor LoadCursorW DestroyIcon CharUpperA IntersectRect ShowOwnedPopups DeleteMenu GetDialogBaseUnits BringWindowToTop LoadAcceleratorsA TranslateAcceleratorA CreatePopupMenu InsertMenuItemA GetMenuBarInfo UnpackDDElParam ReuseDDElParam GetKeyNameTextA UnionRect GetSystemMenu SetParent LoadAcceleratorsW LoadMenuW GetDCEx LockWindowUpdate IsDialogMessageA GetWindowThreadProcessId GetSysColorBrush DrawTextExA GrayStringA SetMenuDefaultItem TabbedTextOutA DrawIcon DrawTextA BeginPaint EndPaint InvalidateRect SetRect EnumDisplaySettingsA EnumDisplayDevicesA DestroyWindow SendMessageA GetDC ReleaseDC DialogBoxParamA EndDialog GetDlgCtrlID SetForegroundWindow GetClientRect FillRect GetThreadDesktop GetKeyboardState GetForegroundWindow GetCursorPos ChildWindowFromPoint GetDesktopWindow FindWindowA OpenDesktopA EnumDesktopWindows CloseDesktop WaitForInputIdle IsWindowVisible OpenClipboard CloseClipboard GetClipboardOwner SetClipboardViewer ChangeClipboardChain SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable GetWindowTextA GetWindowRect MessageBoxA WindowFromPoint EnumWindows GetClassNameA DrawIconEx GetIconInfo EnumDesktopsA GetUserObjectInformationW MessageBoxW GetMenuItemID GetCursorInfo IsIconic PeekMessageA

gdi32

SetTextAlign SetTextJustification PlayMetaFileRecord EnumMetaFile SetWorldTransform ModifyWorldTransform SetColorAdjustment StartDocA ArcTo PolyDraw SelectClipPath SetArcDirection ExtCreatePen MoveToEx TextOutA ExtTextOutA PolyBezierTo PolylineTo SetViewportExtEx SetViewportOrgEx SetTextCharacterExtra SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateFontIndirectA GetTextExtentPoint32A CreateEllipticRgn DPtoLP LPtoDP CombineRgn CreateRectRgnIndirect GetMapMode SetRectRgn GetTextMetricsA EnumFontFamiliesExA CreateFontA GetCharWidthA StretchDIBits GetBkColor SetStretchBltMode SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetGraphicsMode SetMapperFlags ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible PlayMetaFile OffsetClipRgn LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetObjectType GetCurrentPositionEx GetClipRgn ExcludeClipRect Escape CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateDIBPatternBrushPt CreateBitmap SetBkColor CopyMetaFileA GetBitmapBits GdiFlush SetDIBColorTable CreateDIBSection SelectPalette RealizePalette GetDeviceCaps CreatePalette GetObjectA GetSystemPaletteEntries SetTextColor SetDCBrushColor Ellipse GetPixel CreateCompatibleBitmap BitBlt StretchBlt SetBkMode SelectObject PatBlt GetStockObject GetDIBits GetClipBox DeleteObject CreateCompatibleDC CreateDCA SetWindowExtEx CreateSolidBrush DeleteDC

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

advapi32

CreateWellKnownSid RegOpenKeyExA RegQueryValueExA RegSetValueExA RevertToSelf OpenProcessToken ImpersonateLoggedOnUser CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CheckTokenMembership CreateProcessAsUserA LookupAccountSidA GetSidSubAuthority FreeSid AllocateAndInitializeSid RegCloseKey RegQueryValueExW RegDeleteValueW RegSetValueExW ImpersonateSelf AdjustTokenPrivileges SetTokenInformation OpenThreadToken GetTokenInformation LookupPrivilegeValueW GetFileSecurityA SetFileSecurityA RegEnumValueA RegOpenKeyExW RegEnumKeyExA RegDeleteValueA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegCreateKeyExA RegSetValueA DuplicateToken GetUserNameA

shell32

DragFinish ord74 SHAppBarMessage Shell_NotifyIconA ExtractIconA SHGetFileInfoA SHGetFolderPathA DragQueryFileA SHAddToRecentDocs

ole32

CoInitialize CoUninitialize CoCreateInstance OleInitialize OleUninitialize OleSetClipboard OleIsCurrentClipboard ReleaseStgMedium OleGetClipboard StringFromCLSID CoTaskMemAlloc CoTaskMemFree CoTreatAsClass CreateBindCtx ReadClassStg WriteClassStg CreateStreamOnHGlobal ReadFmtUserTypeStg OleDuplicateData OleRegGetUserType SetConvertStg StringFromGUID2 CoDisconnectObject CLSIDFromString CoCreateGuid PropVariantCopy CoInitializeEx WriteFmtUserTypeStg

oleaut32

VarDecFromStr VarBstrFromDec VarBstrFromDate VarBstrFromCy VarCyFromStr VarDateFromStr VariantCopy SafeArrayPtrOfIndex SafeArrayCopy SafeArrayPutElement SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElemsize SafeArrayGetDim SafeArrayRedim SafeArrayDestroy SafeArrayDestroyDescriptor SafeArrayCreate SafeArrayAllocData SafeArrayAllocDescriptor VariantTimeToSystemTime SystemTimeToVariantTime SysReAllocStringLen SysStringLen RegisterTypeLi LoadRegTypeLi LoadTypeLi VariantChangeType VariantClear VariantInit SysAllocStringLen SysAllocStringByteLen SysStringByteLen SysFreeString SafeArrayDestroyData SysAllocString SafeArrayCreateVector

shlwapi

PathFindFileNameA PathRemoveExtensionA PathIsUNCA PathStripToRootA PathFindExtensionA PathRemoveFileSpecW UrlUnescapeA

ws2_32

sendto recvfrom ntohs socket send recv inet_addr getsockname getpeername __WSAFDIsSet inet_ntoa gethostname getnameinfo freeaddrinfo getaddrinfo WSAStringToAddressW WSASocketW WSASend WSARecv WSAGetLastError WSASetLastError WSACleanup WSAStartup select WSAAsyncSelect WSAIoctl gethostbyname connect shutdown accept bind closesocket ntohl ioctlsocket getsockopt htonl htons listen setsockopt

uxtheme

IsAppThemed DrawThemeBackground IsThemeBackgroundPartiallyTransparent DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeText GetThemePartSize

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

gdiplus

GdiplusShutdown

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertOpenStore CertGetCertificateContextProperty

wininet

InternetCanonicalizeUrlA InternetErrorDlg InternetGetCookieA InternetSetCookieA HttpQueryInfoA HttpEndRequestA HttpSendRequestExA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA GopherGetAttributeA GopherOpenFileA GopherFindFirstFileA GopherCreateLocatorA FtpCommandA FtpGetCurrentDirectoryA FtpSetCurrentDirectoryA FtpRemoveDirectoryA FtpCreateDirectoryA FtpOpenFileA FtpRenameFileA FtpDeleteFileA FtpPutFileA FtpGetFileA FtpFindFirstFileA InternetSetStatusCallback InternetGetLastResponseInfoA InternetSetOptionA InternetQueryOptionA InternetFindNextFileA InternetQueryDataAvailable InternetWriteFile InternetSetFilePointer InternetReadFile InternetOpenUrlA InternetConnectA InternetCloseHandle InternetOpenA InternetCrackUrlA

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

827KB

Virtual Size

827KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

77KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

140KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=47, id=241, version=40116,

count=211, id=243, version=40116,

count=37, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=2, id=261, version=23013,

count=6, id=199, version=41118,

count=527, id=260, version=25830,

count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, productName=Unmarked objects (old),

count=28, id=265, version=24215,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=842, id=1, productName=Unmarked objects,

count=27, id=259, version=24123,

count=39, id=260, version=24123,

count=210, id=261, version=24123,

count=129, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=108, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Livecare_demo.exe

IMPHASH 57e98d9a5a72c8d7ad8fb7a6a58b3daf
SHA256 c044a7fc9ef3bf29b26c39cdb3f1076d255a1a223de7ac3ee297464266c007d2
MD5 bb49172a1956963e74df7f1fd86fd48f
SHA1 ff55988e7ebd1f963f3f820cd3d737cc4c7e0fa8
SHA512 0fba3d0d14d063f7b83b0d515cefaeb5d244c0d9ae50861b961489d91f00dcb097a73622dba2005ddbce6eff32519635833558e940b499b33c1c6b7e858d16fb
SSDEEP 12288:aPTjKeoKYXR2QfXSOiXNx3FdVPmWLBHtHhlSDDyUmFv4JMejjlPUQnzBXzqGs1S1:aPTjKeoKYXIQfiOiXpd5NFHflSDDyU8W
TLSH
T1EEF423046B84C4B7D7129EB1B9B5EAB64BB07D8C3B5192571338B99334B67838B4E303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

0a:33:7b:b8:e2:56:e9:1e:25:2a:cc:4a:8b:75:df:cd:09:9c:7e:08:cf:e7:8d:d2:fc:e5:07:b1:05:ad:05:a5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Chains

Jul 24, 2020

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

PE Signature issue

Digest

3e:f6:8e:29:92:e4:3f:ba:c3:e1:8e:3e:c0:1a:33:45:b8:83:46:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Chains

Jul 24, 2020

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Serial Number

62:22:b1:a5:6e:0f:09:6f:97:73:47:99:9b:29:00:59

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2018 - Apr 24, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

13096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

lcareview/ishview.exe

IMPHASH 602a2bef9a5a45153cd08f6ab1772c94
SHA256 2cf3c55761415a56c4e69614acc977c83d1dcccf76b431b7c1a0887dbd0773a9
MD5 b8a0b8372f6e5126329d88fcd2ea3f04
SHA1 d9f51a75bac65b582c35358476629c0fc7bf2bd4
SHA512 bddd16c0facf5478ef83bd0552c0a2ceb06836ba0e5d1d1654d19785792678a73bbeace3dfd0ea26d194bd9ffc88655ad1e1c5de10540e71c674093dafd5da41
SSDEEP 24576:bP6TxupWPRxzgoCee4yv2x7lj8Ip/7skYK58MVDUfgVKgYF+6cyz4N5fGWfv+pf:b4zjCee0dljDYUNWzCt+pf
TLSH
T1E2758D43B7C290F2D9866171107767379E316E0E731ACAD797A1FD1688322D1AB3E389
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

d1:56:1a:72:23:2a:fc:91:93:00:4d:da:e0:8d:05:3d:43:09:57:18:c2:9d:7b:ac:8e:e8:b5:ba:d9:f5:d7:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Chains

Jul 24, 2020

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

PE Signature issue

Digest

02:53:a1:f5:f0:37:83:62:06:0f:6f:ad:7a:68:03:77:13:0b:39:62

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Chains

Jul 24, 2020

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Serial Number

62:22:b1:a5:6e:0f:09:6f:97:73:47:99:9b:29:00:59

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2018 - Apr 24, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

1072433

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\sviluppo\livecare\lvs-demo-viewer\winsrc\vncviewer\Release_Static_MFC\ishview.pdb

kernel32

FileTimeToLocalFileTime GetConsoleMode SetConsoleMode ReadConsoleInputA GetFullPathNameA FindFirstFileA FindClose GetCurrentProcess IsBadCodePtr IsBadReadPtr SetStdHandle SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter IsBadWritePtr VirtualFree HeapCreate HeapDestroy SetUnhandledExceptionFilter SetConsoleCtrlHandler GetDateFormatA GetTimeFormatA DuplicateHandle CreateThread ExitThread HeapSize HeapReAlloc GetStartupInfoA TerminateProcess SetCurrentDirectoryA SetEnvironmentVariableA VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect GetDriveTypeA RtlUnwind ExitProcess GetStringTypeA LCMapStringA LCMapStringW GetStringTypeW FlushConsoleInputBuffer GetFileType QueryPerformanceCounter GlobalMemoryStatus GetCurrentProcessId GetSystemTimeAsFileTime ExpandEnvironmentStringsA GetTickCount TerminateThread GetExitCodeThread CreateMutexA ReleaseMutex SleepEx ResetEvent CreateSemaphoreA WaitForMultipleObjects GetProcessHeap HeapAlloc HeapFree SetThreadLocale FlushFileBuffers ReadFile DeleteFileA GetCurrentDirectoryA GetPrivateProfileStringA GetOEMCP GetCPInfo GetCurrentThread GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom LoadLibraryA FreeLibrary lstrcatA lstrcmpW GetProcAddress lstrcpyA CreateEventA SuspendThread SetEvent WaitForSingleObject GetCurrentThreadId ResumeThread SetThreadPriority GlobalFlags lstrcmpA FileTimeToSystemTime TlsFree LocalReAlloc TlsSetValue TlsAlloc TlsGetValue EnterCriticalSection GlobalHandle GlobalReAlloc LeaveCriticalSection LocalAlloc GetModuleFileNameA InterlockedIncrement InterlockedDecrement DeleteCriticalSection InitializeCriticalSection RaiseException SetLastError GlobalFree FindResourceA LoadResource LockResource SizeofResource GetCommandLineA CompareStringW CompareStringA GetPrivateProfileIntA lstrlenA GetModuleHandleA lstrcmpiA GetVersion WideCharToMultiByte MultiByteToWideChar GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange CreateFileA SetFilePointer SetEndOfFile AllocConsole OutputDebugStringA GetStdHandle WriteConsoleA WriteFile CloseHandle GlobalAlloc GlobalLock GlobalUnlock Beep GetVersionExA lstrcpynA FormatMessageA LocalFree Sleep GetLastError GetTimeZoneInformation

user32

SetWindowsHookExA CallNextHookEx GetActiveWindow IsWindowVisible PeekMessageA ValidateRect ClientToScreen GetWindow PtInRect GetDesktopWindow GetClassNameA GetWindowTextA GetParent GetLastActivePopup IsWindowEnabled GetDlgCtrlID SendMessageA LoadIconA SetDlgItemTextA EndDialog FillRect EnableWindow UnhookWindowsHookEx GetSystemMetrics GetSysColor UnregisterClassA GetMenuItemCount LoadKeyboardLayoutA GetMessageA TranslateMessage DispatchMessageA GetDlgItem GetDlgItemInt GetDlgItemTextA GetClientRect DialogBoxParamA SetWindowTextA GetProcessWindowStation GetUserObjectInformationW RegisterClassExA LoadStringA GetDC ReleaseDC EnableMenuItem GetSystemMenu SetClipboardViewer InvalidateRect DrawTextA SetRect DestroyWindow SetDlgItemInt LoadBitmapA GetMenuCheckMarkDimensions ModifyMenuA SetMenuItemBitmaps CopyRect CallWindowProcA GetClassInfoA GetMenu MapWindowPoints GetMessagePos GetMessageTime GetTopWindow GetForegroundWindow RemovePropA GetPropA SetPropA GetClassInfoExA GetClassLongA GetCapture WinHelpA TabbedTextOutA DrawTextExA GrayStringA DefWindowProcA EndPaint BeginPaint SetScrollInfo LoadMenuA UpdateWindow ScrollWindowEx IsIconic ShowScrollBar ShowWindow SetWindowPos GetWindowRect GetMenuState GetWindowLongA CheckMenuItem SetForegroundWindow SetWindowPlacement GetWindowPlacement AdjustWindowRectEx SystemParametersInfoA TrackPopupMenu GetCursorPos SetMenuDefaultItem GetMenuItemID GetSubMenu PostQuitMessage MessageBoxA DestroyMenu PostMessageA FindWindowA GetKeyboardState ToAscii GetKeyState EmptyClipboard SetClipboardData GetClipboardOwner OpenClipboard GetClipboardData CloseClipboard RegisterWindowMessageA GetSysColorBrush RegisterClassA CreateWindowExA SetWindowLongA AppendMenuA DrawMenuBar GetFocus LoadCursorA SetCursor WindowFromPoint ScreenToClient SetTimer SetFocus ChangeClipboardChain KillTimer

gdi32

GetDeviceCaps CreateCompatibleDC SetPixelV CreateDCA CreateBitmap GetClipBox GetObjectA SaveDC RestoreDC SetMapMode PtVisible RectVisible TextOutA SetStretchBltMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx CreatePalette SetWindowExtEx ScaleWindowExtEx SetBrushOrgEx StretchBlt BitBlt GetStockObject SetBkMode DeleteObject CreateSolidBrush ExtTextOutA SetBkColor SelectObject RealizePalette SelectPalette SetTextColor UpdateColors DeleteDC CreateFontA GetBitmapBits CreateCompatibleBitmap Escape

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegisterEventSourceA DeregisterEventSource RegDeleteKeyA RegSetValueExA RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegCreateKeyA RegSetValueA RegCloseKey RegOpenKeyA ReportEventA

shell32

Shell_NotifyIconA

oleaut32

VariantInit VariantChangeType VariantClear

comctl32

ord17

ws2_32

WSAGetLastError WSACleanup WSAStartup inet_ntoa WSASetLastError gethostbyname inet_addr gethostname setsockopt socket closesocket shutdown bind htonl htons listen getpeername getsockname send recv connect ioctlsocket ntohs getsockopt __WSAFDIsSet select

oleacc

LresultFromObject CreateStdAccessibleObject

generic

count=8, id=105, version=2067,

count=46, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=1, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=16, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=5, id=18, version=8444,

count=339, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=9, id=95, version=2179,

count=6, id=25, version=9210,

count=1, id=28, version=9178,

count=2, id=93, version=2067,

count=21, id=93, version=2179,

count=611, id=1, productName=Unmarked objects,

count=332, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=123, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,

Livecare_service.exe

IMPHASH 57e98d9a5a72c8d7ad8fb7a6a58b3daf
SHA256 5e921ee9aa1fdfaa35ff84b6611293ec02bfbcd5f9e2cde2381cb43e28aacb75
MD5 725503087ade04b7c1df2521d9ee060d
SHA1 5cf37374fa178ea364ca547ae794418493eabb3a
SHA512 7ca264f70bb084974c965911e6b861510f51c462af0bff32c939921c20995617dfea56dfbdd616fd3f8e7dddc5bc2ccc1d3e5c3b21dc3ecdce02afa23a9c9868
SSDEEP 24576:JZxLyZprl+kBZS5WDTiKhPhVUwNAFGliTxs5F4:TxuZpEkC5iTiKhpO8CGliu4
TLSH
T18215235DBB48E863DA54DB705879993A9EB19F4F7504433703F0BA33BAB2162935C183
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

d8:4b:13:c9:83:36:d4:ee:69:22:9d:da:7e:fe:58:3b:9c:f3:d8:74:f7:1c:cf:06:18:3e:7a:bd:0b:80:2d:a7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Chains

Jan 13, 2021

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

PE Signature issue

Digest

1a:e1:39:81:44:33:53:98:de:ad:0d:65:31:4e:6d:28:4f:a7:fb:94

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Chains

Jan 13, 2021

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Serial Number

62:22:b1:a5:6e:0f:09:6f:97:73:47:99:9b:29:00:59

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2018 - Apr 24, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

13096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$APPDATA/Livecare/service/LivecareElevator.exe

IMPHASH a270c89cceaab67b77d45cc9c4d88596
SHA256 07ad95b6bc3cebbcb34d50a845be303fd98cf91c5f2fb46320c7276dcd5f85b0
MD5 a920af77695b8420967e1212a77d8032
SHA1 a939badeee7874efad248f23bdc58d132ad4cf96
SHA512 7bdb9d52227563bda4faae67630b0ae89773e7cfc303f189f465e9aa1bd1e7f4060575e032ca88b32c3e87f1dc2ec41bd36d1e1261ea0d9d66e3ec5fc90a9420
SSDEEP 3072:vqog3aQdCCUqrcQqad/BifayxcgguImjpE1Lm8cbOAklISvwBAg0FubAWi6HP7yz:ih3VAClvtpI0gzrFu6zAOFDyz
TLSH
T1E4249E2075928872D472193405F8EF766A3CB9610B748AFF93E80B7D4F742D16A31AB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

9c:69:8a:48:49:1f:b6:f4:8f:d8:17:3a:6a:7b:95:d2:67:92:0d:1d:80:02:af:a5:36:15:3c:c2:5c:c5:a1:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Chains

Jan 13, 2021

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

PE Signature issue

Digest

f6:6f:f8:4d:1d:c0:a8:e3:28:d8:bb:70:61:63:87:0b:3e:25:42:0c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Chains

Jan 13, 2021

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Serial Number

62:22:b1:a5:6e:0f:09:6f:97:73:47:99:9b:29:00:59

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2018 - Apr 24, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

34529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Sviluppo\livecare\lvs-livecare-elevator\Release\LivecareElevator.pdb

kernel32

GetModuleFileNameA GetVersionExA WriteConsoleW FlushFileBuffers WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RaiseException RtlUnwind GetLastError FreeLibrary LoadLibraryExW HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle HeapSize GetConsoleCP GetConsoleMode SetFilePointerEx CreateFileW

shell32

ShellExecuteA

Name

.text

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

548B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/Livecare/service/LivecareServiceLivelet.exe

IMPHASH 8d0acd2ed6565978aa517bb9c53f91f8
SHA256 1265a106b8ecdd3f4fcdea7d1b54eed44cc2247b0cf2902608453aef4db17784
MD5 f6d25f4a7eb03953a27ada424e59e101
SHA1 bd054dd63705d2e44458073987dc2f44b99cafa1
SHA512 b1d69f8dc3974c328b4d2fbcd77bff2a96919dfdc873cfdb27ab131fdd480ab85b3f472a4543854ec457371696da0de8d9ecfac2c451ce9b321ebd648d8ee59a
SSDEEP 49152:YkBnQ82rF3+xbSWCbylRDSTUb2SLaALqG6z1W7uJO2:v1Q82rGSWhDSTUb2PGW1W7uJ
TLSH
T1C3A57C22BDE14A77C1230F31AA4DF23935BDB5300B39819763D45F1839746A39629EBB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

f1:5c:8c:56:7e:04:a5:16:ef:1e:c3:7a:6c:cc:c0:b4:d5:8a:07:5c:41:91:77:e9:87:5e:60:38:89:23:32:49

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Chains

Jan 13, 2021

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

PE Signature issue

Digest

33:bc:77:92:3e:77:f3:78:54:44:71:39:21:80:90:ba:45:e9:02:e9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Chains

Jan 13, 2021

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Icona S.R.L.,OU=SECURE APPLICATION DEVELOPMENT,O=Icona S.R.L.,L=Cinisello Balsamo,ST=Milano,C=IT

Serial Number

62:22:b1:a5:6e:0f:09:6f:97:73:47:99:9b:29:00:59

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2018 - Apr 24, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

1289575

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Sviluppo\livecare\lvs-livelet-service-win\Release Static MFC No STLPort\Livecare_service.pdb

kernel32

GetSystemInfo GetCurrentDirectoryW SetCurrentDirectoryA SetEnvironmentVariableA GetModuleHandleExW VirtualAlloc GetCommandLineW RtlUnwind OutputDebugStringW GetStringTypeW LCMapStringW VirtualQuery HeapQueryInformation FreeLibraryAndExitThread GetCommandLineA QueryPerformanceFrequency SetStdHandle GetFileType ExitProcess GetStdHandle GetDriveTypeW GetFullPathNameW CreateFileW PeekNamedPipe GetTimeZoneInformation IsValidLocale EnumSystemLocalesW GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExA FindNextFileA IsValidCodePage GetEnvironmentStringsW FreeEnvironmentStringsW DeleteFileW GetLocalTime CreateProcessA InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent GetUserDefaultLCID SearchPathA GetProfileIntA GetTickCount GetTempFileNameA GetTempPathA VerifyVersionInfoA VerSetConditionMask GetWindowsDirectoryA FindResourceExW GetCurrentDirectoryA GetPrivateProfileStringA GetPrivateProfileIntA lstrcpyA GetACP SystemTimeToTzSpecificLocalTime GetFileTime GetFileSizeEx GetFileAttributesExA GetFileAttributesA FileTimeToLocalFileTime GetCPInfo GetOEMCP VirtualProtect GetUserDefaultUILanguage GetLocaleInfoW CompareStringW GlobalFlags GetVolumeInformationA lstrcmpiA GetCurrentProcess DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetFullPathNameA GetFileSize FlushFileBuffers FindFirstFileA FindClose CreateFileA GlobalFindAtomA GlobalAddAtomA FindResourceA LoadLibraryA lstrcmpW GlobalDeleteAtom LoadLibraryExW FreeResource FreeLibrary GetSystemDirectoryW EncodePointer FileTimeToSystemTime GlobalGetAtomNameA lstrcmpA CompareStringA ResumeThread SetThreadPriority GetCurrentThreadId MultiByteToWideChar CopyFileA MulDiv GlobalSize WideCharToMultiByte FindResourceW SizeofResource LockResource LoadResource GetCurrentProcessId LocalReAlloc LocalAlloc GlobalFree GlobalUnlock GlobalHandle GlobalLock GlobalReAlloc GlobalAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc LeaveCriticalSection EnterCriticalSection InitializeCriticalSection LoadLibraryW GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc SetLastError RaiseException DecodePointer OutputDebugStringA OpenProcess lstrlenA FormatMessageA CreateThread LocalFree GetVersionExA GetModuleFileNameA CreateEventA OpenMutexA CreateMutexA CloseHandle Sleep WaitForSingleObject ReleaseMutex SetEvent GetLastError TerminateProcess ExitThread WriteConsoleW

user32

CreatePopupMenu NotifyWinEvent LoadCursorW InvertRect HideCaret EnableScrollBar MessageBeep GetIconInfo DrawIconEx LoadImageA IsRectEmpty DrawFocusRect WindowFromPoint ReleaseCapture SetCapture GetNextDlgGroupItem KillTimer SetTimer DeleteMenu SetCursor ShowOwnedPopups LoadImageW InvalidateRect TrackMouseEvent IntersectRect MapDialogRect GetAsyncKeyState GetNextDlgTabItem EndDialog CreateDialogIndirectParamA PostQuitMessage OffsetRect SetRectEmpty CopyImage SystemParametersInfoA InflateRect GetMenuItemInfoA DestroyMenu FillRect GetWindowDC TabbedTextOutA GrayStringA DrawTextExA DrawTextA RealChildWindowFromPoint GetDesktopWindow ClientToScreen CharUpperA DestroyIcon IsDialogMessageA SetWindowTextA SendDlgItemMessageA CheckDlgButton MoveWindow ShowWindow GetMonitorInfoA MonitorFromWindow WinHelpA GetScrollInfo SetScrollInfo LoadIconW LoadIconA GetWindow GetTopWindow GetClassNameA GetClassLongA SetWindowLongA PtInRect EqualRect CopyRect MapWindowPoints UnhookWindowsHookEx SendMessageA EnableWindow IsWindowEnabled ScreenToClient AdjustWindowRectEx UnionRect GetClientRect RemovePropA GetMenuDefaultItem SetPropA ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow TrackPopupMenu SetMenu GetMenu GetCapture SetFocus GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement SetWindowPos DestroyWindow IsChild IsMenu IsWindow CreateWindowExA GetClassInfoExA MapVirtualKeyA GetKeyNameTextA SetLayeredWindowAttributes EnumDisplayMonitors SetClassLongA SetWindowRgn SetParent OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateA DrawEdge DrawFrameControl IsZoomed MessageBoxA GetWindowLongA GetParent GetWindowThreadProcessId GetLastActivePopup GetMenuStringA GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuA AppendMenuA RemoveMenu GetMessageA TranslateMessage DispatchMessageA PeekMessageA IsWindowVisible GetActiveWindow GetKeyState ValidateRect GetCursorPos SetWindowsHookExA CallNextHookEx GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush LoadCursorA GetWindowTextA GetWindowTextLengthA GetFocus CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions SetMenuItemInfoA LoadBitmapW RegisterWindowMessageA GetMessagePos GetMessageTime PostMessageA DefWindowProcA CallWindowProcA RegisterClassA GetClassInfoA UpdateLayeredWindow MonitorFromPoint LoadAcceleratorsA TranslateAcceleratorA LoadMenuA InsertMenuItemA LoadMenuW GetSystemMenu BringWindowToTop SetCursorPos CopyIcon FrameRect GetPropA DrawIcon UnpackDDElParam ReuseDDElParam GetComboBoxInfo PostThreadMessageA WaitMessage GetKeyboardLayout IsCharLowerA MapVirtualKeyExA GetKeyboardState ToAsciiEx LoadAcceleratorsW CreateAcceleratorTableA DestroyAcceleratorTable CopyAcceleratorTableA SetRect LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuA RegisterClipboardFormatA CharUpperBuffA IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcA DefMDIChildProcA TranslateMDISysAccel SubtractRect CreateMenu DestroyCursor GetWindowRgn GetWindowRect

gdi32

SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign MoveToEx TextOutA ExtTextOutA SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateFontIndirectA GetTextExtentPoint32A CombineRgn CreateRectRgnIndirect PatBlt SetRectRgn DPtoLP GetTextMetricsA EnumFontFamiliesExA CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette GetBkColor CreateCompatibleBitmap EnumFontFamiliesA GetTextCharsetInfo SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateEllipticRgn Ellipse GetTextColor CreatePolygonRgn Polygon Polyline CreateRoundRectRgn LPtoDP Rectangle GetRgnBox OffsetRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceA SetBkMode SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect DeleteDC CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC BitBlt DeleteObject GetObjectA SetTextColor SetBkColor CreateBitmap GetDeviceCaps CreateDCA CreateDIBitmap Escape CopyMetaFileA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

CreateProcessAsUserA OpenProcessToken RegQueryValueExA RegSetValueExA RegEnumKeyExA RegDeleteValueA RegOpenKeyExA RegDeleteKeyA RegCreateKeyExA RegCloseKey StartServiceA StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA QueryServiceStatus OpenServiceA OpenSCManagerA DeleteService CreateServiceA ControlService CloseServiceHandle ReportEventA RegisterEventSourceA DeregisterEventSource

shell32

SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHGetPathFromIDListA SHGetSpecialFolderLocation SHGetDesktopFolder SHAppBarMessage DragFinish DragQueryFileA

ole32

OleDuplicateData IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CreateStreamOnHGlobal CoInitializeEx CoInitialize CoUninitialize CoCreateInstance CoDisconnectObject ReleaseStgMedium CoTaskMemFree CoTaskMemAlloc

oleaut32

VariantTimeToSystemTime SystemTimeToVariantTime SysAllocStringLen SysStringLen LoadTypeLi SysFreeString VariantClear VariantCopy VariantChangeType VarBstrFromDate VariantInit SysAllocString SysAllocStringByteLen

shlwapi

StrFormatKBSizeA PathRemoveFileSpecW PathFindExtensionA PathStripToRootA PathIsUNCA PathFindFileNameA

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

gdiplus

GdipGetImagePixelFormat GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdiplusShutdown GdipAlloc GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits

msimg32

TransparentBlt AlphaBlend

imm32

ImmGetContext ImmGetOpenStatus ImmReleaseContext

winmm

PlaySoundA

uxtheme

GetCurrentThemeName CloseThemeData DrawThemeText DrawThemeParentBackground GetThemePartSize GetThemeSysColor IsThemeBackgroundPartiallyTransparent IsAppThemed GetWindowTheme DrawThemeBackground GetThemeColor OpenThemeData

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

327KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=27, id=241, version=40116,

count=209, id=243, version=40116,

count=33, id=242, version=40116,

count=2, id=261, version=23013,

count=1, id=199, version=41118,

count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=820, id=1, productName=Unmarked objects,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=26, id=259, version=24123,

count=35, id=260, version=24123,

count=366, id=261, version=24123,

count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Signatures

File Explorer

IZ_LiveLet.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

LiveLet.exe

ws2_32

crypt32

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

psapi

urlmon

winmm

oleacc

imm32

usp10

wsock32

wininet

iphlpapi

msi

netapi32

pdh

mpr

generic

Livecare_assistance.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

lcaresrv/ISHooks.dll

PE Signature issue

kernel32

user32

gdi32

generic

lcaresrv/ISHooks64.dll

PE Signature issue

kernel32

user32

gdi32

generic

lcaresrv/RELEASE

lcaresrv/ishooks64.exe

PE Signature issue

PE Signature issue