87551552b704dfb0be5b10c41e816cfd7ebc31ff49383565a7cc05bd365ecd1f

resource	yara_rule
static1/unpack001/kbly/guanwang/guanwang.exe	upx

resource
87551552b704dfb0be5b10c41e816cfd7ebc31ff49383565a7cc05bd365ecd1f
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/kbly/Utils/WebView.dll
unpack001/kbly/Utils/webview2.exe
unpack001/kbly/guanwang/guanwang.exe
unpack002/out.upx

resource
unpack001/kbly/libcurl.dll

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 87551552b704dfb0be5b10c41e816cfd7ebc31ff49383565a7cc05bd365ecd1f
MD5 fda20951bbacc61d09d717a90b8d41a2
SHA1 b5e0e2e24603db120a29ee9cbcc1b4d1ebc6c7d4
SHA512 4ad9cbf9e6f8a35df8cbceb6632c63de20d86acab3f1234dd872e07b3f6b33b5a7ba5e792ff834bf5ed319aa711f8237d9dd080bfee7622ce1abb568eeab25cd
SSDEEP 98304:nf8bQmHdTX+WHyJ/j5wt1JnhvQLJK/qpcXYJozc3RKj+HVbvffDxiLQ+PCvaS5LY:nUbQmHxuWSXwDxhvQLJnppJozObbfDx2
TLSH
T1EE36331A2C9DC1F7D9D30A3D667FFA0CA0B58E7D7A162204E321C8A09879BD5625E335
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kbly/Utils/7z.dll

IMPHASH cd489efe557cd42acdc90e4d9ec4c09c
SHA256 6dc5c98a44c87b95897697574f6bfe3bdb9696103f14d7c7404d5304ab15c108
MD5 4e6650f37fcd8c071d24ec22a438095f
SHA1 ced4680fb9ff9bc51c188c9e75241546039b258d
SHA512 1bf42e99f3adf8a0dbe1c93e0101a662701b3c4cee6c579cbc6599eee584cf3550489df60a98ce6a5c5a8498d51aa2332a847eab811f18f7692ea6e1984462b3
SSDEEP 24576:eZ+lCPq8bgPqPRzWu+sjvNfEz0z/JiJXosR:RlCPnbgiPRzWFsjvNffJtsR
TLSH
T1B3357D25F7F5C4B8C68E52328524E7A510F9F62BCA20918B76D02F6F7F314E6C624E85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

fd:4c:53:0e:71:78:4c:b0:a1:73:22:ca:d1:ac:06:89:9d:8a:e8:bf:98:0b:c8:bb:7f:4e:e8:00:38:ba:ea:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91120116MA05PU4J0C,CN=天津六六游科技有限公司,O=天津六六游科技有限公司,ST=天津市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c27e6bba8e6b5b7e696b0e58cbae9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Mar 1, 2025

SERIALNUMBER=91120116MA05PU4J0C,CN=天津六六游科技有限公司,O=天津六六游科技有限公司,ST=天津市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c27e6bba8e6b5b7e696b0e58cbae9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=91120116MA05PU4J0C,CN=天津六六游科技有限公司,O=天津六六游科技有限公司,ST=天津市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c27e6bba8e6b5b7e696b0e58cbae9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=91120116MA05PU4J0C,CN=天津六六游科技有限公司,O=天津六六游科技有限公司,ST=天津市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c27e6bba8e6b5b7e696b0e58cbae9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

06:50:f9:d1:59:ad:11:3e:70:b5:81:55:06:9f:fa:4b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 17, 2024 - May 27, 2027

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

5

Entry point

643379

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\vmagent_new\bin\joblist\29113\out\Release\7z.pdb

kernel32

GetVersionExA MultiByteToWideChar WideCharToMultiByte GetLastError DeleteCriticalSection EnterCriticalSection LeaveCriticalSection QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId WaitForMultipleObjects VirtualAlloc VirtualFree GetProcAddress GetModuleHandleA CloseHandle WaitForSingleObject CreateEventA SetEvent ResetEvent CreateSemaphoreA ReleaseSemaphore InitializeCriticalSection LocalFileTimeToFileTime FileTimeToLocalFileTime CompareFileTime SetCurrentDirectoryA AreFileApisANSI SetFileTime CreateFileW SetLastError SetFileAttributesA RemoveDirectoryA MoveFileA CreateDirectoryA DeleteFileA GetWindowsDirectoryA GetSystemDirectoryA GetWindowsDirectoryW GetSystemDirectoryW SetFileAttributesW RemoveDirectoryW MoveFileW CreateDirectoryW DeleteFileW GetShortPathNameA lstrlenA GetFullPathNameA GetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryW SearchPathA GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW GetFullPathNameW SearchPathW FindClose FindCloseChangeNotification FindFirstChangeNotificationA FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FindFirstChangeNotificationW GetLogicalDriveStringsA GetLogicalDriveStringsW GetFileSize SetFilePointer GetFileInformationByHandle ReadFile WriteFile SetEndOfFile CreateFileA GetSystemInfo GlobalMemoryStatus DosDateTimeToFileTime FileTimeToDosDateTime SystemTimeToFileTime GetSystemTime CompareStringW CompareStringA GetTimeZoneInformation LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetLocaleInfoA GetLocaleInfoW LoadLibraryA RtlUnwind RaiseException HeapAlloc HeapFree HeapReAlloc ExitThread CreateThread GetCommandLineA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement GetCurrentThread TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent FatalAppExitA HeapCreate HeapDestroy Sleep ExitProcess GetStdHandle GetModuleFileNameA HeapSize SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount SetConsoleCtrlHandler FreeLibrary InterlockedExchange SetEnvironmentVariableA

user32

CharPrevA CharToOemA CharNextA CharLowerW CharUpperW CharLowerA CharUpperA CharPrevExA

oleaut32

VariantCopy SysFreeString VariantClear SysAllocString SysAllocStringByteLen

kbly/Utils/Uninst.exe

IMPHASH ab42f1be8e6f6eac2fc98d4ff43dfe2a
SHA256 e54cd22a7b8a82e8e1cc47738b04df13790a70577be2d18b30e2000af5f59167
MD5 3c83cb5c47f307382cc1fcfdcfd51d24
SHA1 d3ac5d7b710d5371b6b8442d7d1601121f5ba6a3
SHA512 e46f81931c7a133bc589e9650cdc7d411f9138b02084ae4ee0fb7b45cfc2925c20679327e24e18201fbc4569004df35c52cbaec6cbafa07da8ffe74f4695f4f8
SSDEEP 12288:w03vDGH2qqLXVrwk388axw9HSIk9aHFNz:p3vqH2qUXV7s8aC9H5kCFNz
TLSH
T100E448133588BCB6C07212B06B3B97E9932EED600762D5DF53D41669993C0E37E317AA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

71:97:5e:e8:4b:7c:92:4d:a8:12:1d:1c:04:47:88:3f:bd:80:84:96:e3:a5:1d:c8:71:21:cd:50:9c:e4:41:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91120116MA06WL2583,CN=天津旗鱼网络科技有限公司,O=天津旗鱼网络科技有限公司,ST=天津市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c27e6bba8e6b5b7e696b0e58cbae9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Nov 11, 2025

SERIALNUMBER=91120116MA06WL2583,CN=天津旗鱼网络科技有限公司,O=天津旗鱼网络科技有限公司,ST=天津市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c27e6bba8e6b5b7e696b0e58cbae9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=91120116MA06WL2583,CN=天津旗鱼网络科技有限公司,O=天津旗鱼网络科技有限公司,ST=天津市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c27e6bba8e6b5b7e696b0e58cbae9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=91120116MA06WL2583,CN=天津旗鱼网络科技有限公司,O=天津旗鱼网络科技有限公司,ST=天津市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c27e6bba8e6b5b7e696b0e58cbae9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

0f:03:ad:71:08:91:7c:8b:7a:99:c5:50:72:0c:b4:44

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 11, 2025 - Nov 9, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

99294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\001_WorkCode\WD\WD_Main\Release\Uninst.pdb

kernel32

GetCurrentProcessId TerminateProcess GetStartupInfoW OpenProcess GetModuleFileNameW GetModuleHandleW GetProcAddress lstrcpyW lstrlenW CopyFileW MoveFileExW MultiByteToWideChar WideCharToMultiByte K32EnumProcesses K32EnumProcessModules K32GetModuleFileNameExW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection CreateMutexW SetCurrentDirectoryW GetCurrentDirectoryW GetCurrentProcess GetSystemDirectoryW WaitForSingleObject SetLastError CloseHandle WriteFile SetFileAttributesW RemoveDirectoryW GetTempFileNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW FindResourceW SizeofResource LockResource LoadResource FindResourceExW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualFree VirtualProtect VirtualAlloc GetModuleHandleA GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer HeapReAlloc HeapAlloc GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait WaitForSingleObjectEx SetEvent HeapDestroy GetLastError RaiseException DecodePointer WriteConsoleW SetStdHandle GetTempPathW CreateEventW SetEnvironmentVariableW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetStringTypeW FormatMessageW TryEnterCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ReadFile FlushFileBuffers FreeLibrary LoadLibraryW LoadLibraryExW SetEndOfFile GetStdHandle ReleaseMutex LocalFree Sleep GetSystemWindowsDirectoryW GetVersionExW FreeResource DeviceIoControl lstrcmpA RtlUnwind InterlockedPushEntrySList InterlockedFlushSList ExitProcess GetModuleHandleExW GetFileType SetFilePointerEx GetConsoleOutputCP GetConsoleMode GetTimeZoneInformation CreateThread ExitThread FreeLibraryAndExitThread GetCurrentThread IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW

user32

FindWindowExW PostMessageW MessageBoxW DefWindowProcW wsprintfW

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey GetTokenInformation LookupPrivilegeValueW RegEnumKeyExW AdjustTokenPrivileges OpenProcessToken

shell32

SHGetSpecialFolderPathW SHChangeNotify ShellExecuteW SHFileOperationW SHCreateDirectoryExW

ole32

CoInitializeEx CoCreateGuid CoUninitialize CoCreateInstance CoInitialize CoInitializeSecurity CoSetProxyBlanket

oleaut32

VariantInit SysStringLen VariantClear SysAllocString SysFreeString SysAllocStringLen

shlwapi

PathCombineW PathFindFileNameW PathIsDirectoryW StrTrimA StrCmpNIW PathRemoveFileSpecW StrCmpIW SHDeleteKeyW SHGetValueW SHSetValueW StrStrIA StrStrIW PathAppendW PathFileExistsW

comctl32

InitCommonControlsEx

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

kbly/Utils/WebView.dll

IMPHASH a74302eed955effcabf2eefad689889b
SHA256 251557d73e993b4cdec21142f954d8dcc73592de58cbb0fa3f011bc9b17e071b
MD5 c1d6ea2a6718d376d7a1c4a555828183
SHA1 df1725b09f5b33ada89ea0981d5a0703b3c181db
SHA512 b94f63f31c65f72b3bf79837f9f356838e841b73b89c534a15bf97233e2d9ccf6d064e855397fc76ea3920e2d8f8a7358c12c4a496a0f6e7c93f53fd9070ab0e
SSDEEP 49152:FzlrEuVuJx8vLDiqy0XBYKkhSBHj2wtPnD4c:FBrEuvCcXBVMw
TLSH
T14AA58D317989C137EEDD12B2467CBE2D806DD8A80B7506D755982BFEAA304C32F32957
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

26976

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\001_WorkCode\panda_pictorial\PandaPictorialBuild\edge_view.pdb

kernel32

FindResourceW LoadLibraryW CopyFileW MoveFileW MoveFileExW MultiByteToWideChar OutputDebugStringA OutputDebugStringW GetCurrentThreadId InitializeCriticalSectionAndSpinCount SetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent CreateEventW WaitForMultipleObjects RegisterWaitForSingleObject UnregisterWait GetFileSizeEx GetCurrentProcessId GetLocalTime ReleaseMutex CreateMutexW SizeofResource WideCharToMultiByte GetCommandLineW CreateProcessW RtlCaptureStackBackTrace GetModuleFileNameW FindResourceExW GetTickCount OpenProcess GetExitCodeProcess WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc WriteConsoleW SetEndOfFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP LockResource LoadResource GetProcAddress FreeLibrary GetModuleHandleW HeapAlloc HeapDestroy GetLastError RaiseException CloseHandle DecodePointer IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetStdHandle GetFileAttributesExW GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType ExitProcess GetModuleHandleExW ResumeThread ExitThread RtlUnwind CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore DuplicateHandle SetProcessAffinityMask VirtualProtect GetVersionExW GetModuleHandleA FreeLibraryAndExitThread GetTempPathW SetFileAttributesW GetTempFileNameW GetFileTime DeleteFileW CreateFileW GetThreadTimes GetCurrentThread SetThreadAffinityMask IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA FormatMessageW QueryPerformanceCounter QueryPerformanceFrequency TryEnterCriticalSection GetCPInfo SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW ReadFile WriteFile UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW InterlockedExchangeAdd GetFileSize FlushFileBuffers LoadLibraryExW CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile SetFilePointer LocalFree ConnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus WaitForMultipleObjectsEx CreateSemaphoreW CreateNamedPipeW WaitNamedPipeW WaitForSingleObjectEx Sleep SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask ResetEvent

user32

UnregisterClassW GetWindowThreadProcessId SendMessageW SendMessageTimeoutW CopyRect MessageBoxW WaitForInputIdle LoadCursorW FindWindowW SetWindowLongW GetWindowLongW SetWindowTextW GetMessageW TranslateMessage DispatchMessageW PeekMessageW PostThreadMessageW SetTimer KillTimer wsprintfW DestroyWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostMessageW

gdi32

GetTextExtentPoint32W GetStockObject DeleteObject SelectObject

advapi32

CryptGenRandom InitializeSecurityDescriptor CryptContextAddRef CryptDecrypt CryptEncrypt CryptImportKey CryptSetKeyParam RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyW RegCloseKey RegGetValueW CryptAcquireContextW CryptReleaseContext CryptDestroyKey SetSecurityDescriptorDacl

shell32

SHCreateDirectoryExW SHGetFolderPathA SHCreateDirectoryExA ShellExecuteW SHGetSpecialFolderPathW ShellExecuteExW

ole32

CoInitialize StringFromGUID2 CoCreateGuid CoUninitialize

oleaut32

SysFreeString

shlwapi

PathCompactPathW PathCombineW SHGetValueW PathFindExtensionW PathFindFileNameW PathFileExistsW PathCanonicalizeW PathAppendW PathFindFileNameA StrStrIW PathAppendA PathIsDirectoryW StrStrIA PathIsRootW PathIsRelativeW PathFindExtensionA PathRemoveFileSpecW

psapi

GetModuleFileNameExW EnumProcessModules

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

crypt32

CryptStringToBinaryW CryptBinaryToStringA CryptBinaryToStringW CertGetNameStringW CryptStringToBinaryA

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

urlmon

URLDownloadToCacheFileW

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

259KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.shared

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

kbly/Utils/WebView2Loader.dll

IMPHASH 72229ff546c74d09d9030ca49ce61b31
SHA256 1064ab1c2cdc0746b100f021514d591043da7cc1583b450dd071d291080c53ef
MD5 4e5905898ae2075676abbe34ffbbc511
SHA1 3383c05de93e41ba6ad68b3fc52dd2f0eb9057cc
SHA512 e481a444ccee4d41ba5a8a547f69492e315123a8bbe5309dea573a71239c68203bab9b15835da16b23d50a1efdb0fd5d044143f77759fd5544834a4670dde348
SSDEEP 3072:q5S+1NJzO6ecBL2McQ+l1PgqeNZvTzqEtJZAl3TCJ4fmdv:qrNJzTBgbl6mEtJSdGJ2mN
TLSH
T1FBB36B5176D08072E5BE0A380574EB655B3FBA61DFA09DEB279409A94F307C0CE35E2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Digest

de:34:9a:d7:47:6a:0f:d5:bf:ea:e6:6d:b2:41:d9:04:5b:e4:60:b8:67:c0:7b:01:17:50:14:ab:03:6d:89:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 30, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

10

Entry point

16032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

WebView2Loader.dll.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive RtlUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

kbly/Utils/progress.gif

SHA256 2a5a7ace6a323882946c20ad8b4dcb89cb09e2f8bbb4215facdd64aa48c38b16
MD5 ef09afa5bf49f5b03b7e8cc5b7aa7e33
SHA1 255b345511c32879aabdc7b53343d497bd22cfa0
SHA512 bfd772dbe8b5e33c4509b8d3aa6b24039beb35331f512bc97ccdb1c21fc1352878ce08fec78056bc800dc6da34d782d1f844c7d893a4af99e6940128183665e5
SSDEEP 384:GcDP6P1x585rKgiCcfsLzDR8v77iPKfWOoHStK7RbG:GcmdxWcjsLzDev3i5HStKFbG
TLSH
T1AE52BF7AC500C8C9BB597A24EBCB542F0C2D5CA75CB4F96A288CD41DB18C2B41AED7C9
MD5 SHA1 SHA512 SSDEEP TLSH

kbly/Utils/webview2.exe

IMPHASH 87f8d35d0c8fb355b72111b6283b9997
SHA256 3f75677e9052df1a65b2aa0e60aee14768cd68970d5bcdd05a427870f2dfc484
MD5 af9eeaab6dfc11c454d76969af42737f
SHA1 b04871ea0d5c0446a083dbe14c24725af4e5bfec
SHA512 70897481f8839b8590c6d1dffb4810e5cebf0460dc6cd22b6d2ed6bfe5cfbf138ff531278e6cdc6144fb4b9f90232a012fb3fde0de3f1fb1696fdc5f7475f472
SSDEEP 24576:C+b1b0R7nvwdz31MhHzAVvMMMMMMMMXeeerrrrrz84I4JMO7:Xutvwdz31yTA4
TLSH
T1D305180136E95279F1F31BB05A79AB690479BC358F11C6DF2294661E0C31AE1EE31B3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

288408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\001_WorkCode\panda_pictorial\PandaPictorialBuild\webview2.pdb

webview2loader

CreateCoreWebView2EnvironmentWithOptions GetAvailableCoreWebView2BrowserVersionString

kernel32

GetModuleHandleExW GetProcAddress LoadResource LockResource SizeofResource FindResourceW FormatMessageW lstrcpynW WideCharToMultiByte CreateFileW GetFileSize ReadFile SetFilePointer GetExitCodeProcess EnterCriticalSection LeaveCriticalSection OpenProcess GetCommandLineW GetCurrentProcess FreeLibrary LoadLibraryExW LoadLibraryW lstrcmpiW MultiByteToWideChar InitializeCriticalSection SetEvent CreateEventW WaitForMultipleObjects RegisterWaitForSingleObject UnregisterWait GetFileSizeEx GetLocalTime UnmapViewOfFile ReleaseSemaphore DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleW GetOEMCP GetACP IsValidCodePage FindFirstFileExW FindClose SetFilePointerEx ReadConsoleW GetModuleFileNameW GetModuleFileNameA CloseHandle DecodePointer OutputDebugStringW DebugBreak FindNextFileW IsDebuggerPresent FindResourceExW SetEndOfFile GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale QueryPerformanceCounter GetStartupInfoW ResetEvent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter lstrcmpA DeviceIoControl FreeResource GetVersionExW GetSystemWindowsDirectoryW Sleep InterlockedExchangeAdd FlushFileBuffers WriteFile LoadLibraryExA VirtualFree VirtualAlloc GetFileType GetCurrentThreadId GetCurrentProcessId GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind LocalFree CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject GetCommandLineA ReleaseMutex GetStringTypeW GetCPInfo EncodePointer InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent

user32

GetClientRect RegisterWindowMessageW SendMessageW PostMessageW UnregisterClassW SetWindowPos DefWindowProcW CopyRect GetWindowLongW SetWindowLongW RegisterClassExW LoadCursorW PostQuitMessage CallWindowProcW IsWindow DestroyWindow ShowWindow SetTimer BeginPaint EndPaint FindWindowW SetWindowTextW SendMessageTimeoutW CharNextW DispatchMessageW TranslateMessage GetMessageW GetClassInfoExW GetWindowThreadProcessId CreateWindowExW

advapi32

RegEnumKeyExW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey OpenProcessToken GetTokenInformation RegQueryValueExW

shell32

ShellExecuteExW SHCreateDirectoryExW SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitializeSecurity CoSetProxyBlanket CoCreateGuid OleUninitialize OleInitialize CoTaskMemRealloc CoCreateInstance CoTaskMemAlloc CoInitializeEx CoTaskMemFree

oleaut32

SysAllocString SysFreeString SysStringLen VariantClear VariantCopy VarUI4FromStr VariantInit VariantChangeType SysAllocStringLen

shlwapi

PathRemoveFileSpecW PathFindFileNameW PathAppendW PathFindExtensionW SHGetValueW PathCombineW StrCmpNIW StrTrimA StrStrIA PathFileExistsW StrStrIW StrCmpIW ord12

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

bcrypt

BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptFinishHash

iphlpapi

GetAdaptersInfo

kbly/guanwang/guanwang.exe

SHA256 e459f8cb2f7f0a447c0a4ddb2adbb00b4da7c2f52190701154913d57214993fa
MD5 910211f7641b79b437336ee777390c43
SHA1 11932b013dff096bc74016cd9f17d9a687c8ccda
SHA512 8ff622fd6bf30f3ac588c92a52aff5bad6e3710a6efb2dc3c333f6e6a37aa044aa8c156a365923dfe502274c1c56f1950851e74a0529b9b4f524c0d89795dde9
SSDEEP 24576:sZbGGqzI6RzGV7jD8mNnamDw8SDLs48bco8y6:sZbGGKVRzGRjJMswnvf8bLs
TLSH
T1002523B4865A9838EFB26A3051DD527F1F55E00C57B0DB0CCA361A8EDCA6B427F52336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2697936

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=11, id=260, version=27054,

count=41, id=259, version=30795,

count=205, id=261, version=30795,

count=2, id=260, version=27034,

count=1, id=263, version=30795,

count=10, id=261, version=27050,

count=1, id=261, version=27051,

count=11, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=7, id=261, version=27032,

count=1, id=199, version=41118,

count=40, id=260, version=26706,

count=26, id=259, version=26706,

count=143, id=261, version=26706,

count=51, id=260, version=30795,

count=1, id=262, version=30795,

count=41, id=257, version=30795,

count=592, id=1, productName=Unmarked objects,

count=116, id=261, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,

out.upx

SHA256 bc63d23d76b89ef1feeffdc4bb883b53e9cca77c361ac6fa2a66387defec7db4
MD5 0f3d7fa89bf71ce2bf4669d3b5bc30ec
SHA1 78c66978c853efb3fdfd4cef9e9d6a22af4b4a20
SHA512 1b48331de7731798074991a8e300e70094766d8ea7e668e7e23d64677a7daf672f6ce9250b4e3993655ed9b9982c6de9dae592903f5dfe16b32f43d51b40f7d1
SSDEEP 49152:7wer5ATBZT5vdMbGWuYQOjPekpBTJslsLg+xa0NCaA8bLs:rr5ATzTNd64O7ekpPslF448bY
TLSH
T18EC58D227D168132F8F702F199BDAAAF55597E74072440E7B2C82E3E69308D33A3575B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

436450

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=11, id=260, version=27054,

count=41, id=259, version=30795,

count=205, id=261, version=30795,

count=2, id=260, version=27034,

count=1, id=263, version=30795,

count=10, id=261, version=27050,

count=1, id=261, version=27051,

count=11, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=7, id=261, version=27032,

count=1, id=199, version=41118,

count=40, id=260, version=26706,

count=26, id=259, version=26706,

count=143, id=261, version=26706,

count=51, id=260, version=30795,

count=1, id=262, version=30795,

count=41, id=257, version=30795,

count=592, id=1, productName=Unmarked objects,

count=116, id=261, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,

kbly/guanwang/guanwang.ico

SHA256 602de678a58382df523af0074b5bb64af1e65c61fe350220ab4c64b7e8d35319
MD5 679c90af8ac6afc5abeb4224de401e34
SHA1 5ff12f014dccf6dce9b5eb91349de5fd3df76052
SHA512 caa040969645f665f54b37ca0bec0388b9197bfbbad12006374a9d0a993a563026a3faedd643b8c9e2464da4f20815602487c2e302c158c6b1d388dce5693b9d
SSDEEP 3072:/JXOZ3wzf4cMPjn/didJoX/r4at947yGLu9bX3wxHoFawGD9Z:hXmw8bcox8yWuBX3Afnh
TLSH
T1C1E31313ED6D406EED27FB32643B167F3364A284A611DB57DC70A64CD4622ABEE18313
MD5 SHA1 SHA512 SSDEEP TLSH

kbly/guanwang/guanwang.json

SHA256 934b5d52ec12450c8eb5850c6429271334389068c63925427fe4bfaaa6d168a9
MD5 4c343bef76c1dea09d2a79f9568dfb3b
SHA1 77dde1dfe6790d02dc63ddb2a4029563707dca6b
SHA512 77c8beb4c26fae281fe4ac1097cede392da8b94a5102ca02c3860da9b3f6a2c1eba02cc85d25eb47145a96cde080a98f10d86f70367166c6fa13df452c3a81d8
TLSH
T1E7312D03ED2605D6910B947B18F1B48D05C693C0A68F57A46448ED805B4E638F449C41
MD5 SHA1 SHA512 TLSH

kbly/guanwang/guanwang.ui

SHA256 ca5f928ed9b865b4bb69280a527aaee96100a7cacf0a4361248d292f47e4ba47
MD5 9a9270974dbf173a342789ff4cf3c35f
SHA1 a9640fca5e43605bb46f249a25449d6efdd29c07
SHA512 4381d02c8d409ffd7781976492f48f8515e4ec0d98abce9931289dfb2132644ad6b60b3a9c307525eeede193d70ecaf511f883d965c884a1b6d62a193c0dc595
SSDEEP 24576:kddVLRNmOsE/rcnnHqHjxUxJ7Wi1d0VV4WhzRzF52soXqZyl1Y:kdLLAE/rwHK9G12VrRH2x4yl1Y
TLSH
T18465331EBE2D5997C13857F796CAF02F4392B260565EDA53292C91382F00E121CF62EE
MD5 SHA1 SHA512 SSDEEP TLSH

MainWindow/close.png

SHA256 8b08c62d360a184266ed2eb8b578f9a76652b2899182beb0820367dbce09e95b
MD5 59dfeaf653d55245be186ba5623874fb
SHA1 00bbd455617eee203e92b9a854367828919d8505
SHA512 0335cb6cbe18769aa5ede33e43a603a71d50ed966a1899ff0a66351e467d610dd2b4868d7d8d2767a635f680008c148574910f6e0c0d5da42f0206f250704d19
SSDEEP 96:Ij9rfrYczvl2vfwmIs7kOVQCe8iXbPL1aSM59SQGGRlKVB89:wVzQHwFs7bO45Uo2Bu
TLSH
T12BC17D27E0556D4173C1CF0B09F9BC7BA4048DD35CD015B29B2AD02B99C99F08F165E6
MD5 SHA1 SHA512 SSDEEP TLSH

MainWindow/frame.png

SHA256 ae6cdbba98b3dc0debfbad80500945a948304ccde0381833d628aeaa254bb19f
MD5 fce3066f39f338d53437a5a85cc947fe
SHA1 9c3bdf02a9c599f27d240b4c3c0a659141433c6a
SHA512 f89906e0ff9ffd92403d8fa876e9be14ad464970064306301e58f877d3d06ac3365641d0354cef663a84c131b837aa07f5e3e9de2b0549fa34e9fba6b70a5034
SSDEEP 24576:czdJVRb+oAE/rCjT/OrxtUxln0IJVmVHwmRvxT9dI6I5GjUqvg:czfVKE/rC/0z+J8V/xbIHiUf
TLSH
T17D55331E7E2E8C47856C57A346DAF43A43D6B261021ED567390CF23C2F50E151DBA2EE
MD5 SHA1 SHA512 SSDEEP TLSH

MainWindow/min.png

SHA256 7e024073daf0f7a6dffe375ad6a796db8d0e7e7c11837dcadce6ab64d7fabc87
MD5 d819deedfd3e1c9cbfb2236e30d63844
SHA1 146d9c5d99b94e58c33635f5132da28d84d9bb8f
SHA512 e80dec525b0e895c1248e8dd002c199f53129ede9ff824c7a4275d3a8b107a05ef0fb1949e38a41fef5f6df1ab72f1bb8a042245ee9ceb065fd8f9f56101a113
SSDEEP 96:+cjX45Z9jQpyAN+hqRBVaWNoqPF1voK8OfgONNNKhrnkqOMO:6+p1uqRBVaMz1wILknkXH
TLSH
T15DB17C099634EFE3467AC706585E141E52240DA09B48A4B2FBDFC46AB27C27C837E4C7
MD5 SHA1 SHA512 SSDEEP TLSH

MainWindowWebWindow.xml

SHA256 5ff03bacd79ea90e0f544af4530f4b7b25f40be34a0ab62059166390aa529532
MD5 c593c0002c2755913a99f5f039247d91
SHA1 24e9b2cd50ea3970db26f18a9a39d9facb223106
SHA512 c886f78a709c1d55a1cfbccac4a3fd192347b06b6e0ed7e54263661d827ca5be30f92f2e4a9f7121f2df178a5eb99534aabe4a644f443139e1b2d3c6ca74a013
TLSH
T171F04C2071FC6E354357185BAB325AEC425FB9BE06851580B59F6033A8F6137104B565
MD5 SHA1 SHA512 TLSH

MessageBox.xml

SHA256 6eec6694d34afeb85f54c8ef3fd639bc273825b555135aef3b57a736cc9ae6f0
MD5 84ba581f471a709e69618770a44ecc5a
SHA1 d3e0bbfb670b8c2c15d29e1bd833681badae3537
SHA512 fb7ae043fa601b01650d1117426a3b19d4f47aa01e0460b911088bc5b97d901eea1923184ac10960324ffc98b335fa51e13833e3bface0dde247834d81f16852
TLSH
T1D931CD29FA2C1DBE46D114177F2BB65C010EF516D5903B28F51992BB8EF244304BEA63
MD5 SHA1 SHA512 TLSH

MessageBox/bk.png

SHA256 6143a421daeee350121b6a76b832d49655bc4b69790644a75275fbe3879e0b95
MD5 915487f935ded09be448cb55e5350aa9
SHA1 3fea8c96758b28e9fa7c8cf7e4347d0e2662415a
SHA512 5359f11ba5893927b76d26f9a2e5a5a7ebcefe56c5d0a1b4e83aa5c13f52bf0df2dcb7ecc4fd2b76462067fd597b57b5743008f36435318149075f9b7940a0dc
SSDEEP 48:Wh4S8lYk29WJsEvkVU+lMl888LLz6xN+Y97I7cdp+R75GzS:WySuYkEWmI66xNX7CcXo52S
TLSH
T1A7620F28FDF07565908AE5322DD1280A8C334543FAC19D4AFBDE8D17AF04BE94D4F582
MD5 SHA1 SHA512 SSDEEP TLSH

MessageBox/cancel.png

SHA256 86c374739240850a48ac0a1bcc11712c9f7528fa80f62063137d7b8343a4ec75
MD5 b17e199c69941d3495cc5f9bf6c67fc9
SHA1 4bffffb75fc14ac994e70ab03cfb14cfebf20d59
SHA512 51670fb91e7ef0fddfce73921571776a866de3bc3969722c7f9417d7e770a8f7c759ae0a6d033b2d7a56b6942b75713fc7c5242885840049fed830c16cae1544
TLSH
T19221334DE9C66882638DD45624F254138C234980EF84E85DFDCEC526AF644F546798D7
MD5 SHA1 SHA512 TLSH

MessageBox/close.png

SHA256 f31744bd78dd1d65f2058c5271d7356b3ca48077180106d7130b094edf58d0f2
MD5 7e0c12d16cd0435aec91684b89d28431
SHA1 3369bb9c9d7d3e8388c3e645da8b1de229068fe4
SHA512 ff0d928a818f7000e2c1c9535a3196cae3df36ceff54a3227bee100b2e868caa9a17cc8a66cdd7181f471f1ad4676372d0c2b89b26489bf53588ebcb1dcebaf0
TLSH
T1B631FA7DEF91194091C8E58134F6442B8C23CA4056C0F8CBF4DFC56D29A45F2D58D5CB
MD5 SHA1 SHA512 TLSH

MessageBox/ok.png

SHA256 28ca1b04e7b0211820a36517fe850885a79bb60c59666b24938ad0b324a94e46
MD5 295071338223e7acae32a5cd5d9778f4
SHA1 b950d3cfaa6d2de98d80cac9f0a02c75e6bebdf5
SHA512 8ab80bffaffe0cf8ebc414f14b30400977259a5cf3d6baffd96e836481ff502e6c7eaab65a3095665e662a8f95465eeed588fd8c39fd38b6d54bb94b53bca53d
SSDEEP 48:G4S8lYk29WJsEvkVUmiskmlMl888LUskh6xN+Y97I7cdpRR75PAPPPPPc:7SuYkEWmPLkxCkgxNX7CcX75Pz
TLSH
T1E2625314EDF171A5A089D5321DD2384A5C330683EA81AE46FBCE4C176F04FEA8C4F5C6
MD5 SHA1 SHA512 SSDEEP TLSH

PlayWindow/close.png

SHA256 f6f2edb65d89f80dd2cc02a115bb2806e56d00f18b049f578bb1e3c2b868450f
MD5 685f8fc21e387017b91737ea328a687d
SHA1 3313119bc506b53f3c4723de9fb0a4cd8c73f352
SHA512 faae7e5cb38d954d8ec47622e9d93e6f6d75984c7ee153f6c9af5d9a62f048d93c9c7f4195dc6e041e9aceba95f9b3f3b58b6ce1f92a0c4eaf075807e0765eb3
SSDEEP 48:t/6uMlYk29WJsEvvFifl23u9YBL3itsvMxN+Y97sc5V97jV18g:tShYkEWmkFiFQiEMxNX7sc5Xj/9
TLSH
T168624160F9F075A8B148D6722CD238099C274983D9C1AC45BADE9C5ABF21BD90C0F2D7
MD5 SHA1 SHA512 SSDEEP TLSH

PlayWindow/func_btn.png

SHA256 58b26668e0a3fd0fb9aa18d795e2436fedaf6625df25ab26762fa9cc43685729
MD5 6c340705f8c9671db1f861249cdd98ec
SHA1 93d50460eafd1744837888e241bc672e029208e5
SHA512 c54036ea6e69b7e0c72d2fc40fb02187ff14411401e014b7cda235b4039ffcfcac091ca701583b933d083f7443eaff92dfafff8d386c7883e3013ec05ce22a91
TLSH
T10D716C4A99651C51B21A6645D4EB382BDC7407045BD8734856CC94AFBF283F1C637CDF
MD5 SHA1 SHA512 TLSH

PlayWindow/kefu.png

SHA256 9ad2ec1008f132ba383fb12345195d9b1cfe6a395ba44a0ee1fac37fad1d03a7
MD5 1f78e7416f55db69d93f9e416945a53d
SHA1 cf78f954228f1ed6b14c5dea06e81954ac7f7fc9
SHA512 48b04db9ca115d026045596ef8f5397354ac353f1851de507be99079c4f57b327bd15a1964e58b459d4423c7ddabf38d955b1d4973123d71040bb295d9028e9e
SSDEEP 48:U/6rMh8k29WJsEvTQlBW7uyBLyQxN+Y97sc5k77hp1NVEJd4mavT/:USk8kEWmEy8xNX7sc5EP1wab/
TLSH
T12C62B660BDB07291698D94722CD7694AAC630143E9C05C81FACE5C46BF42FE95C4F5E7
MD5 SHA1 SHA512 SSDEEP TLSH

PlayWindow/logo.png

SHA256 d07eef486311544563355af123e1e1692c1e6ed25ea2ba56d7b681bc869d3339
MD5 a27035a6c375b1bef216416bb5f118b2
SHA1 d5e37a1a4959b85949d091070dd727f3aab81f96
SHA512 3975b00e426b0b09929582ba474bf22e549dcd60b7f311736e2a83d33cc3074309622497f7d85c32fc6e40ccd82945acd83cbd8ad9fe53681e3673f2a71eacfd
SSDEEP 96:cX/Yt3l5tQveZS+adetcHR8ym9XbTA1DXUDUEyKXbuHkOg2zeYfdHbMc:cXG3hQwLaktcm3WDubyKdOtzeYF7Mc
TLSH
T188916DC3BCC15677F4815B014571975E432B21FECD44B6B9F569E1606D09F0450F96C7
MD5 SHA1 SHA512 SSDEEP TLSH

PlayWindow/max.png

SHA256 8696fb8920dfa76fc69c9a6334298cbaf865f4391deefaaa96d424a4c46b6200
MD5 7e982f636b2377ef03cbd43e7eaea980
SHA1 6bf19563bf11189450ec7c1a8b484631ce016d6c
SHA512 e24a7ad39cecf3887d2d6b72e95900ec50bcb5b7b247fad90cc0375914bd7c237e143fb837ccfa4f97da33344ca36702debe57f851640bf65e7418d66fb148e4
SSDEEP 48:z/6uMlYk29WJsEvQXNlTMpLuVBLvXgfvxN+Y97sc5v97J2T5k:zShYkEWmh4DvxNX7sc5JJMk
TLSH
T19D623F24F8F075A9A459E5322CC6290A5C370543D9C0AC80BACD5C577F14BEA5C1F6D7
MD5 SHA1 SHA512 SSDEEP TLSH

PlayWindow/min.png

SHA256 08ad24ea489158aed437896f4f65a7053877da20367664c96169398a5452930d
MD5 8ac7b2aa28f5a121b690ec5ea4280cb6
SHA1 ac70146c5319c78200d37b5cbdb21778e8bb3dc2
SHA512 882af46c6ce82b095fa9ca51b7a9a2fe996833adf68c7876e89018cdc9a807a9ed1c50efd829082eb408f80192ae889bc59a1964a3dd1c6cab88f6de4e9e60dc
SSDEEP 48:h/6FMlYk29WJsEvqCWlKBGSuoUBLCtASxN+Y97sc5qD7DB:hSIYkEWme8kASxNX7sc5IF
TLSH
T181626124FDF034A46089E6321CD2240D8C334683D9D5AD89BACE8C1A7F10BEA4C1F297
MD5 SHA1 SHA512 SSDEEP TLSH

PlayWindow/mute.png

SHA256 a3fa973b2fc1c8bb29c23af24f3992bc7e91eaf34da9cb612f32cb628db814c7
MD5 e78a369ec354357d3efd0414cb316040
SHA1 9c22a93d9dd1c164e9823addd0730bc2e75a0013
SHA512 914860bd07288991b1c5ca32cf54616a11b5653e6d911575aa206655563f440121837a1c8538eab4f643ce98c8eaff35d7d715450dbbb477f65030365cf212c7
TLSH
T18921A84ABCE5349093CDD69021E3842EDD6286C0DDD0E57DDECFC4021F293BD48A9AD6
MD5 SHA1 SHA512 TLSH

PlayWindow/restore.png

SHA256 6627978e51d9d306904c41e1babef01d57c58ed9b282a7adda1609f911f045f3
MD5 fe4d37fbb2d2030922779530ad26e9ca
SHA1 8bceb85db86c0f1a1ce84d7efac0eba2b9921bbf
SHA512 7f90cc518cacaaa314e07c09e36dfd06a4c1d9c4eb21a1418fcfd072d0213dc3f6db61930de7df16574c930066e9438a5e74d8f10566d23902190e568935d9b1
SSDEEP 48:z/62MlYk29WJsEv3FSleMuVfBLgdU+xN+Y9rNGksGvsc5v97GL/B:zSZYkEWm68G+xNXrNGpGvsc5JGL/B
TLSH
T13C627164BDF038A46099E6722CD628055C330A8389C19D81BBCD8C167F01FEA4C8F6D3
MD5 SHA1 SHA512 SSDEEP TLSH

PlayWindow/shouye.png

SHA256 8c8aa0132dc13c36f47db03b4a9357c01e29e4fa7f9228204dc8721074732cb8
MD5 37cf46ff427c9c572be7dec0e30d1fec
SHA1 47bf748bb1008c2a6840d05c6a6e92076a6f424b
SHA512 6802ba9d25acc73d55dcff7d35177dd3e5d66c7e68758ed61ae85734871a271e230c187377b86c454642df8a76cef16a01493c0bf103be3c07f2c6f6f09b80c7
SSDEEP 48:J/6LMh8k29WJsEvTZIKbLljvoMI3uxKbNBLgI9LzRMxN+Y97sc5Z77RnRhQR5CXV:JSE8kEWmERkRAxNX7sc5h2RG4M
TLSH
T1E772A265FCF0B4A4600A96323CD139095E370983DAC0AD41BBCD9D26BF10BEA8C5F5DA
MD5 SHA1 SHA512 SSDEEP TLSH

PlayWindow/sound.png

SHA256 b5defd9485733f87fb0b2ef5f721076c14f4b5cd7128aff69b4e568e43bfe105
MD5 34567c6214cb4fc94ade782fd71cf1d2
SHA1 0209d7a1cf3f7447af74d8ae84c3c8630adf4a4a
SHA512 ce55365ed8694a3d9384587b68c182903dcacfe2b3c6b60685331dcd6ad3b85ab23e9a739fed2150c75deb1744dc5aac9717f33c194c68c91e103dc40549d74f
TLSH
T10C21B689FD4227019569BA8135F350774C3206D4C8C8F47CFACE8A2722723FA89246C7
MD5 SHA1 SHA512 TLSH

PlayWindow/top_bg.png

SHA256 16a8f8d83f281a6c1fc3acc28c4c397062cc04e17789c34cd8ab524d8b0bd693
MD5 e6c97ffe3e9805e23442fbabaa34d076
SHA1 0f2c3114ee62a76df1582f8579923b799db44e2a
SHA512 589677ca5dcfd1973f156c646fa1b37751fa7aa4cc8682a17a458950a195b11ec67bef06982a66806074648d9db3bb91c09bdf530124cd76bff422554883cf56
TLSH
T1F631C6B18D41A803CD295D3E9077A7C617EBA1CB4418872A40283CBDA9F3A171D95228
MD5 SHA1 SHA512 TLSH

PlayWindow/top_left_bg.png

SHA256 5e496c8d0b2d2dcfa18ee6e995b17fbec5df5b01fa6534d42a5bc5a72a097ed2
MD5 ed20e83e43e5c6ad20d73219327a8d3c
SHA1 a28ee0068d19b993a24bce4bec8cefd57bef56a5
SHA512 c2bff7c037e0fe5067d7f17afba3fa87f1619cf3a913abd8d342779cd4ea078cbffaed2011c48ce282bd4d9b3d2190045db192d8ecccda95c27c68662b95f57f
TLSH
T1F4F041ABF9A090C986A58B29001BB01B3730F51102251666404428F6EE585B43CBCAAC
MD5 SHA1 SHA512 TLSH

PlayWindow/top_right_bg.png

SHA256 e2fa139c5764b7517dc3d02f9b063b55a8159282befc73890cfdf4848aa44d53
MD5 002e7d12d2fd0b82690bfe645460df73
SHA1 60af2d358126097089e331f048a2544b95f99ce0
SHA512 293420508ec5082481f183d547f3d41821afe46e6f711dae5682da9391a51b6b1b82358d7a65e4fbac5be3ea72703aacd94cc9c66995ae6c0a32e7a2ac3e84e0
TLSH
T1460183F62EECAC72EC0B2B01E201342C46D22358C4B510FF2E30ED6B406F92008F1683
MD5 SHA1 SHA512 TLSH

PlayWindow/tray.png

SHA256 452c9d109420091918ad3e6abd13b80aa67af443a216fbb596d1b141d20f2dd9
MD5 f947879f664bc57548672d72e71f5af9
SHA1 e3ec663e52e16d161fe54bf266db6cba03d97a7e
SHA512 b25991b6c37ea2c567ece3eba226ac788519bf2cf1aaa453e9842896cb4f5c803c494690bb7d2da94080776d36adf3de51c6076f01e2419db10d098f0e573d32
SSDEEP 48:I/6OMlYk29WJsEvX8HlTLqu18lBLeWLZqvxN+Y97sc5vG7gjNTq5CJS:ISBYkEWmTvxNX7sc50kKx
TLSH
T145628665FDF07669A089F2322DD234495C730683C9D0AC85F6CD8C5A2F12BEA4D4F2C2
MD5 SHA1 SHA512 SSDEEP TLSH

PlayWindow/tray1.png

SHA256 b88bf8ba1b2c85748fa3b4b525482bcdeac5561407ca5ce8fe92494ad0d9b13b
MD5 2af6aa1fb9a4859f447e29e4b45c7c21
SHA1 caeabad15d78f766fd14bcfad1ebfc67a9b0db4c
SHA512 8dcbde6255f305dd6018cebdfe6a6bf303f9e0e0b42360ff568234114fc3002f378059ac643bccbd3a1d2e9844e2a5188c6fb4ae74341997cbcc6b406ba1870c
SSDEEP 48:I/6uMlYk29WJsEvX8mlTLqu18lBLeLXxN+Y97sc5vG7RT6srRo3:IShYkEWmSXxNX7sc50rS
TLSH
T1A3629269FEF035A9A089E5322CC624095C734543D8D29C45FACE8C9B7F11BEA5D8F5C2
MD5 SHA1 SHA512 SSDEEP TLSH

main.xml

SHA256 ab2b4b8447a562d27f4bd374c9b03727eeb7613f66a826baf60d1fc64b75acba
MD5 377fb21ffd8d97750c55385698fb8589
SHA1 492dfe720e8360b745e8e0e1c2e3f503d0005ab7
SHA512 78e5f413e3075c8307c501ed94137f4aae72a3a7acc3e588f1424322caf5dbf58d675a3f85509cac75c7aa5b524ab1aef5b6534761a42372891ddf9ade23270b
SSDEEP 96:sChuZQmwrE9LhrE9pNrE9p1rE9GetEpj5pL48EJ:fhwwrE99rE9DrE9HrE9GetEpjXLnM
TLSH
T197B1DD31ED7D2DBA01F545A5A32BB76C061EA136CA843728F5126026ED7208719BFC6E
MD5 SHA1 SHA512 SSDEEP TLSH

share/close_18x20.png

SHA256 b8173c4ff120a60a9879b11201979345ebe9750ad87e061683b82cb06a43d0a8
MD5 099b948b86cd931ff095ac10d5962220
SHA1 1214fe990774611c3491e2a811d1479f7fa2a47f
SHA512 fc68d3eaba977f5980679bf98e333aa088e252486f991805ec5984b67d8e07aae46e8be105961c0529e81c6548dcc6211fb84a7e503259dc26f370497c604187
TLSH
T12E41096D0A9C2A2E65625A103644CB514F7D147A039CAEF3D8ECF18819B72B4F4A973A
MD5 SHA1 SHA512 TLSH

share/icon.png

SHA256 78363851b1c77078598e31a8cb49f975cde47e2581ecea275a00c28c60274c66
MD5 f45b9da7f5985c256ccb96c50a32287d
SHA1 4600d7c1f8790cb19ec7b3a8994dfc76a8a12d4a
SHA512 4cfeafc871b76dc65018d9b7e485e3f2598c8f5b18acf7fcbaa0575a7906cdf4fb885d82d0317e921450f4e0c30cd11cada01f24aa1dc3430fb522d35fb09a73
TLSH
T1BE31EB5DECF23F53461CB49914FA873A446344645BF475E639DBCA460A300B05479FDB
MD5 SHA1 SHA512 TLSH

share/shadow.png

SHA256 9d97db1d71462a9bd43f29c78de4968f332435004f1298985aa69c91e9a9313f
MD5 2e216fe61f7d79765414e94134b4a11c
SHA1 3cf03dac598c8de9e66abb26bf5d522dcbc8dcd2
SHA512 331addf6a8466ee7e9d6caf028696c782dec4cbdfdd71f024d2fab35f2214448ea6342c1b77ea2c49789ab4a25b9a110d512f071565ae2812a4e92274326255f
SSDEEP 48:+E/6s4S8lYk29WJsEvkVUU48slq888LWxxN+Y97sc50877PKmZ:xS5SuYkEWmvxNX7sc5V7SU
TLSH
T1D9623C68BDF17160A099E4321CD2294A9C324683DAD0AC89FBCD8D17BF05BEA0C4F187
MD5 SHA1 SHA512 SSDEEP TLSH

share/shadow_blue.png

SHA256 0fb0c171c1ff348910d91123a44f9a4c326ade5a8209434bb79d31b84b6aa71c
MD5 c40ace7d97ae2cf039608241b764f797
SHA1 3578516973bacdc8c82fe7c21162c733b107eec9
SHA512 9744f213ab48cc61fbf11a8216b0edaeb0c4ecd08b99f8b6bd7dd19511ac0f21a8d4843888046b9fd6f3cf116496943575309ec9d8504a8a6224d8dfa3bf6aa7
TLSH
T15941C64CFD402D50CA59E843EDE5624B4E37AAC0DAD0E485EECE881728215F6CD4CBC7
MD5 SHA1 SHA512 TLSH

kbly/libcurl.dll

IMPHASH ce01e23545e89604a2fa4ce5791f2ce1
SHA256 412ed3638cdabf9364d26068190d2965f0127f91eb1419a78b827963d0bb5e64
MD5 4aa16416d9f24b961bf119de582d4868
SHA1 7e0821f7d597099d55e864b3f44644b1454c8579
SHA512 40475495d8c16aa8215176925003fa8fa930dce10730a53c2ebef0c2d5fb60f5be10e2e4f5cf05f7e070e79c25e83b6156a2e672ee20e77020863d2d48d3afa6
SSDEEP 49152:5lvE+WJBa1vNTE8Jc9ziGPeYLfgyX8XbX6na:3vE+WJCTE8JKzYcK2a
TLSH
T102E5AF13BE8046A5D8660170B24E9F3D9E3D57280F2A89C7D698DCE89B24BD3173DB1D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

44:3c:00:11:e3:63:fc:bb:3d:b9:38:c8:96:5f:b3:d2:fc:95:52:3b:09:53:33:7b:ca:02:71:5c:c4:a1:82:c9:7e:f6:2a:58:cb:9d:2b:93:5a:0c:d9:8f:0d:60:13:01:29:f9:da:09:0e:9d:69:b7:d2:19:8c:18:05:9a:a6:e7

Digest Algorithm

sha512

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=curl-for-win Code Signing Authority

Chains

Aug 14, 2026

CN=curl-for-win Code Signing Authority

CN=curl-for-win Root CA 2024

Minor OS version

0

Major OS version

6

Entry point

5040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA

iphlpapi

if_nametoindex

kernel32

AcquireSRWLockExclusive CancelIo CloseHandle CompareFileTime CreateEventA CreateFileA CreateFileMappingA CreateMutexA DeleteCriticalSection EnterCriticalSection FormatMessageW GetConsoleMode GetCurrentProcess GetCurrentThreadId GetEnvironmentVariableA GetFileAttributesA GetFileType GetFullPathNameW GetLastError GetModuleFileNameA GetModuleHandleA GetOverlappedResult GetProcAddress GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetTickCount64 GetTickCount GetTimeZoneInformation InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionEx IsProcessorFeaturePresent LeaveCriticalSection MapViewOfFile MoveFileExA MultiByteToWideChar PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReleaseMutex ReleaseSRWLockExclusive SetConsoleMode SetHandleInformation SetLastError Sleep SleepEx TerminateProcess TlsGetValue UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeA WideCharToMultiByte WriteFile

normaliz

IdnToAscii IdnToUnicode

secur32

InitSecurityInterfaceA

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc mbstowcs strtol strtoll strtoul strtoull wcrtomb wcstombs

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _findfirst32 _findnext32 _fstat64 _fullpath _lock_file _stat64 _unlock_file _unlink

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strrchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv __sys_errlist __sys_nerr _beginthreadex _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _errno _execute_onexit_table _exit _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _register_onexit_function abort exit strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf _fseeki64 _lseeki64 _open _read fclose feof ferror fflush fgets fopen fputc fputs fread fseek ftell fwrite getc rewind setvbuf ungetc _write _write _open _fileno _fileno _close

api-ms-win-crt-string-l1-1-0

_strnicmp isalnum isspace isupper isxdigit mbrlen memset strcmp strcpy strcspn strlen strncmp strncpy strpbrk strspn tolower wcscpy_s wcslen wcsncmp wcsncpy _stricmp _strdup

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _difftime64 _gmtime64 _time64 _tzset strftime

api-ms-win-crt-utility-l1-1-0

_byteswap_uint64 bsearch qsort

user32

FindWindowA SendMessageA

wldap32

ber_free ldap_bind_s ldap_err2string ldap_first_attribute ldap_first_entry ldap_get_dn ldap_get_values_len ldap_init ldap_memfree ldap_msgfree ldap_next_attribute ldap_next_entry ldap_search_s ldap_set_option ldap_simple_bind_s ldap_sslinit ldap_unbind_s ldap_value_free_len

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetEvent WSASetLastError WSAStartup WSAStringToAddressW WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostname getpeername getsockname getsockopt htonl htons inet_pton ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

curl_easy_cleanup curl_easy_duphandle curl_easy_escape curl_easy_getinfo curl_easy_header curl_easy_init curl_easy_nextheader curl_easy_option_by_id curl_easy_option_by_name curl_easy_option_next curl_easy_pause curl_easy_perform curl_easy_recv curl_easy_reset curl_easy_send curl_easy_setopt curl_easy_ssls_export curl_easy_ssls_import curl_easy_strerror curl_easy_unescape curl_easy_upkeep curl_escape curl_formadd curl_formfree curl_formget curl_free curl_getdate curl_getenv curl_global_cleanup curl_global_init curl_global_init_mem curl_global_sslset curl_global_trace curl_maprintf curl_mfprintf curl_mime_addpart curl_mime_data curl_mime_data_cb curl_mime_encoder curl_mime_filedata curl_mime_filename curl_mime_free curl_mime_headers curl_mime_init curl_mime_name curl_mime_subparts curl_mime_type curl_mprintf curl_msnprintf curl_msprintf curl_multi_add_handle curl_multi_assign curl_multi_cleanup curl_multi_fdset curl_multi_get_handles curl_multi_info_read curl_multi_init curl_multi_perform curl_multi_poll curl_multi_remove_handle curl_multi_setopt curl_multi_socket curl_multi_socket_action curl_multi_socket_all curl_multi_strerror curl_multi_timeout curl_multi_wait curl_multi_waitfds curl_multi_wakeup curl_mvaprintf curl_mvfprintf curl_mvprintf curl_mvsnprintf curl_mvsprintf curl_pushheader_byname curl_pushheader_bynum curl_share_cleanup curl_share_init curl_share_setopt curl_share_strerror curl_slist_append curl_slist_free_all curl_strequal curl_strnequal curl_unescape curl_url curl_url_cleanup curl_url_dup curl_url_get curl_url_set curl_url_strerror curl_version curl_version_info curl_ws_meta curl_ws_recv curl_ws_send

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

671KB

Virtual Size

670KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer