23082026_1627_21082026_tax documents[.]IMG[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
23082026_1627_21082026_tax documents.IMG.zip
Size 5.1MB
Sample260823-tybb2as1dy
SHA256 583ea749e3fb116ba477a59b88fdf5f294900a4cd24ac1387fa40bc07dbedfba
MD5 435a043c652a768f174432fdb8940d4c
SHA1 c1d44dfa23b880bedf9e3278b77c63c21d1b6cf4
SHA512 3cf63ef5fd9066b1e6091c0530e1b4f6183eb3f261ab2e3e4ec467e5404cf19a985f5ce6992282554593fcfa6ce43470409b5e80f206b5dbbbf890528805805d
SSDEEP 98304:umQzZXJSTo1Oosti55oWcBsCnExhywUOpmN5JbZLXYHj00JZdeRdx:Uso5dciCExhfo5lZLIA0c7x
TLSH
T13736335ACAAC6C792B8312D5984C48453DF2E91FE56D62FB1BE1CE7C9E4C3B43B99040
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/hdp.dLL

File Explorer

23082026_1627_21082026_tax documents.IMG.zip

.zip 5.1MB
tax documents.IMG

.iso 8.9MB
20260821085422.exe

.exe 3.0MB
INT-Number.A128C1CB446F1705C8B.Doc.LNK

.lnk 419B
hdp.dLL

.dll 5.8MB

23082026_1627_21082026_tax documents.IMG.zip

SHA256 583ea749e3fb116ba477a59b88fdf5f294900a4cd24ac1387fa40bc07dbedfba
MD5 435a043c652a768f174432fdb8940d4c
SHA1 c1d44dfa23b880bedf9e3278b77c63c21d1b6cf4
SHA512 3cf63ef5fd9066b1e6091c0530e1b4f6183eb3f261ab2e3e4ec467e5404cf19a985f5ce6992282554593fcfa6ce43470409b5e80f206b5dbbbf890528805805d
SSDEEP 98304:umQzZXJSTo1Oosti55oWcBsCnExhywUOpmN5JbZLXYHj00JZdeRdx:Uso5dciCExhfo5lZLIA0c7x
TLSH
T13736335ACAAC6C792B8312D5984C48453DF2E91FE56D62FB1BE1CE7C9E4C3B43B99040
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

20260821085422.exe

IMPHASH eeca753708e3e991f77bc2c4ee8b2521
SHA256 53a4e54f23228c129e2f3d6f34ac457878e49ed2bb5ac13f05c10a55693d2dd8
MD5 9033f5bed49269403341abcfbd8244eb
SHA1 b2c8ddc97ec6894123ceba781ca0311a25472a3d
SHA512 bef1c4c9fdb148554ccb84320d0164e9f3d4ef27ccb238592a6d56d27b7b901bbcd4540075c5a3302ecb6853ad4d4f827e39de7d75f7c1de6fe7a7ee9030009a
SSDEEP 98304:16NPHPNYDT1g+8UYEP8deLgOgBnr9HUAi58:16NPHPNYDT1g+bYw8deLsnrtge
TLSH
T1A9E59D22F9019432F8E20077D7FE4BBE492DAA30172894D3D7D518A95AB05E27B3B357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Password

infected

Digest

68:8f:a3:c5:25:d1:5e:e4:03:a7:f2:5f:76:54:8d:5c:47:9a:c8:cf:56:75:ad:7c:14:9f:01:b9:fb:65:50:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=9133000070337747XE,CN=Hithink RoyalFlush Information Network Co.\,Ltd.,O=Hithink RoyalFlush Information Network Co.\,Ltd.,L=杭州市,ST=浙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Nov 18, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

b0:94:27:37:e3:fa:e0:f9:29:28:c8:e3:57:f3:9a:44:f3:59:6c:a3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Nov 18, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

Serial Number

01:fe:bc:8a:77:43:53:3e:07:0a:2a:48:0b:f5:10:b5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 1, 2023 - Aug 2, 2026

Minor OS version

Major OS version

Entry point

1982578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\11179 hdp日志回捞\sre\Build\hxdaemonprocess\hxdaemonprocess.pdb

ws2_32

shutdown WSACloseEvent getnameinfo gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select __WSAFDIsSet WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind recv WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent send

wldap32

ord79 ord219 ord301 ord147 ord133 ord46 ord142 ord167 ord127 ord27 ord26 ord117 ord41 ord208 ord216 ord14 ord145

crypt32

CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreW

kernel32

SetEndOfFile SetStdHandle HeapReAlloc FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapAlloc HeapFree GetConsoleCP GetACP ExitProcess SetConsoleCtrlHandler SetFilePointerEx SystemTimeToTzSpecificLocalTime GetDriveTypeW GetModuleHandleExW FindFirstFileExA ExitThread GetTimeZoneInformation RtlUnwind RaiseException UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect VirtualAlloc GetVersionExW LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetPrivateProfileStringA WritePrivateProfileStringA SetLastError CreateDirectoryA GetTickCount OpenProcess TerminateProcess CloseHandle GetLongPathNameA GetCurrentProcessId GetLastError WaitForSingleObject FindClose RemoveDirectoryA SetFileAttributesA GetFileAttributesA DeleteFileA FindFirstFileA FindNextFileA GetTempPathA GetCurrentProcess SetUnhandledExceptionFilter CreateThread GetCurrentThreadId InitializeCriticalSection EnterCriticalSection LeaveCriticalSection ResetEvent WaitForMultipleObjects MapViewOfFile CreateEventW CreateFileMappingW LoadLibraryW GetModuleFileNameW CreateProcessW GetFileAttributesW MultiByteToWideChar GetProcAddress SetEnvironmentVariableA GetModuleHandleW SetCurrentDirectoryA GetCurrentDirectoryA GetDiskFreeSpaceExA VerSetConditionMask VerifyVersionInfoW GetFileSize ReadFile SetFilePointer CreateFileA WideCharToMultiByte DeleteCriticalSection FreeLibrary Sleep LoadLibraryExA GetModuleFileNameA GetModuleHandleA QueryPerformanceCounter QueryPerformanceFrequency CreateToolhelp32Snapshot Process32First Process32Next Module32First GetSystemTimeAsFileTime GetFileInformationByHandle WriteFile SystemTimeToFileTime FileTimeToSystemTime UnmapViewOfFile CreateFileMappingA SleepEx GetSystemDirectoryW FormatMessageW MoveFileExW CompareFileTime GetEnvironmentVariableA GetFileType GetStdHandle PeekNamedPipe GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InterlockedExchangeAdd InterlockedCompareExchange InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExA FormatMessageA CreateFiber DeleteFiber SwitchToFiber ConvertThreadToFiber ConvertFiberToThread LoadLibraryA SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter SetEvent GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo DecodePointer EncodePointer CreateHardLinkW CopyFileW CreateDirectoryExW DeviceIoControl AreFileApisANSI RemoveDirectoryW GetFullPathNameW GetFileAttributesExW GetProcessHeap WriteConsoleW HeapSize GetLocalTime GetSystemTime FindNextFileW FindFirstFileExW DeleteFileW CreateFileW CreateDirectoryW GetCurrentDirectoryW TryEnterCriticalSection GetCurrentThread SwitchToThread DuplicateHandle WaitForSingleObjectEx

user32

PostMessageA GetUserObjectInformationW GetProcessWindowStation EnumWindows GetWindowRect GetPropA MessageBoxA GetWindowThreadProcessId SetTimer LoadImageA GetSystemMetrics SetDlgItemTextA SetWindowPos IsDialogMessageA LoadIconA LoadCursorA GetDesktopWindow SetWindowLongA GetWindowLongA RemovePropA GetMessageA CreateDialogParamA ShowWindow DestroyWindow IsWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA SendMessageA DispatchMessageA TranslateMessage SetPropA

advapi32

CryptReleaseContext CryptAcquireContextW ReportEventA RegisterEventSourceA DeregisterEventSource CryptGenRandom

shell32

ShellExecuteExA SHFileOperationA SHCreateDirectoryExA ShellExecuteA

shlwapi

StrStrA PathAppendA PathCanonicalizeA PathFileExistsA StrToInt64ExA StrStrIA

hdp.dLL

IMPHASH d2de316476ef7aea03d010664dad9e50
SHA256 d93b8f420b4f7b912db5e45d6c19f900896a80027d16efce5023764ef6a49396
MD5 52b5616e792f500a0f6ca2c005d79fc9
SHA1 c075d8976cb752c9cafdeddcb880c2e6a2342bcd
SHA512 7203c0315978b091e68efa83f4f229e0294d44b14427baea37b1735a7994af05a45c891ca348831e4b61d89282827e4a5e391b05ba135713d3e42f0baf818078
SSDEEP 98304:c6CysmjOw4YDZJdbYM6ZahkmwnrSbVHyqbtbZ4OiZrq1DfPHNADtV6v+zM+rwroJ:Bs7wnBP6Zahkm6i1RZ4O7NADtV6v+zZT
TLSH
T15656D0913D5C40A6E05B1231CF6BA2BCF2EE7DB03B75315B1680FA1AFB357414A18A5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

1569536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\dd\vctools\vc7libs\ship\atlmfc\src\NvPluginWatchdog\Release\NvPluginWatchdog.pdb

kernel32

GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP EnumSystemLocalesW IsValidLocale LCMapStringW GetStdHandle GetACP GetModuleFileNameA GetFileType SetStdHandle HeapQueryInformation GetCommandLineW GetCommandLineA QueryPerformanceFrequency GetOEMCP TerminateProcess UnhandledExceptionFilter FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedFlushSList RtlUnwind GetCPInfo GetStringTypeW LCMapStringEx RaiseException OutputDebugStringW IsDebuggerPresent FindFirstFileExA FindNextFileA VirtualQuery GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter IsProcessorFeaturePresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FindResourceExW SystemTimeToTzSpecificLocalTime LocalFileTimeToFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime GetStringTypeExW MoveFileW DuplicateHandle UnlockFile SetEndOfFile ReadFile LockFile GetVolumeInformationW GetShortPathNameW FlushFileBuffers IsValidCodePage FindFirstFileW FindClose SearchPathW GetProfileIntW SetFilePointer GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW LocalReAlloc LocalAlloc GlobalHandle TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetThreadLocale WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetTickCount64 CompareStringA GetVersionExW GetCurrentThread GlobalGetAtomNameW lstrcmpA lstrcmpiW GetWindowsDirectoryW GetUserDefaultLCID ReplaceFileW SetFileTime GetTempFileNameW GetFullPathNameW GetFileTime GetDiskFreeSpaceW GetCurrentDirectoryW ResumeThread SetThreadPriority GlobalReAlloc VerifyVersionInfoW VerSetConditionMask GetCurrentProcessId FileTimeToSystemTime CompareStringW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryA LoadLibraryExW GetModuleHandleA FreeLibrary EncodePointer OutputDebugStringA MulDiv GlobalFree GlobalLock GlobalUnlock GlobalSize GlobalAlloc GetProcessHeap DecodePointer HeapReAlloc HeapSize InitializeCriticalSectionEx GetTempPathW CreateMutexW SystemTimeToFileTime CreateThread GetLocalTime DeviceIoControl Process32NextW Process32FirstW CreateToolhelp32Snapshot ExitProcess CreateDirectoryW GetTickCount VirtualProtect GetSystemDirectoryW GetModuleHandleW WriteProcessMemory lstrcpyW CreateProcessW MultiByteToWideChar CopyFileW lstrcatW GetModuleFileNameW GetFileAttributesW LocalFree GetCurrentProcess DeleteFileW WriteFile UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSize CreateFileW GetModuleHandleExW FindResourceW LoadResource VirtualFree LockResource SizeofResource TryEnterCriticalSection GetProcAddress LoadLibraryW SetWaitableTimer CreateWaitableTimerW lstrlenW WideCharToMultiByte ResetEvent CancelIo CreateEventW SetLastError SwitchToThread GetCurrentThreadId GetLastError FormatMessageW SetEvent Sleep WaitForSingleObject CloseHandle CreateEventA HeapDestroy HeapCreate LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapFree HeapAlloc VirtualAlloc GetSystemInfo

user32

GetCursorPos SetCursor MessageBeep DeleteMenu GetSystemMenu ReleaseCapture SetCapture GetAsyncKeyState CharUpperW IsZoomed TrackMouseEvent IntersectRect DrawIconEx IsRectEmpty OffsetRect DrawFocusRect SetWindowRgn DrawStateW DrawFrameControl DrawEdge EnumDisplayMonitors SystemParametersInfoW LoadCursorW GetSysColorBrush SetLayeredWindowAttributes GetWindowThreadProcessId GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW ReleaseDC GetDC MapVirtualKeyW GetKeyNameTextW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageW SetWindowTextW IsWindowEnabled CheckDlgButton SetDlgItemTextW MoveWindow ShowWindow GetMonitorInfoW WindowFromPoint WinHelpW GetScrollInfo SetScrollInfo LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow GetLastActivePopup GetTopWindow GetClassNameW GetClassLongW SendNotifyMessageW CopyAcceleratorTableW InSendMessage IsClipboardFormatAvailable SetCursorPos PeekMessageW TranslateMessage DispatchMessageW SetWindowLongW GetWindowLongW PtInRect EqualRect DestroyCursor MapWindowPoints AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW MonitorFromPoint GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow TrackPopupMenu SetMenu GetMenu GetCapture GetKeyState SetFocus GetDlgCtrlID NotifyWinEvent CreatePopupMenu DestroyMenu GetMenuDefaultItem SetMenuDefaultItem OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DestroyIcon CopyImage BringWindowToTop GetUpdateRect LockWindowUpdate SetRect GetDlgItem IsIconic IsWindowVisible EndDeferWindowPos UnionRect GetDesktopWindow GetMenuItemInfoW RegisterClipboardFormatW SetClassLongW GetActiveWindow DestroyAcceleratorTable SetParent UpdateLayeredWindow MonitorFromWindow MsgWaitForMultipleObjects EnableWindow LoadBitmapW GetClientRect FillRect InflateRect GetParent SetRectEmpty LoadMenuW GetSubMenu SendMessageW ScreenToClient InvalidateRect UpdateWindow GetWindowRect GetSysColor IsChild GetFocus LoadImageW GetSystemMetrics RedrawWindow CharUpperBuffW PostMessageW SetTimer KillTimer PostQuitMessage DefWindowProcW RegisterClassW CreateWindowExW UnregisterClassW GetMessageW IsWindow MessageBoxW ClientToScreen GetMenuStringW GetMenuState GetMenuItemID GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu RegisterWindowMessageW GetMessagePos GetMessageTime CallWindowProcW GetClassInfoW GetClassInfoExW IsMenu DestroyWindow SetWindowPos GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos GetIconInfo ModifyMenuW LoadAcceleratorsW TranslateAcceleratorW EnableScrollBar RemovePropW CreateMenu InsertMenuItemW UnpackDDElParam ReuseDDElParam WaitMessage SetWindowContextHelpId MapDialogRect CreateDialogIndirectParamW EndDialog GetNextDlgTabItem PostThreadMessageW ShowOwnedPopups FrameRect HideCaret InvertRect SendDlgItemMessageA RealChildWindowFromPoint ToUnicodeEx GetKeyboardLayout GetKeyboardState CreateAcceleratorTableW GetDoubleClickTime CopyIcon SubtractRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel EnumChildWindows DrawIcon GetComboBoxInfo GetNextDlgGroupItem CharNextW InvalidateRgn GetWindowRgn MapVirtualKeyExW IsCharLowerW CopyRect

gdi32

RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectObject SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign StartDocW MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetTextMetricsW CombineRgn CreateEllipticRgn Ellipse GetBkColor RectVisible CreatePolygonRgn Polygon Polyline GetMapMode SetRectRgn DPtoLP CreateRoundRectRgn GetDIBits RealizePalette SetPixel StretchBlt CreateDIBSection SetDIBColorTable GetWindowOrgEx Rectangle RoundRect EndDoc StartPage EndPage AbortDoc SetAbortProc GetRgnBox OffsetRgn LPtoDP CreatePalette GetPaletteEntries ExtFloodFill SetPaletteEntries EnumFontFamiliesExW FillRgn FrameRgn GetBoundsRect PtInRegion GetViewportOrgEx GetNearestPaletteIndex GetSystemPaletteEntries GetTextFaceW SetPixelV LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel GetObjectType GetClipBox ExcludeClipRect Escape CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC BitBlt PatBlt CreateRectRgnIndirect CreateBitmap SetTextColor SetBkColor GetDeviceCaps CreateDCW CopyMetaFileW DeleteDC CreateFontIndirectW DeleteObject GetTextExtentPoint32W GetStockObject GetTextColor PtVisible GetObjectW

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW GetJobW

advapi32

CloseServiceHandle GetTokenInformation ConvertSidToStringSidW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegCreateKeyExW SetFileSecurityW GetFileSecurityW RegSetValueW DeleteService ControlService StartServiceW OpenServiceW OpenProcessToken CreateServiceW OpenSCManagerW RegDeleteTreeW AdjustTokenPrivileges LookupPrivilegeValueW FreeSid CheckTokenMembership AllocateAndInitializeSid RegCreateKeyW RegQueryValueExW RegCloseKey RegSetValueExW RegDeleteValueW

shell32

ShellExecuteExW ExtractIconW SHGetFileInfoW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetDesktopFolder SHAppBarMessage DragQueryFileW DragFinish ShellExecuteW SHAddToRecentDocs SHBrowseForFolderW SHGetMalloc SHGetFolderPathW

comctl32

ImageList_Draw InitCommonControlsEx ImageList_AddMasked

shlwapi

PathFileExistsW PathFindExtensionW PathFindFileNameW PathStripPathW PathIsUNCW PathStripToRootW StrFormatKBSizeW PathRemoveFileSpecW

uxtheme

GetThemeColor GetCurrentThemeName GetThemeSysColor GetWindowTheme DrawThemeText IsAppThemed GetThemePartSize IsThemeBackgroundPartiallyTransparent OpenThemeData DrawThemeParentBackground DrawThemeBackground CloseThemeData

ole32

CLSIDFromProgID CoCreateInstance CoInitialize SetConvertStg GetClassFile CoDisconnectObject OleFlushClipboard OleIsCurrentClipboard DoDragDrop OleGetClipboard CoGetClassObject CoRevokeClassObject CoRegisterMessageFilter CoInitializeEx OleCreateMenuDescriptor OleUninitialize OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleInitialize CoFreeUnusedLibraries CoUninitialize CLSIDFromString CreateFileMoniker StgIsStorageFile StgOpenStorage StgCreateDocfile OleSetMenuDescriptor OleGetIconOfClass OleLockRunning OleSetContainedObject OleSaveToStream OleSave OleLoad OleCreateFromFile OleCreateLinkToFile OleCreateStaticFromData OleCreate CreateItemMoniker CreateGenericComposite CreateILockBytesOnHGlobal GetHGlobalFromILockBytes WriteClassStm StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateStreamOnHGlobal OleRegGetUserType ReleaseStgMedium OleDuplicateData ReadFmtUserTypeStg WriteFmtUserTypeStg CreateBindCtx CoTreatAsClass WriteClassStg ReadClassStg CoTaskMemFree CoTaskMemAlloc StringFromCLSID StringFromGUID2 CoCreateGuid CoLockObjectExternal RegisterDragDrop RevokeDragDrop

oleaut32

VariantChangeType VariantInit SysAllocStringLen SysAllocString VariantClear SafeArrayDestroy VariantCopy VarBstrFromDate LoadTypeLi OleCreateFontIndirect SystemTimeToVariantTime VariantTimeToSystemTime SysStringLen SysFreeString

oledlg

OleUIBusyW OleUIConvertW OleUIEditLinksW OleUIInsertObjectW OleUIAddVerbMenuW

gdiplus

GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics GdipDrawImageI GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown GdipCreateBitmapFromStream

ws2_32

WSASetLastError WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAEventSelect WSACreateEvent WSAResetEvent shutdown WSAGetLastError send recv select WSAIoctl connect htons gethostbyname socket closesocket setsockopt WSACleanup WSAStartup WSACloseEvent

winmm

timeGetTime PlaySoundW

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

415KB

Virtual Size

414KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00CFG0

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

23082026_1627_21082026_tax documents.IMG.zip

tax documents.IMG

20260821085422.exe

ws2_32

wldap32

crypt32

kernel32

user32

advapi32

shell32

shlwapi

generic

INT-Number.A128C1CB446F1705C8B.Doc.LNK

hdp.dLL

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ws2_32

winmm

oleacc

imm32

generic