SSJJ-bz-wd-Installer (1)[.]exe

resource
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/IpConfig.dll
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

SSJJ-bz-wd-Installer (1).exe

IMPHASH 1f23f452093b5c1ff091a2f9fb4fa3e9
SHA256 40d529c56d6efc72ee0c2db380722e1e0fa0b6fb0034d1a1d78d370692089253
MD5 ae6bcfa1489bcc76e50d2df74b59a317
SHA1 2e78481fc469be8ff11dd51d5ca40a89d59addc2
SHA512 3c4f4cbb7a43da3f19be2d71c0e4512da67c072b07e3ac93494f6a54affd79fd348efa22639e28d7916d35d7a26ce2f61cb3dd3628b76dc9eef0b9af475b030a
SSDEEP 49152:GQao6/+1s31WXgdq671M43oJHEOT/vEZiBEub2jjH8Oggwa:95tsEXgYo1M43oJHptBEub2jIOgFa
TLSH
T1D9B533017F856C0FCFA729323CF0D566E8346E821C7A9B539231FC586BB26846E953D9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Password

1122

Digest

2c:8e:cb:f1:b8:e2:36:d8:2e:f4:e3:4f:19:b7:a8:38:5d:72:cf:00:bf:fc:91:61:c4:9c:5d:f8:4d:9f:d8:2a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jan 20, 2020

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

6e:ac:77:59:b4:6e:76:54:98:c6:8b:68:f7:42:62:ce:27:fc:5c:75

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jan 20, 2020

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

02:f9:e9:ea:01:af:ba:10:0b:a1:31:9c:24:91:32:bb

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 5, 2019 - Jan 23, 2022

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

06:0e:67:ed:0c:51:28:35:12:bd:6c:69:69:49:ee:2b

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 21, 2018 - Jan 23, 2022

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

13477

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess SetCurrentDirectoryW GetFileAttributesW SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW GetShortPathNameW GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalUnlock GetDiskFreeSpaceW GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/INetC.dll

IMPHASH 735e27ae3d7df8c0487e4353d04f6f28
SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
MD5 640bff73a5f8e37b202d911e4749b2e9
SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
TLSH
T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

1122

Minor OS version

0

Major OS version

4

Entry point

17741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LocalFree WideCharToMultiByte TerminateThread lstrcpyW LoadLibraryA CreateThread WaitForSingleObject LocalAlloc lstrcpynW SleepEx MulDiv GetModuleHandleW ReadFile GetLastError CreateFileW lstrcmpiW CreateFileA lstrcatW GetFileSize SetFilePointer lstrcmpW MultiByteToWideChar lstrlenA WriteFile lstrlenW CloseHandle GlobalAlloc GlobalFree GetTickCount DeleteFileW

user32

GetDlgItem DestroyWindow GetClientRect MessageBoxW wsprintfA SystemParametersInfoW GetWindowTextW GetWindowLongW FindWindowExW IsWindow CreateDialogParamW GetParent ShowWindow KillTimer DispatchMessageW LoadIconW PostMessageW IsDialogMessageW GetMessageW SetWindowPos SendDlgItemMessageW SetWindowTextW TranslateMessage GetWindowRect RedrawWindow SetTimer EnableWindow UpdateWindow SetWindowLongW wsprintfW SendMessageW SetDlgItemTextW IsWindowVisible

comctl32

ord17

wininet

InternetConnectW HttpOpenRequestW InternetQueryOptionW InternetErrorDlg HttpSendRequestExW InternetWriteFile HttpSendRequestW InternetSetFilePointer HttpAddRequestHeadersA FtpCreateDirectoryW InternetCrackUrlW FtpOpenFileW InternetSetOptionW InternetOpenW InternetGetLastResponseInfoW HttpEndRequestW InternetReadFile HttpAddRequestHeadersW InternetCloseHandle HttpQueryInfoW

$PLUGINSDIR/IpConfig.dll

IMPHASH 3f0fda09180f619ca116344bede41608
SHA256 fe2093ff4bfa1d7259c922aca1e7bb219c4d234e469942446d9e2f8086b7d720
MD5 a75e3775daac9958610ce1308e0bca3b
SHA1 d83ce354cde527c2e20fb425415f6d4795dd4cd4
SHA512 48168a91ec90df262b1e158f32b4bc2a6d6ce10022eb96d4a6f3c755b977e5c104558626adaa214bda29d7f1d246f19e2df59b9a338982aa1c623e1bdd5714c6
SSDEEP 3072:oa/4Ftm9rSlia00FW96LOsWNQmtQ9WVx95+tTIJ:t/4S9raiae8DSDtQ9W3utEJ
TLSH
T121C35B11B6A0C030D1E745BD497DCA589E3A79306BF180CB73E5169EAAF07E09B713A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

1122

Minor OS version

0

Major OS version

5

Entry point

10306

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Unicode\Plugins\IpConfig.pdb

kernel32

InterlockedIncrement InterlockedDecrement GlobalAlloc lstrcpynW GlobalFree lstrcpyW FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA HeapFree GetProcessHeap GetLastError GetCurrentThreadId GetCommandLineA RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep HeapSize ExitProcess HeapAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA RtlUnwind LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage SetFilePointer WriteFile GetConsoleCP GetConsoleMode MultiByteToWideChar LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

wsprintfW

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayGetElement VariantInit SysAllocStringByteLen VariantCopy VariantClear SafeArrayGetLBound SysStringLen SysAllocString

$PLUGINSDIR/StdUtils.dll

IMPHASH 7b79709c0d5576549eb261e3410f95f8
SHA256 4787e95796035dda92a6cbff56ffddde5ace96f5e46f0f40d2998189ccd6e7ce
MD5 b7f044787bb5a0c1eb43907c061c1ac0
SHA1 84675f05e0e406482a688c61e0dee35b9a8fb390
SHA512 7f0ebc15ee74050a8b493f2c944fc6551056efedde60193be76d4115d28b10f06cc9a859cb42135deee56d614d2ca90e432627f30432d303320dd41fc7fcde6f
SSDEEP 1536:1k3Dhu2n/PaONjb0GCDeTF7Rqh7AG2gCf46Q6K3le45Gq:CNu2n/SOx0hDeTF7Rqh7Bl2K3lefq
TLSH
T1DAA35C61A2FAACF5E1E70A3C146AB65A4DB77F382434CDAF2302410F9934642DA6D357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

1122

Minor OS version

0

Major OS version

5

Entry point

59428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

iswspace ??3@YAXPAX@Z _msize _wsetlocale _snprintf iswcntrl _beginthreadex time srand rand clock _getpid _wsplitpath iswgraph __wgetmainargs wcsncpy _wcsnicmp wcschr calloc free _wcsicmp _snwprintf swscanf abort ??2@YAPAXI@Z memset memcpy

shlwapi

ord176

crypt32

CryptProtectData CryptUnprotectData

kernel32

GlobalFree MultiByteToWideChar WideCharToMultiByte InterlockedExchange HeapValidate InterlockedDecrement InterlockedIncrement GetSystemTime OutputDebugStringA GetExitCodeProcess InitializeCriticalSection SystemTimeToFileTime TerminateThread WaitForSingleObject LocalFree GetFullPathNameW GetVersion GetFileAttributesW LoadLibraryW FreeLibrary CloseHandle lstrcpynW GlobalAlloc DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetTickCount Sleep VerSetConditionMask GetCurrentProcess GetModuleHandleW FatalAppExitW GetVersionExW TerminateProcess GetModuleFileNameW RaiseException VerifyVersionInfoW GetLastError GetProcAddress SetFilePointerEx WriteFile ReadFile CreateFileW GetFileSizeEx GetCommandLineW

user32

MsgWaitForMultipleObjects PeekMessageW DispatchMessageW wsprintfW DestroyWindow SetTimer UnregisterClassW KillTimer LoadStringW MessageBoxW GetWindowThreadProcessId AllowSetForegroundWindow CreateWindowExW RegisterClassW MessageBoxA

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

ShellExecuteExW SHFileOperationW ShellExecuteW

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 75ed96254fbf894e42058062b4b4f0d1
SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
TLSH
T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

1122

Minor OS version

0

Major OS version

4

Entry point

10647

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH e1c0bd3d5b9f3f5cec7ea773ff66ac6e
SHA256 b8fa7b9393fff910144768588c471ca7c9ec98a2b8b186b2172b8ba7a5279500
MD5 a6f622a2f12ac10bca04e23deff5cada
SHA1 abf851b5ccfb64004e9b49718a467bd754545887
SHA512 35c8b0db179104e638f1b40f3f8038a41fdc327e112de5cb0dbb97cbf1dfa276fcf6400fcb46b88cb5ba233ca769becbdb4b4d40920adca831e3c0f38193c50f
TLSH
T1CB8160BBA3F40CF3D0954BBB40A30CA792B2DDB02B16401F4987568A2085A6FFD5E705
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

1122

Minor OS version

0

Major OS version

4

Entry point

4714

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH e2ee55bddad4241d619d6a8a38e2d869
SHA256 feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
MD5 ca95c9da8cef7062813b989ab9486201
SHA1 c555af25df3de51aa18d487d47408d5245dba2d1
SHA512 a30d94910204d1419c803dc12d90a9d22f63117e4709b1a131d8c4d5ead7e4121150e2c8b004a546b33c40c294df0a74567013001f55f37147d86bb847d7bbc9
SSDEEP 192:oF8cSzvTyl4tgi8pPjQM0PuAg0YNy8IFtSP:EBSzm+t18pZ0WAg0R8IFg
TLSH
T16312F793E5A820B3C6D3523F35BE2B2EC7B95335B0512C0487738A497A6947A6E38347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

1122

Minor OS version

0

Major OS version

4

Entry point

7443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

WDlauncher.exe

IMPHASH 51b52e8778db954dda3149403236c0f4
SHA256 1f093de225c1c7788e2eca65c7b993b9882c7b90c0e8614a5a92f6745c96838b
MD5 a93fabf128d0443491916a0bba141385
SHA1 7eda2a6cceb4d0dd28722a01d9d6ee1ec8b3733d
SHA512 f7f561706094769f1c4a4931b9def22e6ac35c7efd12746717769a8d62e8048337a8a57425ede224d74c4b474595dfa5c11a859cb22ad8985bab6c8b97ac2da5
SSDEEP 49152:4hanOcdydkw1pvJ+BQbpFnaOa5yakKoJ8ynkSdTyxehPqYWO:4hkyOOaMHPznGxehz
TLSH
T1C8B58D203742C173FE931271997EA76F443DAE64072641DFA3C82E2E29706E3673A657
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Password

1122

Digest

ae:a4:1c:3b:33:08:8f:26:a1:c8:4f:57:2f:c1:21:a4:32:ea:65:85:9f:60:98:e2:84:ef:05:d3:e4:8e:87:dd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jan 20, 2020

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

bf:fb:ed:4e:8d:71:24:eb:e2:ca:67:94:24:cb:8e:ec:34:b2:41:23

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jan 20, 2020

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

02:f9:e9:ea:01:af:ba:10:0b:a1:31:9c:24:91:32:bb

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 5, 2019 - Jan 23, 2022

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

SERIALNUMBER=91330106699809363L,CN=Zhejiang Wizard Technology Co.\, Ltd,O=Zhejiang Wizard Technology Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

06:0e:67:ed:0c:51:28:35:12:bd:6c:69:69:49:ee:2b

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 21, 2018 - Jan 23, 2022

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

5

Entry point

1236995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\microclient_build\build\launcher\bin\Release\WDlauncher.pdb

ws2_32

htons ntohs setsockopt getsockopt getaddrinfo accept listen recvfrom getsockname getpeername connect closesocket bind send recv WSASetLastError select WSACleanup WSAStartup gethostbyname inet_ntoa __WSAFDIsSet socket WSAGetLastError WSAIoctl freeaddrinfo ntohl htonl gethostname ioctlsocket sendto

psapi

GetProcessImageFileNameW

kernel32

VerifyVersionInfoW GetSystemTimeAsFileTime GetEnvironmentVariableA GetFileAttributesA GetLogicalDriveStringsW QueryDosDeviceW InitializeCriticalSection SleepEx GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerifyVersionInfoA ExpandEnvironmentStringsA GetStdHandle PeekNamedPipe WaitForMultipleObjects SetLastError FormatMessageA CreateFileA GetFileSizeEx WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage GetProcessHeap SetStdHandle GetTimeZoneInformation HeapSize FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode HeapReAlloc HeapFree GetFullPathNameW HeapAlloc ExitThread GetDriveTypeW SetEnvironmentVariableW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetModuleHandleExW RtlUnwind VerSetConditionMask QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue OutputDebugStringW LocalFree GetStartupInfoW IsDebuggerPresent InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter FindFirstFileW GetVersionExW SetEnvironmentVariableA ResetEvent SetEvent SetThreadPriority GetSystemDirectoryW GetLongPathNameW GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW QueryPerformanceFrequency QueryPerformanceCounter TlsFree GetLocalTime GlobalUnlock GlobalLock GlobalAlloc WideCharToMultiByte DosDateTimeToFileTime SystemTimeToFileTime DuplicateHandle SetFileTime SetFilePointer WriteFile GetFileType GetCurrentProcess CreateFileW ReadFile GetFileSize MulDiv DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException DecodePointer ExitProcess GetCurrentDirectoryW SetCurrentDirectoryW FindResourceW GetModuleHandleW GetModuleFileNameW GetTickCount SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetACP LoadLibraryW TlsSetValue TlsGetValue TlsAlloc CreateEventW EncodePointer GetCurrentThread WaitForSingleObjectEx GetCurrentThreadId TryEnterCriticalSection AreFileApisANSI CreateHardLinkW SetFilePointerEx SetEndOfFile GetFileInformationByHandle GetFileAttributesExW lstrcpynA GetProcAddress FreeLibrary MoveFileExW CopyFileW LeaveCriticalSection EnterCriticalSection SetFileAttributesW RemoveDirectoryW CreateDirectoryW FindNextFileW FindFirstFileExW FindClose GetStringTypeW FormatMessageW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetFileAttributesW Sleep GetExitCodeThread TerminateThread CreateThread TerminateProcess GetCurrentProcessId OpenProcess DeleteFileW CloseHandle WaitForSingleObject GetLastError GetProcessId IsProcessorFeaturePresent GetExitCodeProcess InterlockedDecrement InterlockedIncrement UnregisterWaitEx

user32

GetClientRect GetWindowRect ScreenToClient SetCursor IntersectRect UnionRect OffsetRect LoadCursorW GetMessageW CreateWindowExW IsWindow DestroyWindow UpdateLayeredWindow SetWindowPos IsIconic SetFocus GetFocus GetKeyState SetCapture ReleaseCapture SetTimer KillTimer GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos IsRectEmpty PtInRect GetWindowLongW SetWindowLongW GetParent PeekMessageW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW ShowWindow EnableWindow SetPropW GetPropW MonitorFromWindow GetMonitorInfoW IsZoomed SetWindowRgn MonitorFromPoint CharNextW MoveWindow GetWindowRgn CharPrevW DrawTextW FillRect SetRect HideCaret ShowCaret GetCaretPos ClientToScreen GetSysColor MapWindowPoints SetWindowTextW GetWindowTextW GetWindowTextLengthW DispatchMessageW TranslateMessage MessageBoxW PostMessageW SendMessageW FindWindowW CreateAcceleratorTableW InvalidateRgn GetWindowPlacement SetForegroundWindow GetWindowThreadProcessId GetClassNameW GetWindow EnumWindows

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW GetDeviceCaps TextOutW GetObjectA SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRectRgnIndirect CombineRgn CreateDIBSection PtInRegion CreateRectRgn CreateRoundRectRgn GetObjectW GetTextMetricsW SelectObject SaveDC RestoreDC GetStockObject DeleteObject DeleteDC CreatePen BitBlt

shell32

SHGetSpecialFolderPathW ShellExecuteExW ShellExecuteW

ole32

CoCreateGuid OleLockRunning CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal CoInitializeEx CoCreateInstance

oleaut32

VariantClear VariantInit SysAllocString SysStringLen SysFreeString

advapi32

CryptCreateHash RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

gdiplus

GdipDeleteGraphics GdipCreateFromHDC GdipDeleteStringFormat GdipSetPenDashStyle GdipSetPenMode GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAddPathArcI GdipAddPathLineI GdipDeletePath GdipCreatePath GdipFree GdipAlloc GdiplusStartup GdipSetStringFormatAlign GdipSetStringFormatFlags GdipCloneStringFormat GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipStringFormatGetGenericTypographic GdipDrawImageRectI GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipLoadImageFromStream GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipDrawLineI

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

iphlpapi

GetAdaptersInfo

comctl32

ord17 _TrackMouseEvent

wldap32

ord143 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord46

crypt32

CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertGetNameStringA CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CertAddCertificateContextToStore CertFreeCertificateChain CryptStringToBinaryA

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

440KB

Virtual Size

440KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=21, id=241, version=40116,

count=193, id=243, version=40116,

count=31, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=199, version=41118,

count=29, id=259, version=24123,

count=20, id=260, version=24234,

count=64, id=261, version=24234,

count=130, id=261, version=24123,

count=39, id=260, version=24123,

count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=99, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=490, id=1, productName=Unmarked objects,

count=8, id=260, version=24218,

count=79, id=261, version=24218,

count=1, id=255, version=24218,

count=1, id=151,

count=1, id=258, version=24218,

locales/bz

SHA256 6dfa34a8c77431dc2f550727309bb18e682b165bce5163db9690249d809454f6
MD5 87f1b3770f84e617039c474053693edf
SHA1 b0d413070cb248ba6ba7a330e9ff96cc78b9c570
SHA512 b739f1caead840ad5386b783901c28388cb1ec86469659cc262922df23d79c0c8f01a685127948e8fbc4586e601c0c1d65d5fb51d691741e1cc124b2511f3f14
TLSH
T1612157AE0803C151FDA5072E521D0F459F816411FF056A4DCAEB4AA59337924F92EE8B
MD5 SHA1 SHA512 TLSH

locales/jp

SHA256 e80f0a9c10390eb5147db1ef438e8d6ff17be9a616eca199cbd7e595ed529300
MD5 c420ad2f0141b32d9c887f9525e1fbeb
SHA1 f29e187fac5260e28e18e1eb8b4a777ff2f826b6
SHA512 ba6e28ab6ffa381267ef4d18923030743d24eec6337156fabbf5d0ac09ddb5dd4f98eaf01bee8c1ed70576fb9d99a3d794659307ba3517670ed9090cedde5e8d
TLSH
T1162129AD5206C391ACB8133D190C5651BF817C61FEB65A7CCACEC811633389DE528E36
MD5 SHA1 SHA512 TLSH

locales/na

SHA256 6262d15b2602d6b74f06015d46a5dffcd00204ae7ee1ba556c70b8d74a78734d
MD5 99c3b3df55fda198b68b61a4cd701aa1
SHA1 587331166379c7d8d1ebf0c02d11e94e0b984a3a
SHA512 05e3e18a371e622735ed777d265ac6ef3f3635cc22f6824b2038228d54b77d2afc31a5aef34843feedbe6bb4706e2aee9cb21620db967b38bbd26b552423b0f3
TLSH
T1382162BE5406C1A0BCA0031D620C4765AED0B493F714AA5DCADB4859437B924F6BFF1B
MD5 SHA1 SHA512 TLSH

locales/nabz

SHA256 b9492121f4500d900c72aac8fdb9abab880962d5b18e101a6bba375d50f53de9
MD5 b6e421bd89e35119bc9e99a9e5a09df5
SHA1 19e48bc9b1f23fab52146b8c886d51f173db3934
SHA512 12a360c61c3f402bd73f4254cebb6d8623c615affae04a6eb96ace6dfc9a46fce4d22ea7289ed86ee7d480eb801619553d72a744f2daa43e4fef94ac9bfd04fd
TLSH
T1072162BE6402C1A0BCA0031D614C4765AED0B463F714AA5DCEDB4859437B824F6BFF5B
MD5 SHA1 SHA512 TLSH

locales/tk

SHA256 0328da3660f3ba5da50482fd9f56acb83d8008a0a959115d87f5c0db463938dd
MD5 4698911577221ec52c8d274aba6516d2
SHA1 e15a0719ac2f88f0fc416e3d5e51c18fbf0101a6
SHA512 d562ca1c0dc7b7adb669c8f4a8af2fe1c37550c486feb5978c3a157cfd827f2f0359d91d61a8d8390fb6bf2828e1370ce9327d0850fc94dd1814dc31a45f1575
TLSH
T1FC214CAE6813D420AF44231D2A0E0754AFD4B615FB241D99EBCE581153B7C24F62FF1B
MD5 SHA1 SHA512 TLSH

locales/tw

SHA256 e415ab0d2d395eeed104ebc284e736a55fea27239e3250f4e3972dbfd3d82d07
MD5 24c8836d101a96d6238c7ef4c216c382
SHA1 f9dad5829768ca5282f1f5734830c6ae4d9bad10
SHA512 92a169bb742007e6cd40e4ff0cf0ac97f3f4cac98dfb32051609863a1d0d83dbd4986f1cc265457c94ec253f2c67821b9bdae3ef1a3cec57279c0b329743140a
TLSH
T15611367A1807C2A4AE65636E460C53195FD07032F780296DCFDB4845633B82AA939F1F
MD5 SHA1 SHA512 TLSH

locales/viet

SHA256 64149ad90b3e32e5a8e20c2149e107326a745d58bfb8800a982ed0fb1ac01a2e
MD5 62d57554fb81081742ebbb5edf5782a9
SHA1 32473f0a0d09f94e967e55e3c489686ec11c3ad5
SHA512 9eb76b2c9ec3698d03a9901502d168baabcbc6fffb1f249915fbf9a256172496896f906ddc2eb0bfe2f0223af60fcc45c392111b848d6c2b37ecb9948c6cb615
TLSH
T1772138BA2447C020FE5C0B1D844D4358AFD4B52AF3502A9DEBEA18959377C14F92DF0B
MD5 SHA1 SHA512 TLSH

locales/zh-CN

SHA256 bd8de6c75186e616fbca948d79ce983074add9a94e3f2c75e13f28aac8def7c4
MD5 53df424b1a4e758bedc5d61817e0ed73
SHA1 915421c99c96c7e12c00e4b0c3580eb8dcb52123
SHA512 a1e457e9768cfb478a249e4004611a585a2fd6d3418cd9bce40f1633f5aff265de0966f94f082aa6fb1aa3776492d6bbc0d6f67ba3c03c7683ff080c5cb27160
TLSH
T1521136BA1403C2D0AE99135C261C66086E947011FB585D9EDBD698849337D29E92CE0B
MD5 SHA1 SHA512 TLSH

platform.ini

SHA256 d23a5beaacaee8f08a31e0e5b544655a373d3ec0e9b55ebce2209dc9ab0c2b0a
MD5 19a6eba05c857ab20527fc1993dd0b40
SHA1 f8ee0847b07302c51193b4e7b8fe94f3c963a93f
SHA512 125e0755962fb7daaa2be915b174609b550d22e0b88e82cad816208bad636a73ee255c7a8d48e10c2b464109db7a356c31891208c8d12d388cad617e9188778c
TLSH
T1B041429A0ACBC8BD2550BB805236BC41FD2FC3452A5AAD00FBC54408E4D5CABE60E5FF
MD5 SHA1 SHA512 TLSH

res.zip

SHA256 ee035b560435b60f5a20f5380182a38a010470131a71028bf03554b7d9d4be71
MD5 df8cfcd473c02d1db02fe330cb819ff7
SHA1 4812dbe845c0b27190b54b46b2e82a5a506887c1
SHA512 f9f2030d78a5f27699560cd8dce42686730ae72f667afccc3f0f46c5cc062f923f2a8e15af106162994e8d7df5bd59abe4beaeb4fd3a7c8f1f9bdb0ce3dacab4
SSDEEP 24576:xnyMJy3gRdVE5BXo+VEpIxaj9ZoIhcq+2F2NOYGOIT2ZOVIIWk5KRsxAm7nyMJyw:cMJyBRVEpXjTthce9IOVCk5KPmmMJyw
TLSH
T194553385EAD439C5DA1BD570F1A2949CCB7DA9DAF6B46003F227858E036A8F430357CE
MD5 SHA1 SHA512 SSDEEP TLSH

Password

1122

background-4399.png

SHA256 ef7f5dc56f3a0b2506fca793c897d41c1b6427d9b9861f84a8feb94148b2d0b9
MD5 723d1c24eafc4b61bf0ae66b96f0561f
SHA1 62f0aeb58b48ad882f817efe1a3255f667e8be88
SHA512 0d8e97cf43ccd6d3cf7554a07a870401e2f9aeb685d27cc4849b6d8cf978c4599e60d8d17dc1068e1b34b31cede1268180194f442e966514bb8eef89100f2bce
SSDEEP 3072:JIP2ZK+8bVfhsN1Jyw1XkvgE/hr5dK4oEEVBVN0ptwWbSruu5IQH:6uU7pC1JyWXkvr9zoBv4twWCrOQH
TLSH
T188F3122A2F696544CD0ECA75DE15E660DA949ABF5CF0CA53B306C90F574CED8200BBCE
MD5 SHA1 SHA512 SSDEEP TLSH

background-battle.jpg

SHA256 3bb0b2468ca0b6ee8478eb234abd6e28b85115da0ff032e499c86ffe0fcd5ddf
MD5 6b47485971b2dd95ae8a7240d65b8204
SHA1 0830b3c4f83614ba5d49c0346b0b3ef506c0ca77
SHA512 6e407c4a62a24052cb3e1edf1fa5415833dd47e22a11a6af026cb73a4b5ecd3169f8d488ad334eaa2387d9f9ffdb153a1cbdd842791c98c9bc320e80d749cae2
SSDEEP 24576:Bu5ptQ+b+tIRsjL/aEh6yYSpKPuKGMKTqPe9IO2k5K9oXUg2:4fb+tvjDth6wboe92k5Kzg2
TLSH
T191253384D1EC3EA2EA56E524B0E3189D4A7DB5D6F3B47002FA3B45C502B71B83079B9D
MD5 SHA1 SHA512 SSDEEP TLSH

background.png

SHA256 ef7f5dc56f3a0b2506fca793c897d41c1b6427d9b9861f84a8feb94148b2d0b9
MD5 723d1c24eafc4b61bf0ae66b96f0561f
SHA1 62f0aeb58b48ad882f817efe1a3255f667e8be88
SHA512 0d8e97cf43ccd6d3cf7554a07a870401e2f9aeb685d27cc4849b6d8cf978c4599e60d8d17dc1068e1b34b31cede1268180194f442e966514bb8eef89100f2bce
SSDEEP 3072:JIP2ZK+8bVfhsN1Jyw1XkvgE/hr5dK4oEEVBVN0ptwWbSruu5IQH:6uU7pC1JyWXkvr9zoBv4twWCrOQH
TLSH
T188F3122A2F696544CD0ECA75DE15E660DA949ABF5CF0CA53B306C90F574CED8200BBCE
MD5 SHA1 SHA512 SSDEEP TLSH

bar-bg.png

SHA256 d13328951a1bd5030e3162bb241f0282a673e26730e260dd8abdb9cafb82dc15
MD5 557595b35869304e45d537f50c7568f0
SHA1 2d460258b0719456595c968d76404604ca99996e
SHA512 f7acfdffece476a3d9f7bff8fc8009fd6309f79e7bbd58b38be0757131faea4fefc7c85400a2ee780a5794e857f9039b639911f785fccbe4768c6330fff977dc
SSDEEP 96:FY7Y20aFVqZQZU91NgCW1oZjvKyWjwgVw5oF72rISMmZx:FY7yQ6KhGZ7ujwK8oF7fpmZx
TLSH
T10C916C8AC4919800E36A967E18F32D834B258542CBCDD894771BD00B4CAA23461DE0E7
MD5 SHA1 SHA512 SSDEEP TLSH

bar.png

SHA256 85a74ce9555a90cc6ccf61f0a4106f34936ff659ec16314f1e2db80c4d983aea
MD5 5a8505a2bb5a7f73aac515fd3596cae4
SHA1 e1da7da75d887ffb837dbf335c80eda0740e0239
SHA512 023e5d7ad7c68fdfe1f2ae87122b950f7b90ff68ca5dbe7be30ef0b826a6cbf6f05890aa7b41d337760ada98b5e0ab1568a1fe8a321dc84990eb3773f9ac38a1
TLSH
T17B616FC01F2BF15F006985DF175241D6D3749F4F1710C5D78A7C6AAD73D17660858498
MD5 SHA1 SHA512 TLSH

black.png

SHA256 0f71c11669e37373e5893807e58127d2c350bb3d6049e5cb553ddb33ae8c9dc3
MD5 f896aa41257e8bad19c57c95a8e6c999
SHA1 2d048ce4dc1f011a92b3b605c155892cd2eb47c4
SHA512 1289b38f7c112073d83ee2756c6b6e36d51f55946f9276a83b992f316a97d64dd710e4fc9bcaa57896b8c73c451aadda0a77ee7c7a27cc5d697b0b1d16cc17e5
TLSH
T1ACD02BC3EE808C6CCA4F493F11274240717A09DF201134086F30D00474146409142301
MD5 SHA1 SHA512 TLSH

close.png

SHA256 a699adc474428a94ef1d29df2abcbdf97982e4141fa3f4b5df67420784833828
MD5 915b5cf3341ca7f40aa94f4d68bf35d1
SHA1 e0fea01de2d0f5c5d5780f8f1690d33ff80bfc25
SHA512 02d1347d59c6ab49e17d6984a89727b10a3455b26c588505f01da3a529f0719e0986f28da50f518df70d6c441c29132a616c086a3331cd7baa8c32ea9873b980
TLSH
T1AF1182C9ED415CA0D44DD9D128F6C833ADB6C940D6B4F522788BC6861C221F5889E5CF
MD5 SHA1 SHA512 TLSH

close_hover.png

SHA256 6a696c0a1cdc6c3b4769b2049db1de686d1afc82fdde09d2e40555014edb74ce
MD5 bb583871f6759d81aaefe62f4d4afea5
SHA1 4f3f64f0396232c2c0d9375041e3d3916e883a77
SHA512 71140d9d1371666c2548fa431dfe91394b651be5989fdb6c6049e345f623c52b6ea74d09adba0edb7b379f3078c5184cabdf617b990ac72d11d5b685a7ee5b06
TLSH
T18F213309E9A16C409249DA9314FE9037A5A20D80D5D0B5699B96CC4B0C312B744DA2DF
MD5 SHA1 SHA512 TLSH

launcher.xml

SHA256 d7d9b6a67b75aadd0105e31ce53921a18e617be2b7959c3d5a34cfd8d4e52236
MD5 43fc61ce0b00b04fc5a07cea71f1c17a
SHA1 3dff146234852b5212abde6b2b224bd58f985b36
SHA512 6c9cc6f0fb3e3a5282949b21b8c3ff6ad103e38411c226778ba4c1f7ab05c5b4b9ec9a8650d849628e01b0a2fa76c076d42578196ec1c412bd71d580d5b54cd8
TLSH
T188519B10B22C5D3DC2511046AB38DEA0898EF9F582285BC6B42E31777BE14A729FF25D
MD5 SHA1 SHA512 TLSH

launcher_4399.xml

SHA256 eb1588a8f319fe8ebbb723ecc12bced7268ff892735a80202bd72f402be28bf8
MD5 98b6f48a95b3be06d53edac1ce346d63
SHA1 85f2feb2eec5dd4c50d05b13101cf570ec8e1c5e
SHA512 ba2bf61d3a037ad3d914eb73ddf235a320c4dda51ab92aeb71dccf91dfbb8cac071e63b0bcb430a291165903b863a9b2a84ed517c3e9adb81ea0d7e4665c8352
TLSH
T1F4518A10B22C5D3DC2511046AB38DEA0898EF9F582285BC6B42E31777BE10A729FF25D
MD5 SHA1 SHA512 TLSH

launcher_battle.xml

SHA256 d995363eea5d2a6eef33b8c164ceb7a4bcff7ed87528cf6ef8f0f7a12c638e6a
MD5 cfed8b2f763cd1a1c6cf81366aea2d6b
SHA1 be40c272667f863bb92e4aca7824fb1621e8a1ef
SHA512 76d4e6019302d3c8b5a03cfa3e80703715f02cfc18ff6387df5d34505928ad94fb36f9044456e9521b32a650f9789be26d1d253aeb83c0df2b921f978a9a4a14
TLSH
T1D3519B10B73C2D3DC2611046B739CD90468EF5F686185A86F82F3073ABA14A729BF29D
MD5 SHA1 SHA512 TLSH

loading_battle.png

SHA256 66d6d9b5b2dda323a570d08d94e611a77f761d3c4ec5bee5749dd455cb574600
MD5 30a7426b01ed46b8d4d41c40029fbb1e
SHA1 804a1436491b5e9545fe608d553b7f3b089a17a3
SHA512 60e443d0779b563ba94ddb942269b55aed7cd5c64c2f91a6ce06b9f81c10b29a018347e9517cfa32ffd08917b26082bbda3781bc68924b89a2a19f773ff5c214
SSDEEP 192:qxr0K2KS66/BnrddGSXmNISoAca72ZzBDTtc/5C9KmcOak+wz7b/FrsS4/x5IQny:4kprdomBAcdZzBDRcxCgk+wr/FrsHxDy
TLSH
T1EB42C1F9BE76BF370C819E24D826F1954FD4F63C17E02EDA10497A3201C65418675ED0
MD5 SHA1 SHA512 SSDEEP TLSH

min.png

SHA256 b72d26fe721d8814a598188e4894d3596c9b89217a95915eb9ee691aef6e8c68
MD5 08c254337c9b4fb19dac41eb1d5d0f8b
SHA1 e7613dbd154774f163820e9865033d6da6e3ed52
SHA512 bfc6f7a739d786da864c4331418dfbd414e463c0c498b624220b1acc228dcc3717fa688cf9fe39d01cbde6327b5ff892c44ac7116c9685d5aca15198a6afe2c3
TLSH
T1D111444BFA511842D38DDB8224E7C13688D30D8099F4E4AAE9DBC90A6C711F2442EBDB
MD5 SHA1 SHA512 TLSH

min_c.png

SHA256 b6719455d77de4a5403b2754b58ce4170bceb69eeac36fefe59e8c39e3269488
MD5 b2c74fcc294eaa14adfb4bfab39da0f1
SHA1 c28305d74cc60a47cc48be5b3d84ab321aeb49e1
SHA512 53cf6c05e0ecc10870d0a18a45e2fae80d7b9485d31219abc93fcfffbb01c8d53a8e24a467c8477c97f761cc90802bdecaf49d27851591ec6cadb2dc51cb015d
TLSH
T15411081BF3D384F0C14D92FFD3AB8144F021414012312AF70FE88C52D35CBC50625204
MD5 SHA1 SHA512 TLSH

min_hover.png

SHA256 1106e7cb526a412c19cdaec988e6c95d6e341201a1104b6ee3a3056055d48d93
MD5 cbd8be1db147b6a89a7dfe09887d5d56
SHA1 9828714ad63d81d1cce1af39cfa245cba0bd3a1d
SHA512 04405d7c6cbe7c9f215bfb3ab0ae77883d8a6c2fcf0928f09052ee70377a41961e897f44471548ce61a5b4ad6beb2e0d5627a63934b5be8c1e3bd5f47afffbaf
TLSH
T170111007F9701C40D34CD5C618FAA027D5620C909AD0E5A677CAC41659361F6C85C9DB
MD5 SHA1 SHA512 TLSH

uninstaller.exe.nsis

SHA256 d880cb57741c47f1a555f77a621d27e05d1050580cd831d11545bb73abc8873a
MD5 67ed56c60616f8f80b9a51573dd6ae5b
SHA1 7ef8e66da342f9ffd6308ccf32a4c5c858d52182
SHA512 42582144a84af65f8a9c697ae123e270415da79cdc16181edcee1f0be5d02a418a4a07c584aa8298e8828aba4aff02e20b43e02ec51e12762ebb1fd1a4d9c74d
SSDEEP 768:WnB14MLE36GhrhmFUTlxCDFMDalpEJhH2QKNp+nqerkTsYwM:A+mG34UTlxCbrohWlNUnp0AM
TLSH
T19103024672B70272F47CF74854DDE4782BC28CCFA1FB58EAC2B5CE116BA6A25105C64D
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer