Daemon[.]Tools[.]Pro[.]Advanced[.]v5[.]3[.]0[.]0359[.]exe

resource	yara_rule
static1/unpack001/$PLUGINSDIR/Aero.dll	acprotect

resource	yara_rule
static1/unpack001/Extractor.exe	vmprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/Aero.dll	upx

resource
Daemon.Tools.Pro.Advanced.v5.3.0.0359.exe
unpack001/$PLUGINSDIR/Aero.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack001/Lang/ENU.dll
unpack001/Lang/RUS.dll
unpack001/Lang/UKR.dll
unpack001/MSIMG32.dll
unpack001/Plugins/Grabbers/GenDPM.dll
unpack001/Plugins/Grabbers/GenDisc.dll
unpack001/Plugins/Grabbers/GenSub.dll
unpack001/Plugins/Grabbers/SafeDisc.dll
unpack001/Plugins/Grabbers/Tages.dll
unpack004/$PLUGINSDIR/InstallOptions.dll
unpack004/$PLUGINSDIR/Lang/ENU.dll
unpack004/$PLUGINSDIR/System.dll
unpack001/Uninstall.exe

resource
unpack001/DTAgent.exe
unpack001/DTCommonRes.dll
unpack001/DTHelper.exe
unpack001/DTImgEditor.exe
unpack001/DTPro.exe
unpack001/DTShellHlp.exe
unpack001/DTShl32.dll
unpack001/DTShl64.dll
unpack001/Engine.dll
unpack001/Extractor.exe
unpack001/Uninstall-main.exe
unpack004/$PLUGINSDIR/SetupHelper.exe
unpack004/$PLUGINSDIR/UninstHlp.dll
unpack001/imgengine.dll

Daemon.Tools.Pro.Advanced.v5.3.0.0359.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 098d808c4303c3ce26cc69c60035a3c0178911fccda25c09101503c07cb9660a
MD5 64bdc989bbf35d2ed5b5274bbb440e36
SHA1 259780f07b39b32993d9955148d4650bf15cb868
SHA512 9a7aecf1ee1f5a20b2d65ef6de755025dd689a3ade401ee0c4fa136856627aad50b441acd9efbd9ab80b323e09cae9609bf6b7ce4a54d7f0ec03b056260920ca
SSDEEP 196608:YNGQW7TFD9xBNGYDrpIcCx9ODniMn8KxBta9yMTrA:Yb8RDpkYHiA2aZBc9Lo
TLSH
T1DA96336A98DCDBD9F2E138F5702B9D86167335759CE6E46B83C321083FB91832DA4B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/Aero.dll

SHA256 b19961de6ca07e08704d6372718542f70dbbb203e59bf9bbe3a58f6e069a625c
MD5 869c5949a10b32d3a31966cc5291301b
SHA1 329080c974d593ecdefd02afa38dd663a10331c4
SHA512 3b9dde16e9ca803b1048243dbf29c717ac0472dffa764542c234318a960828834aa650b1dfb8bba66c4e7a9ce3aaf453829afc57dfb33dc8c311d203150d4fca
SSDEEP 96:AdxrhBuDBzndge+Kwv7KzxsJBuEGQKq+5okMU+S0767ZJG:IGB+Bh78xsPLGQKqEokSS0e7ZJ
TLSH
T19EC12A4577F8113EE0AAC73295AB062B7178BC40C7FB5AED0C0E145B38312908D89B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

31664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 4c0f15fa26cdd7c557e2e3b29b3848350b12620f19c3a921cbcbae80bc121e0b
MD5 ef8b23849f3d991b4514342c9de3473e
SHA1 47fc7e99ae0d9a4a6d0afd2c2d3956d653a864a2
SHA512 a5f3b257ab8138024b7249c82df60f78d4a93107c6b5e29fc0314718bb63771abcf63f8f581f61bca9440c7280270ecb624e7c661ada6dc187d3a8833b639262
SSDEEP 192:zBEjYHgjcN3SV1taiam0WKbK9XV+G7Vze7Z:zBEju9dSN390WKbKJkGk7
TLSH
T11D12EC32E7D951F2F3D38A7879972AAB607A7D31279541EB486338242A70990FD30753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
TLSH
T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/dtsoftbus01.inf

SHA256 6f44403a6d47b391586e59f83f1b5b5c6a7c7c0f6df9c7e42bf546f3f13e88fa
MD5 7e2b24f1c6da16288cafbf58a2eb309c
SHA1 2f27aeca8401261b84546f7f6afa459155f78593
SHA512 c0e85d362fecff3bd2095432e05fdddba89f7fc96facf07edf4f34121f68e7a3b1ebd871b12490362e88eba2e4c041db8736c3617cb4b9911457668db0f5122f
TLSH
T1E1312CE3158D5372DD8EB7F186202C884397D53E73288842CC0DB102C802ED346B3B63
MD5 SHA1 SHA512 TLSH

dtpro.dat

SHA256 f1d98b00850d8019dc4fe18b077829ae0c0d66e3f46fa0b9e5769d4a2be17ced
MD5 f86a23c482566e410f29299a549dd7a1
SHA1 228e2015a99aa4767848844e1b6514a83cf2d430
SHA512 a8bf5a53fca365b50f57e17981aa71aeef6476896a270d53513baa25dc8d369bd29bf5276be61613ec877ef49eadcd21ce944d9dd5333f85151ea10d8b67a983
TLSH
T128210BCD7B43315C012654B427D673841E08BAA4B1257DE11F60C6DD23631B82E020F7
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/en.bmp

SHA256 572afbbe22ce62759bc3b1d1e40bfd6f3914994f1ebaf4c93ef9d0aca93cc6c4
MD5 ed25f74135602d4f678f47c8a90b3927
SHA1 b1745d8b3308fce970f3334f058c4c5fc1a38d30
SHA512 4b4881aaf6da1a14700dec06c4298a9fa27f6225a074c370fe3ce4a7ca7b0d360f46dda992b6d33f59948a58e88a84454a5da20783ae2164d59ee9d863d5e4f0
SSDEEP 1536:YYoX2TOQrlGUd8ZI1M649GuaEauGOQA2PkwwwpwnGj5j5XdBHSSSLo:joX2TOQrlGUd8ZI1M649GnEagikwwwpZ
TLSH
T1F93362E534F42686E2120BDB7ECF7C01A98B9905669DD30E64138F7897DEB01680D7BE
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/modern-header.bmp

SHA256 17f7b92548a2d453cc70b0181ae4e8b8f5fb5a0eee696a8c84676fc589975fe1
MD5 326b6779adb31cae2017b9f3cdd0feda
SHA1 e4d2e11d18728aa0a0c722b10338a83cf4af41d6
SHA512 766618dcbbc86edd7c7058086fd907dbd551f8905468fdf142c4314321c8d748eee7ffece4043e1b7f1364e95ac3998feae1c471b9c6cdedd835bd824dfa4db7
SSDEEP 192:66gCx0FlzAX3JoM1Nvp+bDHlOzXwj9TgQ2XsOjqqnML9sEZyxSJC:6Le0FxqoPD4nsOWqML9pygJC
TLSH
T1ADC25592C5C80684EC5D3B1831361E3E127AAFAE7ABCA14F8F5D74E67FF66874025091
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
TLSH
T1DE121A636694D5BBC2D2123736A53752CBA92338F0265C05CBB78E867D646C57E3A302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
TLSH
T1A4C1E5B656D909F3E41D00B83E31241F43FEE5260B7A03719E8B2AC61CD2AB6FD58791
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH 439074d1c01f7b16781bdf060930814a
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis7z.dll

IMPHASH 4cde51a857443fd1560ef51c43ec5e07
SHA256 37dd96230521a91dc7eba0d0a4fe8726b4405562b1a96363a01e28334bde94fd
MD5 567103638bb0c81cf9bd86f727ea12ac
SHA1 ddc03ea66412f11b5975092f92067a85d29d17b1
SHA512 1d64a197489ea45e21a89ec535ca0282eed47ade40589dee31de865870ddb91ffc0921a5eacea89ddf9bc1d9b93bb7edf6f6c3148a18a9611df87be0fc369fa4
SSDEEP 3072:676+sYX+bTOybVJJhk6BoUDReZgbUP3A4zeGh62RZ56c:6vs8+WeVJQ6CUDRe+UPAYefim
TLSH
T14C04AE2237D0C176E31B1635CD96FBA172B9B6604A62C58B3F890F294F32694DF2D706
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

95666

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateFileW SetFileTime CloseHandle SetFileAttributesW RemoveDirectoryW MoveFileW CreateDirectoryW GetLastError DeleteFileW GetFullPathNameW GetCurrentThreadId GetCurrentProcessId SetLastError FindClose FindFirstFileW GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile GetCurrentProcess GetSystemInfo GetProcAddress GetModuleHandleW GetStdHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects DeleteCriticalSection AreFileApisANSI VirtualFree VirtualAlloc WaitForSingleObject SetEvent InitializeCriticalSection ResetEvent CreateEventW SetFileApisToOEM SetFileApisToANSI GetVersionExW GlobalFree lstrcpyW lstrcpynW GlobalAlloc RaiseException VirtualQuery LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA WideCharToMultiByte MultiByteToWideChar GetTickCount HeapAlloc HeapFree HeapReAlloc ExitThread CreateThread GetCommandLineA HeapCreate HeapDestroy Sleep ExitProcess GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoA

user32

CharUpperW GetDlgItem FindWindowExW SetWindowTextW wsprintfW SendMessageW

oleaut32

VariantCopy VariantClear SysAllocString

$PLUGINSDIR/ru.bmp

SHA256 a134fdafe45a29c94295c6164c118b0166870807bfafa94db211bf61802ee432
MD5 acba4cb0fee2ea0560dce560d8bb1d00
SHA1 975c3daa1fd5941f9e0ec07f544629bd0a533a44
SHA512 92e6f736b16ee7bc139a0dacb7d321faf98809df7afcb58dae345c78cd63d65b2922aea21e636462f9f990bf3a137c1b35b4ba515cf7bf42baa0a2ff6979eb04
SSDEEP 1536:KPctujHN/VlDmHG31psO7EhV99QiheM12OkwqmjOKoIJsXCyUWWWSAU:6ctujHN/VlDmHG31psO7EhV99QiheM1t
TLSH
T1E133005878E42347A3270EDB24CF5812D6B67805272EE66E9A035F7683EFB41491C3F9
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/ua.bmp

SHA256 f28654f1b4089e01fc336d8813b4a8c07f1d85088e6fd134eb382f295bd81755
MD5 f7086ff90228a948d8409eae0adb2fb6
SHA1 cead702dd51a6295ad2e948f7d05a0debd51254e
SHA512 32ec7cbfd564308b96d8d183337d4fcc0845708411a88f6fee475b5ee8ee04881e7cd4e0d4250c014c3ca0f1e23f741b77cb3fa1ffd54f14bc99380677301e8f
SSDEEP 1536:Ged+ZMtbbbHWSALL1WW0Viw9EDGb5555Myl:GeLbbbHRAUTwyl
TLSH
T1BB33722044C7311E2E95FD9FA79ADDB55186638F80A9BCCA5E13B703A03C7128F59AF1
MD5 SHA1 SHA512 SSDEEP TLSH

DTAgent.exe

IMPHASH fd0aa2382ed235aa352452c01f44af33
SHA256 9a569a4771812d094560cb1ab07f69c3e996c9a966a883c8de1c3ff3b8193b95
MD5 d045530c3e6779cf42f1b0dd9c3559ee
SHA1 2017c2fe7a485bd4dfc24ab31a39266f7097c817
SHA512 c2397204c75230969d6881e73acfc7d45d6d2b00dfbc63fd8e6edccd1928525a07011f9344c2ab9b262f16cd5ccdafa2baffc36e2e7aae89de1f855802cf8112
SSDEEP 49152:Enlop6pjj4JzkEQKiqIV6Yyu6H+0U8IQ+jl5oNg1ENCe/Tl9F5l+9uYcv+eD+Cu1:EloCHwIEQKiq9Yyu6H+0U8IQ+jl2NXhY
TLSH
T16EE5AE61FE11A47DD563223FB41E86A449A4BC345AB7C6FB22C02F383DE42D2D53865B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ce:1f:b4:74:5a:32:26:97:ac:3c:a6:8d:b2:ed:10:8e:9f:72:bf:56

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

May 13, 2013

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Serial Number

11:21:35:64:05:60:9a:b9:5f:8d:db:13:16:4b:82:f9:6d:e5

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2012 - May 30, 2015

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

1

Major OS version

5

Entry point

1270751

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Projects\dtpro5\ui\tray\Tray\Release\DTAgent.pdb

dtcommonres

?ShowEraseDiskDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PAUIPhysicalDevice@@@Z ?ShowConvertImagesDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PA_WPAVIAttachedProgress@@@Z ?ShowBurnImageDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PA_WHPAVIAttachedProgress@@@Z ?ShowGrabDiskDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PAUIPhysicalDevice@@PAVIAttachedProgress@@@Z _AboutDialogShow@8 ?SetInvisibleWaitDialog@@YGX_N@Z ?ReleaseDTProResObjects@@YGXXZ ?EditBox@@YGHPAUHWND__@@PB_W1PA_WK2H@Z ?ShowDeviceParameters@@YGXPAUHWND__@@PAUIVirtDeviceParam@@@Z ?MessageBoxExt@DTProRes@@YGIPAUHWND__@@PB_W1111I@Z ?ProcessingInProgress@@YGHXZ ?IsEraseDialogShowed@@YGHXZ ?IsDeviceInfoShowed@@YGHXZ ?ShowDeviceInfo@@YGXPAUHWND__@@PAUIPhysicalDevice@@PAUIDeviceInfo@@@Z ?DevicesListDialog@@YGJPAUHWND__@@KVCComBSTR@ATL@@AAV23@PAUIDaemonProEngine@@@Z ?CheckSPTDInstallation@DTProRes@@YGHPAUHWND__@@PAUIDaemonProEngine@@HHPA_N@Z ?IsDeviceParametersShowed@@YGHXZ

mpr

WNetAddConnection3W

kernel32

TerminateProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation GetStringTypeW LCMapStringW GetConsoleCP HeapDestroy EnumSystemLocalesA WriteConsoleW SetEnvironmentVariableA SizeofResource LockResource InterlockedPopEntrySList VirtualFree InterlockedPushEntrySList InterlockedCompareExchange HeapCreate SetHandleCount GetConsoleMode FreeEnvironmentStringsW LoadResource FindResourceW FindResourceExW WideCharToMultiByte ResumeThread GetCurrentThreadId FreeLibrary GetProcAddress LoadLibraryW MultiByteToWideChar GetModuleHandleW SetLastError DeactivateActCtx GetLastError ActivateActCtx LeaveCriticalSection FindResourceA CloseHandle CreateThread SetCurrentDirectoryW GetCurrentDirectoryW GetVersionExW FindFirstFileW lstrlenW DisconnectNamedPipe ReadFile WriteFile GetOverlappedResult WaitForMultipleObjects SetEvent ConnectNamedPipe CreateEventW GetCurrentProcessId CreateNamedPipeW GetVersion CreateMutexW OpenEventW GetCommandLineW GetDriveTypeW GetModuleFileNameW IsValidLocale CreateDirectoryW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LoadLibraryExW GetStdHandle SetUnhandledExceptionFilter GetFileType SetStdHandle VirtualQuery VirtualAlloc HeapSize HeapQueryInformation ExitProcess HeapReAlloc ExitThread DecodePointer EncodePointer RtlUnwind GetStartupInfoW HeapSetInformation VirtualProtect SearchPathW GetProfileIntW GetNumberFormatW GetWindowsDirectoryW SetErrorMode GetFullPathNameW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer lstrcmpiW lstrcpyW GetSystemDirectoryW GlobalGetAtomNameW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle WaitForSingleObject Sleep CreateProcessW GlobalReAlloc TlsGetValue LocalAlloc GlobalFlags GetPrivateProfileIntW GetUserDefaultUILanguage ConvertDefaultLocale GetSystemDefaultUILanguage GetLocaleInfoW InterlockedExchange lstrcmpA GetFileTime GetFileSizeEx GetFileAttributesW FileTimeToLocalFileTime FileTimeToSystemTime GetFileAttributesExW InterlockedDecrement ReleaseActCtx CreateActCtxW SetThreadPriority CopyFileW GlobalSize GlobalFindAtomW GlobalDeleteAtom CompareStringW InitializeCriticalSectionAndSpinCount lstrcmpW GlobalMemoryStatus GetThreadTimes GetProcessTimes GetProcessWorkingSetSize GetStartupInfoA QueryPerformanceCounter LoadLibraryA VirtualLock VirtualUnlock GetPrivateProfileStringW WritePrivateProfileStringW GetVolumeInformationW DeleteFileW GetSystemInfo FindClose FormatMessageW GetSystemTimeAsFileTime GetUserDefaultLCID GetLocaleInfoA FreeResource GetCPInfo lstrlenA GlobalAddAtomW DeleteAtom GlobalFree GlobalUnlock GlobalLock GlobalAlloc RaiseException HeapFree FlushInstructionCache HeapAlloc GetProcessHeap LocalFree GetCurrentThread GetCurrentProcess MulDiv MoveFileExW GetTickCount GetTempFileNameW GetTempPathW CreateFileW WaitNamedPipeW GetEnvironmentStringsW

user32

ToUnicodeEx CopyAcceleratorTableW DrawFrameControl DrawStateW SetClassLongW DestroyAcceleratorTable SetParent SetWindowRgn IsZoomed GetNextDlgGroupItem NotifyWinEvent EnableScrollBar InvertRect IsRectEmpty GetMenuDefaultItem UnpackDDElParam ReuseDDElParam LoadAcceleratorsW InsertMenuItemW OffsetRect BringWindowToTop TranslateAcceleratorW PostThreadMessageW IsIconic CharUpperW UnregisterClassW SetLayeredWindowAttributes EnumDisplayMonitors CopyImage RealChildWindowFromPoint IntersectRect SetRectEmpty RegisterClipboardFormatW ShowOwnedPopups DestroyMenu GetWindowDC MapVirtualKeyW GetKeyNameTextW GetMenuStringW IsDialogMessageW SetMenuItemBitmaps GetMenuCheckMarkDimensions CheckMenuItem SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetClassLongW GetClassNameW GetForegroundWindow GetLastActivePopup BeginDeferWindowPos EndDeferWindowPos PeekMessageW MapWindowPoints ScrollWindow TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos ShowScrollBar RedrawWindow ValidateRect GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement GetMenu GetKeyState GetKeyboardLayout CreateDialogIndirectParamW GetNextDlgTabItem GetClipboardOwner GetClipboardViewer GetDesktopWindow GetInputState GetMessageTime GetOpenClipboardWindow GetProcessWindowStation GetQueueStatus GetCaretPos ExitWindowsEx GrayStringW DrawTextExW DeleteMenu RemoveMenu CreatePopupMenu CreateMenu GetMenuState InsertMenuW AppendMenuW GetMenuItemInfoW SetRect DrawEdge TabbedTextOutW RemovePropW SetPropW SendMessageW GetParent UnregisterClassA EnableWindow PostQuitMessage GetPropW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard SetFocus CheckDlgButton MessageBeep DialogBoxIndirectParamW GetDialogBaseUnits InflateRect DrawFocusRect SystemParametersInfoW CallWindowProcW DefWindowProcW IsWindowEnabled GetDlgItemTextW GetWindowThreadProcessId GetWindowTextLengthW DrawTextW SetDlgItemTextW EnableMenuItem GetSystemMenu AllowSetForegroundWindow CopyRect MonitorFromWindow GetMonitorInfoW SetWindowPos MoveWindow ShowWindow EndPaint GetSysColorBrush FrameRect BeginPaint FillRect GetKeyboardState CreateAcceleratorTableW SetCursorPos LockWindowUpdate UnionRect IsCharLowerW MapVirtualKeyExW UpdateLayeredWindow MonitorFromPoint IsMenu WaitMessage DefFrameProcW DefMDIChildProcW DrawMenuBar TranslateMDISysAccel IsClipboardFormatAvailable GetUpdateRect CopyIcon CharUpperBuffW SubtractRect GetTopWindow GetWindow GetWindowTextW GetMenuItemID GetMenuItemCount DestroyIcon GetSysColor ReleaseCapture GetCapture PtInRect GetWindowLongW MapDialogRect DrawIcon DestroyCursor GetWindowRgn SetActiveWindow GetWindowRect GetClientRect SetTimer GetActiveWindow LoadCursorW IsWindow SetCursor IsWindowVisible GetCursorPos ScreenToClient GetMessagePos ModifyMenuW CallNextHookEx WindowFromPoint LoadBitmapW LoadIconW SetWindowsHookExW SetMenuDefaultItem PostMessageW DestroyWindow KillTimer DispatchMessageW TranslateMessage GetMessageW CreateWindowExW SetWindowTextA GetDlgItem SetWindowTextW EndDialog DialogBoxParamW MessageBoxW LoadImageW GetSystemMetrics GetAsyncKeyState GetFocus GetDlgCtrlID UnhookWindowsHookEx GetSubMenu LoadMenuW SetForegroundWindow GetDoubleClickTime RegisterWindowMessageW FindWindowA ReleaseDC DrawIconEx GetIconInfo GetDC ClientToScreen UpdateWindow InvalidateRect SetCapture SetWindowLongW HideCaret

gdi32

IntersectClipRect LineTo MoveToEx SetTextAlign GetLayout SetLayout SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn CreatePatternBrush SelectPalette GetObjectType ExcludeClipRect SetRectRgn CombineRgn DPtoLP GetTextMetricsW CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetBkColor CreatePalette GetPaletteEntries GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries CreateRoundRectRgn CreatePolygonRgn GetTextColor CreateEllipticRgn Polyline Polygon SetDIBColorTable StretchBlt OffsetRgn GetRgnBox EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries SetPixelV GetTextFaceW GetClipBox SetMapMode SetROP2 SetPolyFillMode RestoreDC SaveDC CreateRectRgnIndirect CopyMetaFileW CreateBitmap SetDIBits Escape TextOutW RectVisible PtVisible CreateHatchBrush PatBlt CreateDIBSection Ellipse GetBkMode CreatePen CreateSolidBrush CreateDCW RoundRect SetBkMode SetTextColor SetBkColor ExtTextOutW CreateFontIndirectW GetDeviceCaps GetTextExtentPoint32W GetStockObject Rectangle CreateCompatibleBitmap GetBitmapBits GetObjectW CreateCompatibleDC SelectObject BitBlt DeleteDC DeleteObject SetPixel GetPixel

msimg32

TransparentBlt AlphaBlend

comdlg32

GetFileTitleW GetOpenFileNameW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegSetValueExW RegDeleteValueW RegCreateKeyExW SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor OpenProcessToken OpenThreadToken GetTokenInformation LookupPrivilegeValueW IsValidSid AdjustTokenPrivileges RegDeleteKeyW SetNamedSecurityInfoW AllocateAndInitializeSid SetEntriesInAclW ConvertSidToStringSidW RegEnumKeyExW CryptGenRandom RegEnumValueW RegQueryValueW RegEnumKeyW RegQueryValueExA RegOpenKeyExA

shell32

ord680 ShellExecuteExW ShellExecuteW ord155 SHCreateShellItem ord190 Shell_NotifyIconW SHAppBarMessage SHBrowseForFolderW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetDesktopFolder DragFinish SHGetFileInfoW DuplicateIcon SHGetFolderPathW DragQueryFileW

comctl32

_TrackMouseEvent ImageList_GetIconSize

shlwapi

PathFindFileNameW PathFileExistsW PathStripToRootW PathIsUNCW PathRemoveFileSpecW PathFindExtensionW

ole32

IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CreateStreamOnHGlobal CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject OleLockRunning OleInitialize CoFreeUnusedLibraries OleUninitialize CoCreateGuid CoInitializeEx OleDuplicateData CoTaskMemAlloc ReleaseStgMedium DoDragDrop RevokeDragDrop CoLockObjectExternal RegisterDragDrop OleGetClipboard CLSIDFromString CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysStringByteLen VariantTimeToSystemTime SystemTimeToVariantTime VariantClear VariantChangeType VariantInit SysAllocStringByteLen VarBstrFromDate SysAllocStringLen SysStringLen SysFreeString SysAllocString VarBstrCmp

oledlg

OleUIBusyW

oleacc

AccessibleObjectFromWindow CreateStdAccessibleObject LresultFromObject

gdiplus

GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipDrawImageI

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

DTCommonRes.dll

IMPHASH bcff8f3deb58df3f904c773dfa1d7ac3
SHA256 2469bcc9a0de9d1caa75bdf37929cac6a64db9ac3a6a51efa5e46120b03c6ef7
MD5 1b42b944e8ccc57678cb7ce6fb219f0a
SHA1 648d2bbecd6af8154a396edf35b672f014430c5c
SHA512 057a574b1ab6258126a2f9b6659a09553217a1cd7afb74ca0e3030f649844d927055e9f53b6edb80b8380088c3ac3cc71dc42002484ea44e2198bc1b7ab8320d
SSDEEP 98304:Yd2I1IDczLWcSgpT12c14IPwpFhHS20wMN+uFFFdaFFFd3usVeXV7Vx:YR1jn1Y1S20wq+uFFFsFFFFuso
TLSH
T19836B000FD1DC03FE56A633FB45B959689AAFD316AA3C6CB66C02D1C69E02C2DD34653
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

68:22:8d:78:9a:e2:a7:74:f3:06:61:41:a6:8f:48:f7:fc:02:63:6c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

May 13, 2013

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Serial Number

11:21:35:64:05:60:9a:b9:5f:8d:db:13:16:4b:82:f9:6d:e5

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2012 - May 30, 2015

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

1

Major OS version

5

Entry point

1390571

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\Projects\dtpro5\ui\DTProRes\Release\DTCommonRes.pdb

comctl32

ImageList_GetIconSize _TrackMouseEvent

user32

SetWindowPos MoveWindow ScreenToClient GetWindowRect CreateWindowExW ShowWindow GetDlgItem SetWindowTextW DialogBoxParamW EndPaint GetSysColorBrush FrameRect MessageBoxW EnableWindow LoadIconW GetDesktopWindow SetTimer KillTimer GetParent OpenClipboard EmptyClipboard SetClipboardData CloseClipboard InvalidateRect DestroyIcon SetDlgItemTextW LoadImageW DrawIconEx GetCaretPos MessageBeep IsWindowEnabled CheckDlgButton IsWindow DialogBoxIndirectParamW GetDlgItemTextW IsWindowVisible GetMonitorInfoW MonitorFromWindow CopyRect PostMessageW GetDC LoadMenuW ReleaseDC GetCapture GetClipboardOwner GetClipboardViewer GetInputState GetMessagePos UnregisterClassA GetWindowRgn DestroyCursor DrawIcon SubtractRect MapVirtualKeyExW IsCharLowerW GetDoubleClickTime CharUpperBuffW CopyIcon RegisterClipboardFormatW IsClipboardFormatAvailable SetMenuDefaultItem WaitMessage PostThreadMessageW CreateMenu IsMenu UpdateLayeredWindow UnionRect MonitorFromPoint TranslateMDISysAccel DrawMenuBar DefMDIChildProcW DefFrameProcW UnpackDDElParam ReuseDDElParam InsertMenuItemW TranslateAcceleratorW GetNextDlgGroupItem GetIconInfo EnableScrollBar HideCaret InvertRect GetMenuDefaultItem LockWindowUpdate BringWindowToTop SetCursorPos SetRect CreateAcceleratorTableW LoadAcceleratorsW GetKeyboardState GetKeyboardLayout ToUnicodeEx CopyAcceleratorTableW DrawFrameControl DrawEdge DrawStateW SetClassLongW NotifyWinEvent WindowFromPoint CreatePopupMenu DestroyAcceleratorTable SetParent SetWindowRgn IsZoomed OffsetRect IsRectEmpty CharUpperW IsIconic DeleteMenu IntersectRect SetLayeredWindowAttributes EnumDisplayMonitors SetRectEmpty CopyImage SetCursor SetFocus LoadCursorW UpdateWindow GetWindowTextW GetTopWindow GetWindow GetSystemMenu EnableMenuItem GetAsyncKeyState GetDlgCtrlID GetFocus CallNextHookEx SetWindowsHookExW UnhookWindowsHookEx GetKeyState GetNextDlgTabItem GetClassNameW EnumChildWindows RegisterWindowMessageW LoadBitmapW ClientToScreen DrawTextW GetWindowTextLengthW GetSystemMetrics CreateDialogParamW GetMessageW TranslateMessage DispatchMessageW GetUpdateRect DestroyWindow PostQuitMessage CallWindowProcW GetPropW ReleaseCapture InflateRect DrawFocusRect SetPropW PtInRect SetCapture RemovePropW GetCursorPos GetWindowThreadProcessId AllowSetForegroundWindow RealChildWindowFromPoint UnregisterClassW MapDialogRect ShowOwnedPopups GetWindowDC GrayStringW DrawTextExW TabbedTextOutW FillRect DestroyMenu GetMenuItemInfoW MapVirtualKeyW GetKeyNameTextW DefWindowProcW GetSysColor SystemParametersInfoW GetDialogBaseUnits ExitWindowsEx CreateDialogIndirectParamW SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW CheckMenuItem IsDialogMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetClassLongW GetForegroundWindow GetLastActivePopup SetActiveWindow BeginDeferWindowPos EndDeferWindowPos PeekMessageW MapWindowPoints ScrollWindow GetQueueStatus GetProcessWindowStation GetOpenClipboardWindow GetMessageTime TrackPopupMenu SetMenu SetScrollRange GetScrollRange BeginPaint GetClientRect SendMessageW EndDialog SetForegroundWindow GetActiveWindow EnumWindows SetWindowLongW GetWindowLongW RemoveMenu GetSubMenu GetMenuItemCount InsertMenuW GetMenuItemID AppendMenuW GetMenuStringW GetMenuState GetMenu GetWindowPlacement SetWindowPlacement SetScrollInfo GetScrollInfo DeferWindowPos EqualRect AdjustWindowRectEx RegisterClassW GetClassInfoW GetClassInfoExW ValidateRect RedrawWindow ShowScrollBar GetScrollPos SetScrollPos

kernel32

GetSystemTimeAsFileTime GetSystemInfo GetVolumeInformationW VirtualUnlock VirtualLock LoadLibraryA QueryPerformanceCounter GetStartupInfoA GetProcessWorkingSetSize GetProcessTimes GetThreadTimes GlobalMemoryStatus GlobalSize CreateActCtxW ReleaseActCtx lstrcmpW CompareStringW GlobalDeleteAtom GlobalFindAtomW FreeResource InterlockedExchange GetSystemDefaultUILanguage ConvertDefaultLocale GetUserDefaultUILanguage lstrcmpA SetThreadPriority ResumeThread GetPrivateProfileIntW VirtualProtect GetFileAttributesExW FileTimeToSystemTime FileTimeToLocalFileTime GetFileSizeEx GetFileTime LocalAlloc TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree SetErrorMode GlobalGetAtomNameW GlobalFlags GetSystemDirectoryW lstrcpyW lstrcmpiW SetFilePointer FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle GetFullPathNameW GetWindowsDirectoryW GetProfileIntW SearchPathW EncodePointer DecodePointer ExitThread GetCommandLineA RtlUnwind HeapReAlloc ExitProcess HeapSize HeapQueryInformation VirtualAlloc VirtualQuery SetStdHandle GetFileType TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP GetUserDefaultLCID HeapCreate HeapDestroy GetStdHandle GetTimeZoneInformation GetStringTypeW LCMapStringW SetHandleCount GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetConsoleCP GetConsoleMode EnumSystemLocalesA IsValidLocale WriteConsoleW SetEnvironmentVariableA FindResourceExW GetPrivateProfileStringW WritePrivateProfileStringW GetCurrentThread MulDiv FlushInstructionCache GetCurrentProcess GetModuleFileNameW WaitNamedPipeW CreateProcessW GlobalAddAtomW DeleteAtom GetNumberFormatW GetLocaleInfoW InterlockedDecrement InterlockedIncrement InitializeCriticalSectionAndSpinCount GetFileAttributesW FindClose FindNextFileW GetCurrentThreadId GetVersionExW FindFirstFileW RaiseException CreateDirectoryW DeleteFileW HeapFree GetProcessHeap HeapAlloc CreateEventA CopyFileW LocalFree FormatMessageW MoveFileExW GetTempFileNameW GetTempPathW lstrlenW GetLogicalDriveStringsW MultiByteToWideChar CreateFileW GlobalFree GlobalUnlock GlobalLock GlobalAlloc ActivateActCtx DeactivateActCtx SetLastError SetCurrentDirectoryW GetCurrentDirectoryW CreateThread LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetModuleHandleW GetProcAddress LoadLibraryW DisconnectNamedPipe WriteFile ReadFile GetOverlappedResult WaitForMultipleObjects GetLastError SetEvent ConnectNamedPipe GetCurrentProcessId CreateNamedPipeW Sleep FreeLibrary LoadLibraryExW WideCharToMultiByte FindResourceW LoadResource LockResource SizeofResource WaitForSingleObject GetTickCount CloseHandle CreateEventW ResetEvent OpenEventA InterlockedPopEntrySList VirtualFree InterlockedPushEntrySList InterlockedCompareExchange GetLocaleInfoA IsValidCodePage lstrlenA

gdi32

SetPixelV GetTextFaceW SetPaletteEntries ExtFloodFill GetBoundsRect FrameRgn FillRgn PtInRegion GetViewportOrgEx GetWindowOrgEx LPtoDP Rectangle SetPixel StretchBlt SetDIBColorTable GetRgnBox OffsetRgn GetSystemPaletteEntries RealizePalette GetNearestPaletteIndex GetPaletteEntries CreatePalette Polygon Ellipse Polyline CreateEllipticRgn GetTextColor GetBkColor CreatePolygonRgn CreateRoundRectRgn EnumFontFamiliesExW DPtoLP CombineRgn SetRectRgn GetTextCharsetInfo EnumFontFamiliesW GetTextMetricsW CreateCompatibleBitmap CreateDIBitmap CreateHatchBrush GetObjectType SelectPalette CreatePatternBrush ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape TextOutW RectVisible PtVisible GetPixel GetWindowExtEx GetViewportExtEx CreateRectRgn SelectClipRgn SetLayout GetLayout SetTextAlign MoveToEx LineTo IntersectClipRect ExcludeClipRect GetClipBox SetMapMode SetROP2 SetPolyFillMode RestoreDC SaveDC BitBlt CreateCompatibleDC PatBlt CreateRectRgnIndirect CreateBitmap CopyMetaFileW SetDIBitsToDevice SetDIBits CreateDIBSection GetBitmapBits CreatePen CreateSolidBrush DeleteDC CreateDCW RoundRect SetBkColor ExtTextOutW SetTextColor SetBkMode CreateFontIndirectW GetObjectW GetDeviceCaps DeleteObject GetStockObject GetTextExtentPoint32W SelectObject

msimg32

TransparentBlt AlphaBlend

comdlg32

GetFileTitleW GetSaveFileNameW GetOpenFileNameW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegDeleteValueW RegSetValueExW RegCloseKey RegOpenKeyExW OpenProcessToken OpenThreadToken GetTokenInformation LookupPrivilegeValueW IsValidSid AdjustTokenPrivileges RegEnumValueW RegQueryValueW RegEnumKeyW RegOpenKeyExA RegQueryValueExA CryptGenRandom ConvertSidToStringSidW RegEnumKeyExW RegDeleteKeyW RegQueryValueExW RegCreateKeyExW

shell32

SHAppBarMessage DragFinish SHGetSpecialFolderLocation SHGetDesktopFolder SHGetFileInfoW ord680 DuplicateIcon SHGetSpecialFolderPathW DragQueryFileW SHGetPathFromIDListW SHBrowseForFolderW SHGetDiskFreeSpaceExW ShellExecuteW ShellExecuteExW

shlwapi

PathStripToRootW PathFindExtensionW PathRemoveFileSpecW PathFindFileNameW PathIsUNCW

ole32

RevokeDragDrop CoLockObjectExternal RegisterDragDrop OleGetClipboard DoDragDrop CreateStreamOnHGlobal OleLockRunning IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CoInitializeEx CoUninitialize OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoCreateInstance CoTaskMemFree CoInitialize CoCreateGuid

oleaut32

SysAllocString VariantInit VariantChangeType VariantClear VarBstrCat VarBstrFromDate SystemTimeToVariantTime VariantTimeToSystemTime SysStringLen SysStringByteLen SysAllocStringByteLen SysAllocStringLen VarBstrCmp SysFreeString

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

gdiplus

GdipDrawImageRectI GdipSetInterpolationMode GdipGetImageGraphicsContext GdiplusShutdown GdipCloneImage GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePaletteSize GdipGetImagePalette GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdiplusStartup GdipBitmapUnlockBits GdipDrawImageI GdipCreateFromHDC GdipFree

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

??0?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@boost@@QAE@XZ ??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@UCRequestHandShake@DTNet@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UCRequestHandShake@DTNet@@@23@XZ@51 ??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@UCRequestSimple@DTNet@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UCRequestSimple@DTNet@@@23@XZ@51 ??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@UCResponseCommon@DTNet@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UCResponseCommon@DTNet@@@23@XZ@51 ??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@UCResponseHandShake@DTNet@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UCResponseHandShake@DTNet@@@23@XZ@51 ??_B?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseCommon@DTNet@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseCommon@DTNet@@@detail@archive@3@XZ@51 ??_B?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseHandShake@DTNet@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseHandShake@DTNet@@@detail@archive@3@XZ@51 ??_B?1??get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ@51 ??_B?1??get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@3@XZ@51 ??_B?1??get_instance@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ@51 ??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51 ??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@51 ??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@3@XZ@51 ??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@3@XZ@51 ??_B?1??get_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ@51 ?CheckSPTDInstallation@DTProRes@@YGHPAUHWND__@@PAUIDaemonProEngine@@HHPA_N@Z ?DevicesListDialog@@YGJPAUHWND__@@KVCComBSTR@ATL@@AAV23@PAUIDaemonProEngine@@@Z ?EditBox@@YGHPAUHWND__@@PB_W1PA_WK2H@Z ?GetComputerNameDialog@@YGHPAUHWND__@@PAUIDaemonProEngine@@PA_WJH@Z ?GetUserNameAndPassword@@YGHPAUHWND__@@PAUIDaemonProEngine@@PA_W2@Z ?IsDeviceInfoShowed@@YGHXZ ?IsDeviceParametersShowed@@YGHXZ ?IsEraseDialogShowed@@YGHXZ ?MessageBoxChecked@@YGIPAUHWND__@@PB_W1PAH@Z ?MessageBoxExt@DTProRes@@YGIPAUHWND__@@PB_W1111I@Z ?ProcessingInProgress@@YGHXZ ?ReleaseDTProResObjects@@YGXXZ ?SelectImageCatalogFolder@@YGHPAUHWND__@@PAUIDaemonProEngine@@PAUITreeItems@@PAPAU3@@Z ?SetInvisibleWaitDialog@@YGX_N@Z ?ShowBurnImageDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PA_WHPAVIAttachedProgress@@@Z ?ShowConvertImagesDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PA_WPAVIAttachedProgress@@@Z ?ShowDeviceInfo@@YGXPAUHWND__@@PAUIPhysicalDevice@@PAUIDeviceInfo@@@Z ?ShowDeviceParameters@@YGXPAUHWND__@@PAUIVirtDeviceParam@@@Z ?ShowEraseDiskDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PAUIPhysicalDevice@@@Z ?ShowGrabDiskDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PAUIPhysicalDevice@@PAVIAttachedProgress@@@Z ?SplashHide@@YGXXZ ?SplashSetMessageText@@YGXPA_W@Z ?SplashShow@@YGPAUHWND__@@PAUIDaemonProEngine@@@Z ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCRequestHandShake@DTNet@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UCRequestHandShake@DTNet@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCRequestSimple@DTNet@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UCRequestSimple@DTNet@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCResponseCommon@DTNet@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UCResponseCommon@DTNet@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCResponseHandShake@DTNet@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UCResponseHandShake@DTNet@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseCommon@DTNet@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseCommon@DTNet@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseHandShake@DTNet@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseHandShake@DTNet@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ ?get_instance@?$singleton@V?$extended_type_info_typeid@UCRequestHandShake@DTNet@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UCRequestHandShake@DTNet@@@23@XZ ?get_instance@?$singleton@V?$extended_type_info_typeid@UCRequestSimple@DTNet@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UCRequestSimple@DTNet@@@23@XZ ?get_instance@?$singleton@V?$extended_type_info_typeid@UCResponseCommon@DTNet@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UCResponseCommon@DTNet@@@23@XZ ?get_instance@?$singleton@V?$extended_type_info_typeid@UCResponseHandShake@DTNet@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UCResponseHandShake@DTNet@@@23@XZ ?get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseCommon@DTNet@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseCommon@DTNet@@@detail@archive@3@XZ ?get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseHandShake@DTNet@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseHandShake@DTNet@@@detail@archive@3@XZ ?get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ ?get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@3@XZ ?get_instance@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ ?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@3@XZ ?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@3@XZ ?get_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ ?instance@?$singleton@V?$extended_type_info_typeid@UCRequestHandShake@DTNet@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@UCRequestHandShake@DTNet@@@23@A ?instance@?$singleton@V?$extended_type_info_typeid@UCRequestSimple@DTNet@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@UCRequestSimple@DTNet@@@23@A ?instance@?$singleton@V?$extended_type_info_typeid@UCResponseCommon@DTNet@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@UCResponseCommon@DTNet@@@23@A ?instance@?$singleton@V?$extended_type_info_typeid@UCResponseHandShake@DTNet@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@UCResponseHandShake@DTNet@@@23@A ?instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseCommon@DTNet@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseCommon@DTNet@@@detail@archive@3@A ?instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseHandShake@DTNet@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseHandShake@DTNet@@@detail@archive@3@A ?instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@A ?instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@3@A ?instance@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@A ?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A ?instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@A ?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@3@A ?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@3@A ?instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@A ?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseCommon@DTNet@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseHandShake@DTNet@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@UCRequestHandShake@DTNet@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UCRequestHandShake@DTNet@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@UCRequestHandShake@DTNet@@@serialization@boost@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@UCRequestSimple@DTNet@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UCRequestSimple@DTNet@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@UCRequestSimple@DTNet@@@serialization@boost@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@UCResponseCommon@DTNet@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UCResponseCommon@DTNet@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@UCResponseCommon@DTNet@@@serialization@boost@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@UCResponseHandShake@DTNet@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@UCResponseHandShake@DTNet@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@UCResponseHandShake@DTNet@@@serialization@boost@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseCommon@DTNet@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseCommon@DTNet@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseCommon@DTNet@@@detail@archive@boost@@@634@A ?t@?1??get_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseHandShake@DTNet@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseHandShake@DTNet@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vbinary_iarchive@archive@boost@@UCResponseHandShake@DTNet@@@detail@archive@boost@@@634@A ?t@?1??get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@734@A ?t@?1??get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@734@A ?t@?1??get_instance@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@734@A ?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestHandShake@DTNet@@@detail@archive@boost@@@634@A ?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@UCRequestSimple@DTNet@@@detail@archive@boost@@@634@A ?t@?1??get_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@detail@34@A CheckForUpdateCommand ShowLicenseDialogCommand _AboutDialogShow@8 _CheckLicenseAsyncCommand@12 _CheckLicenseCommand@16

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

392KB

Virtual Size

392KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

35KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

224KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

DTHelper.exe

IMPHASH d275d90c0406f6c255643a2f95d3c769
SHA256 762804a6a0c0ce5971b1d3810354c635c4c1f25c996ed804c0a04278f01bc950
MD5 6ba4653f492ef9ca6d3be0e37367ff82
SHA1 9fc58fd4113c661db79cf17159b6b4b9bf2ddac5
SHA512 2c72d0fef344fcfc11c28cea75457c61d26de812eb702d1fa5d05802487c2542f209a23ecd2b58ef1fc6694e6208af764ff989c90183435c2c4ddc029def9f89
SSDEEP 6144:bxC9y2jdAhvhmJd0+1slRaehOV8SZFSOEg9WmDhonrTxVijK6basXoIagIDIj:D2jChplDQfZFSwfDhorT2jK6byFgI8j
TLSH
T17F84CF93B640C1B5ED961670A96ECE80261A3C7BCEE4A18F73D5367E1EF0763043664B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5e:2d:11:23:7d:4a:98:e4:35:a8:d5:fe:3c:32:ac:eb:4a:d2:a9:ce

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

May 13, 2013

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Serial Number

11:21:35:64:05:60:9a:b9:5f:8d:db:13:16:4b:82:f9:6d:e5

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2012 - May 30, 2015

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

1

Major OS version

5

Entry point

15632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Projects\dtpro5\ui\Helper\Release\DTHelper.pdb

kernel32

WaitForSingleObject GetSystemTimeAsFileTime WideCharToMultiByte GetVersionExW GetModuleFileNameW MultiByteToWideChar GetLastError LocalFree WriteConsoleW FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer GetStringTypeW IsProcessorFeaturePresent LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo RtlUnwind GetCurrentProcessId GetCurrentProcess FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetModuleHandleW FreeLibrary WriteFile LoadLibraryW CloseHandle DisconnectNamedPipe ReadFile CreateFileW WaitNamedPipeW GetProcAddress GetTickCount QueryPerformanceCounter HeapCreate InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle ExitProcess Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection EncodePointer DecodePointer GetCommandLineW HeapSetInformation

user32

DestroyWindow AllowSetForegroundWindow LoadIconW SendMessageW CreateWindowExW MessageBoxW

advapi32

RegDeleteKeyW GetTokenInformation OpenProcessToken RegCloseKey RegSetValueExW RegDeleteValueW RegCreateKeyExW

shell32

ShellExecuteExW ord680 ShellExecuteW SHChangeNotify

oleaut32

SysFreeString

DTImgEditor.exe

IMPHASH 499b642b05d4d44ea25fbd4a8f53274f
SHA256 339be957aa9cb223654a6cd2d7f9c48d95366d6182bfdec7a4fb17fc07502f11
MD5 fc6afc853e277ef09b00d1f6956ea322
SHA1 d343b7a8bcc4a04906a64ab467263265450318cd
SHA512 9771bc918fc104b4d47702ebdd10798571de0f4e95d7fe426ddd703ef7b933b894039fec2d4509a35454deb32cffed03c03469b6b78a35c27da9de863e76cab7
SSDEEP 196608:PYbF8xXjl/KrmbQQ6QBRjN6g8w+3S9azlaUyRl0+V4vTBuA:PYpezly6QQ6QbjN6fTJ0A
TLSH
T1EC766C30EE16D469D96312BFF91E67AD2849BD301B66CDDF51D03E6828F21D26A3C243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

df:78:87:3d:29:95:47:d2:21:46:57:e1:42:1c:5d:ce:a1:3a:2d:e0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

May 13, 2013

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Serial Number

11:21:35:64:05:60:9a:b9:5f:8d:db:13:16:4b:82:f9:6d:e5

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2012 - May 30, 2015

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

1

Major OS version

5

Entry point

1614780

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Projects\dtpro5\ui\Astroburn\Astroburn\Release\Astroburn.pdb

mpr

WNetEnumResourceW WNetUseConnectionW WNetOpenEnumW WNetCloseEnum WNetAddConnection3W

ws2_32

WSAStartup

kernel32

SetEnvironmentVariableA GetConsoleCP GetTimeZoneInformation IsProcessorFeaturePresent GetStringTypeW LCMapStringW GetThreadPriority GetPriorityClass GetModuleHandleA GetCurrencyFormatW GetUserDefaultLangID GetVersionExA WinExec IsBadReadPtr IsBadWritePtr InterlockedPopEntrySList VirtualFree InterlockedPushEntrySList InterlockedCompareExchange WriteConsoleW EnumSystemLocalesA SetPriorityClass GetConsoleMode IsValidCodePage GetOEMCP GetACP GetCPInfo PeekNamedPipe GetFileInformationByHandle IsDebuggerPresent UnhandledExceptionFilter TerminateProcess HeapDestroy HeapCreate SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle SetUnhandledExceptionFilter GetFileType SetStdHandle VirtualQuery VirtualAlloc HeapQueryInformation RtlUnwind GetDateFormatW GetTimeFormatW ExitThread HeapSize HeapReAlloc FindFirstFileExW ExitProcess DecodePointer EncodePointer GetStartupInfoW HeapSetInformation GetCommandLineW VirtualProtect SearchPathW GetNumberFormatW GetWindowsDirectoryW SetErrorMode GetFullPathNameW DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer lstrcpyW GetSystemDirectoryW GetCurrentDirectoryW GetThreadLocale TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc GlobalFlags GlobalGetAtomNameW GetFileTime GetFileSizeEx SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime GetFileAttributesExW GetProfileIntW SuspendThread ResumeThread SetThreadPriority GlobalFindAtomW CompareStringW ReleaseActCtx CreateActCtxW GetPrivateProfileIntW FreeResource lstrcmpA GlobalDeleteAtom GetUserDefaultUILanguage ConvertDefaultLocale GetSystemDefaultUILanguage CompareStringA lstrcmpW GetLocaleInfoW InterlockedExchange CopyFileW GlobalSize GlobalMemoryStatus GetThreadTimes GetProcessTimes GetProcessWorkingSetSize GetStartupInfoA QueryPerformanceCounter LoadLibraryA VirtualLock VirtualUnlock GetPrivateProfileStringW WritePrivateProfileStringW GetSystemInfo WideCharToMultiByte GetSystemTimeAsFileTime GetUserDefaultLCID FindResourceExW GetLocaleInfoA GlobalAddAtomW DeleteAtom GetCurrentProcessId GetCurrentThread HeapFree FlushInstructionCache GetCurrentProcess HeapAlloc GetProcessHeap GetTempFileNameW DisconnectNamedPipe WriteFile WaitNamedPipeW CreateProcessW Sleep lstrlenA GetExitCodeProcess MoveFileExW MoveFileW DeleteFileW IsValidLocale LocalFree FormatMessageW GetVersionExW MulDiv GetVolumeInformationW GetFileAttributesW GetLogicalDrives GetCurrentThreadId ResetEvent WaitForMultipleObjects FindCloseChangeNotification FindFirstChangeNotificationW SetEvent EnterCriticalSection CreateEventW InitializeCriticalSection WaitForSingleObject ReadFile GetFileSize GetDriveTypeW GetTempPathW GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetTickCount ActivateActCtx DeactivateActCtx SetLastError CreateThread CreateDirectoryW CloseHandle CreateFileW FindNextFileW FindClose FindFirstFileW InitializeCriticalSectionAndSpinCount InterlockedIncrement InterlockedDecrement LockResource ReleaseMutex LeaveCriticalSection CreateMutexW LoadLibraryW DeleteCriticalSection GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar GetLastError RaiseException lstrcmpiW GetModuleHandleW GetProcAddress lstrlenW FreeLibrary

user32

GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement GetMenu SetWindowContextHelpId MapDialogRect RegisterClipboardFormatW GetMenuState GetMenuStringW AppendMenuW RemoveMenu GetLastActivePopup GrayStringW DrawTextExW TabbedTextOutW GetCapture GetClipboardOwner GetClipboardViewer GetInputState GetMessagePos GetMessageTime GetOpenClipboardWindow GetProcessWindowStation GetQueueStatus GetCaretPos ExitWindowsEx IsCharAlphaNumericW RemovePropW SetPropW IsWindowEnabled GetDlgItemTextW GetWindowThreadProcessId CheckDlgButton MessageBeep DialogBoxIndirectParamW GetDialogBaseUnits InflateRect DrawFocusRect GetWindowTextLengthW DrawTextW SystemParametersInfoW SetDlgItemTextW AllowSetForegroundWindow CopyRect MonitorFromWindow GetMonitorInfoW CreateWindowExW ShowWindow DialogBoxParamW EndPaint GetSysColorBrush BeginPaint EqualRect AdjustWindowRectEx RegisterClassW GetClassInfoExW EndDialog DrawIcon ValidateRect GetScrollPos SetScrollPos GetScrollRange SetScrollRange CreateIcon GetIconInfo SetRectEmpty IsRectEmpty SetFocus SetRect InsertMenuItemW CreatePopupMenu GetPropW CallWindowProcW DrawIconEx SetMenu SetCursor InsertMenuW PtInRect PostQuitMessage DeleteMenu RegisterWindowMessageW SetWindowTextW GetWindowTextW GetWindow GetTopWindow GetSubMenu ModifyMenuW GetMenuItemID GetMenuItemCount GetForegroundWindow UnhookWindowsHookEx SetWindowsHookExW GetDlgItem GetActiveWindow CallNextHookEx GetDlgCtrlID GetWindowDC CreateIconFromResourceEx BeginDeferWindowPos DeferWindowPos EndDeferWindowPos GetClassInfoW GetKeyState TrackPopupMenu ScrollWindow MapWindowPoints PeekMessageW DestroyWindow DispatchMessageW SetActiveWindow GetClassNameW GetClassLongW WinHelpW SendDlgItemMessageA SendDlgItemMessageW GetNextDlgTabItem CreateDialogIndirectParamW IsDialogMessageW TranslateMessage GetMessageW DefWindowProcW LoadCursorW IsChild IsWindow GetSystemMenu EnableMenuItem SetParent ReleaseCapture WindowFromPoint SetCapture ClientToScreen SetWindowLongW CheckMenuItem GetMenuCheckMarkDimensions CharUpperBuffW SetMenuItemBitmaps ShowOwnedPopups GetMenuItemInfoW DestroyMenu GetKeyNameTextW MapVirtualKeyW IntersectRect TranslateAcceleratorW BringWindowToTop IsIconic LoadAcceleratorsW CharNextW MessageBoxW PostMessageW EnableWindow GetCursor LoadMenuIndirectW SystemParametersInfoA GetClipboardData CreateIconIndirect UnregisterClassA GetWindowRect ScreenToClient OffsetRect MoveWindow SendMessageW SetWindowPos GetClientRect IsWindowVisible GetAsyncKeyState InvalidateRect GetCursorPos LoadMenuW GetFocus DrawEdge FrameRect RedrawWindow FillRect LoadImageW ReleaseDC GetDC LoadIconW ReuseDDElParam UnpackDDElParam RealChildWindowFromPoint EnumDisplayMonitors GetDesktopWindow SetLayeredWindowAttributes SetTimer PostThreadMessageW KillTimer SetForegroundWindow GetParent CopyAcceleratorTableW UpdateWindow GetWindowLongW GetSystemMetrics OpenClipboard InvalidateRgn EmptyClipboard SetClipboardData CloseClipboard GetNextDlgGroupItem DestroyIcon LoadBitmapW GetSysColor ShowScrollBar UnregisterClassW CopyImage CharUpperW UnionRect GetDCEx LockWindowUpdate IsZoomed SetWindowRgn DestroyAcceleratorTable NotifyWinEvent SetClassLongW DrawStateW DrawFrameControl ToUnicodeEx GetKeyboardLayout GetKeyboardState CreateAcceleratorTableW SetCursorPos GetMenuDefaultItem InvertRect HideCaret EnableScrollBar DefFrameProcW DefMDIChildProcW DrawMenuBar TranslateMDISysAccel MonitorFromPoint UpdateLayeredWindow IsMenu CreateMenu WaitMessage SetMenuDefaultItem IsClipboardFormatAvailable GetUpdateRect CopyIcon GetWindowRgn WindowFromDC DestroyCursor SubtractRect MapVirtualKeyExW IsCharLowerW GetDoubleClickTime

gdi32

Escape SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn CreatePatternBrush CreateBitmap SelectPalette GetObjectType ExtCreatePen CreateHatchBrush CopyMetaFileW SetRectRgn CombineRgn GetMapMode GetBkColor CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetTextColor GetRgnBox StretchDIBits CreateEllipticRgn GetClipBox Ellipse Polygon CreatePalette GetPaletteEntries GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries OffsetRgn SetDIBColorTable GetDIBits StretchBlt SetPixel Rectangle EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn TextOutW GetBoundsRect ExtFloodFill SetPaletteEntries GetNearestColor GetBkMode GetStretchBltMode SetPixelV RectVisible PtVisible GetWindowExtEx SetMapMode SetStretchBltMode SetROP2 SetPolyFillMode RestoreDC SaveDC SetDIBits CreateDIBSection DeleteDC CreateDCW RoundRect SetBkMode SetTextColor SetBkColor ExtTextOutW GetTextFaceW GetTextMetricsW LineTo MoveToEx CreatePen CreateRectRgnIndirect PatBlt DPtoLP GetCurrentObject CreateRoundRectRgn CreateFontIndirectW GetObjectW DeleteObject GetDeviceCaps SetBitmapBits GetBitmapBits GetViewportExtEx CreateRectRgn SelectClipRgn SetLayout GetLayout SetTextAlign IntersectClipRect FrameRgn CreatePolygonRgn CreateFontW GetTextExtentPoint32W ExcludeClipRect GetPixel CreateSolidBrush GetStockObject SelectObject BitBlt Polyline CreateCompatibleDC CreateCompatibleBitmap GetDCOrgEx ExtCreateRegion GetTextCharset CreateEllipticRgnIndirect

msimg32

AlphaBlend TransparentBlt GradientFill

comdlg32

GetSaveFileNameW GetFileTitleW GetOpenFileNameW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumValueW RegQueryValueW RegEnumKeyW CryptGenRandom RegDeleteKeyW ConvertSidToStringSidW AdjustTokenPrivileges IsValidSid LookupPrivilegeValueW GetTokenInformation OpenThreadToken OpenProcessToken RegQueryValueExA RegOpenKeyExA RegQueryValueExW RegCreateKeyW SetSecurityDescriptorSacl GetSecurityDescriptorSacl

shell32

SHGetSpecialFolderLocation DragFinish ord75 DuplicateIcon ShellExecuteExW SHGetMalloc SHGetDesktopFolder SHGetDiskFreeSpaceExW ExtractIconExW SHGetFileInfoW DragQueryFileW SHGetPathFromIDListW SHBrowseForFolderW Shell_NotifyIconW SHGetSpecialFolderPathW ShellExecuteW SHAppBarMessage

comctl32

ImageList_Duplicate InitCommonControlsEx _TrackMouseEvent ImageList_GetIconSize

shlwapi

PathFileExistsW PathRemoveExtensionW PathFindExtensionW PathRemoveFileSpecW PathStripToRootW PathIsUNCW PathFindFileNameW

ole32

OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleLockRunning WriteClassStm OleSaveToStream CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes OleGetClipboard CoLockObjectExternal CoRegisterMessageFilter CoRevokeClassObject CoGetClassObject DoDragDrop OleFlushClipboard OleIsCurrentClipboard CoUninitialize CLSIDFromString CLSIDFromProgID OleInitialize CoFreeUnusedLibraries OleUninitialize CoCreateGuid OleDuplicateData ReleaseStgMedium CoInitializeEx OleLoadFromStream RevokeDragDrop RegisterDragDrop CoCreateInstance StringFromGUID2 CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

VariantInit VariantChangeType VariantClear VarBstrCat SysAllocStringLen VarBstrFromDate SystemTimeToVariantTime VariantTimeToSystemTime SysStringByteLen VarBstrCmp UnRegisterTypeLi LoadTypeLi RegisterTypeLi SysAllocString SysStringLen VarUI4FromStr SysFreeString SysAllocStringByteLen SafeArrayDestroy VarDateFromStr VarCyFromStr OleCreateFontIndirect VariantCopy VarR8FromStr VarMul OleCreatePictureIndirect VarDiv VarBstrFromR8 VarI4FromStr

oledlg

OleUIBusyW

dtcommonres

?ReleaseDTProResObjects@@YGXXZ _AboutDialogShow@8 ?MessageBoxExt@DTProRes@@YGIPAUHWND__@@PB_W1111I@Z

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

gdiplus

GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipDrawImageI

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

waveOutPrepareHeader waveOutReset waveOutClose waveOutRestart waveOutOpen PlaySoundW waveOutWrite waveOutPause

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

768KB

Virtual Size

767KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

95KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

306KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

DTPro.exe

IMPHASH ba69a0293a80cac60bd08efa1272e6b0
SHA256 b0c29ab056c7d378465abf0a0961e0e37405a818e0c8efcf740b5b15dbb26d53
MD5 4e6fc94bc5324aa9d4a88bd3af8f4652
SHA1 e718ed61f397db8a55a40dc695c6f68a7a25b892
SHA512 213efcbef878402faa3e5242c2b47ce5d529412dbf541287fa56c566307e3992e7a6e9f0edc4b9fceabab2f70fcb055da353981d8c74ddd01b9a6a5e45dadbb6
SSDEEP 196608:niRGq1UKYoD6PQrmC+ZQdrsWecFw897bl0KyQ+yyluhfs1ufUZ:niVyKYlPQrmhZQdrIZKyQ+yyluhfscsZ
TLSH
T1CC768C72FE41C469D9A2117FF93A96FE144ABD35DB25D2C722813E2938F01C3693A607
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

93:25:7f:1d:0e:4b:15:88:f8:d9:b0:3e:f5:cd:a1:fc:65:ff:08:50

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

May 13, 2013

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Serial Number

11:21:35:64:05:60:9a:b9:5f:8d:db:13:16:4b:82:f9:6d:e5

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2012 - May 30, 2015

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

1

Major OS version

5

Entry point

1645432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Projects\dtpro5\ui\DTProGui\Release\DTPro.pdb

dtcommonres

_AboutDialogShow@8 ?SplashSetMessageText@@YGXPA_W@Z ?MessageBoxExt@DTProRes@@YGIPAUHWND__@@PB_W1111I@Z ?SplashShow@@YGPAUHWND__@@PAUIDaemonProEngine@@@Z ?ShowBurnImageDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PA_WHPAVIAttachedProgress@@@Z ?ShowConvertImagesDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PA_WPAVIAttachedProgress@@@Z ?CheckSPTDInstallation@DTProRes@@YGHPAUHWND__@@PAUIDaemonProEngine@@HHPA_N@Z ?DevicesListDialog@@YGJPAUHWND__@@KVCComBSTR@ATL@@AAV23@PAUIDaemonProEngine@@@Z ?ProcessingInProgress@@YGHXZ ?IsEraseDialogShowed@@YGHXZ ?ShowEraseDiskDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PAUIPhysicalDevice@@@Z ?ShowDeviceInfo@@YGXPAUHWND__@@PAUIPhysicalDevice@@PAUIDeviceInfo@@@Z ?ShowDeviceParameters@@YGXPAUHWND__@@PAUIVirtDeviceParam@@@Z ?ShowGrabDiskDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PAUIPhysicalDevice@@PAVIAttachedProgress@@@Z ?ReleaseDTProResObjects@@YGXXZ ?SelectImageCatalogFolder@@YGHPAUHWND__@@PAUIDaemonProEngine@@PAUITreeItems@@PAPAU3@@Z ?SplashHide@@YGXXZ

mpr

WNetAddConnection3W

kernel32

LoadResource FindResourceW lstrlenW CreateFileW CloseHandle FindFirstFileW FindNextFileW FindClose GetModuleFileNameW MultiByteToWideChar SetLastError DeactivateActCtx GetLastError LoadLibraryW GetModuleHandleW GetProcAddress ActivateActCtx GetCurrentDirectoryW LockResource MulDiv Sleep LeaveCriticalSection RaiseException DeleteCriticalSection CreateMutexW OpenEventW SetEvent ReleaseMutex InitializeCriticalSectionAndSpinCount GetVersionExW GetCurrentThreadId CreateNamedPipeW GetCurrentProcessId CreateEventW ConnectNamedPipe WaitForMultipleObjects GetOverlappedResult ReadFile SizeofResource LoadLibraryExW SetCurrentDirectoryW TlsGetValue WriteFile DisconnectNamedPipe FreeLibrary GetProcessHeap HeapFree HeapAlloc SetEnvironmentVariableA CreateEventA WriteConsoleW EnumSystemLocalesA WaitForSingleObject EnterCriticalSection InterlockedCompareExchange InterlockedPushEntrySList VirtualFree InterlockedPopEntrySList GetVersionExA GetUserDefaultLangID GetCurrencyFormatW GetModuleHandleA WinExec IsBadReadPtr SetPriorityClass GetPriorityClass GetThreadPriority OpenEventA GetTimeZoneInformation GetConsoleMode GetConsoleCP LCMapStringW PeekNamedPipe GetFileInformationByHandle IsProcessorFeaturePresent ResetEvent CreateThread FindResourceExW CreateDirectoryW GetLocaleInfoW GetNumberFormatW GetLogicalDrives InitializeCriticalSection IsValidCodePage GetOEMCP GetACP GetCPInfo GetStringTypeW IsDebuggerPresent UnhandledExceptionFilter TerminateProcess HeapDestroy HeapCreate SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle SetUnhandledExceptionFilter GetFileType SetStdHandle HeapSize HeapQueryInformation ExitProcess HeapReAlloc VirtualQuery VirtualAlloc RtlUnwind GetDateFormatW GetTimeFormatW ExitThread FindFirstFileExW EncodePointer DecodePointer GetStartupInfoW HeapSetInformation GetCommandLineW VirtualProtect SearchPathW GetProfileIntW GetWindowsDirectoryW SetErrorMode GetFullPathNameW DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer lstrcmpiW lstrcpyW GetSystemDirectoryW GlobalFlags TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc GetTempPathW WideCharToMultiByte CreateProcessW WaitNamedPipeW GetThreadLocale GlobalGetAtomNameW GetFileTime GetFileSizeEx GetCurrentProcess GetCurrentThread LocalFree GetFileAttributesW SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime GetFileAttributesExW InterlockedIncrement LocalAlloc GetPrivateProfileIntW GetUserDefaultUILanguage ConvertDefaultLocale GetSystemDefaultUILanguage InterlockedExchange lstrcmpA SuspendThread ResumeThread SetThreadPriority InterlockedDecrement ReleaseActCtx CreateActCtxW GlobalFindAtomW GlobalDeleteAtom CompareStringW lstrcmpW FreeResource CopyFileW GlobalSize IsBadWritePtr GetFileSize GlobalMemoryStatus GetThreadTimes GetProcessTimes GetProcessWorkingSetSize GetStartupInfoA QueryPerformanceCounter LoadLibraryA VirtualLock VirtualUnlock GetPrivateProfileStringW WritePrivateProfileStringW GetVolumeInformationW DeleteFileW GetSystemInfo RemoveDirectoryW FormatMessageW GetSystemTimeAsFileTime GetUserDefaultLCID GetDriveTypeW GetLocaleInfoA lstrlenA GlobalAddAtomW DeleteAtom GlobalFree GlobalUnlock GlobalLock GlobalAlloc FlushInstructionCache MoveFileExW GetTickCount GetTempFileNameW IsValidLocale

user32

DrawStateW SetClassLongW DestroyAcceleratorTable SetWindowRgn NotifyWinEvent EnableScrollBar HideCaret InvertRect GetMenuDefaultItem LockWindowUpdate GetDCEx UnionRect CharUpperW GetNextDlgGroupItem InvalidateRgn CopyAcceleratorTableW PostThreadMessageW UnregisterClassW SetLayeredWindowAttributes EnumDisplayMonitors CopyImage RealChildWindowFromPoint IsZoomed UnpackDDElParam ReuseDDElParam LoadAcceleratorsW IsIconic InsertMenuItemW BringWindowToTop TranslateAcceleratorW ShowOwnedPopups SetWindowContextHelpId MapDialogRect RegisterClipboardFormatW IntersectRect DestroyMenu GetMenuItemInfoW GetMessageW TranslateMessage GetWindowDC GrayStringW DrawTextExW TabbedTextOutW MapVirtualKeyW GetKeyNameTextW SetMenuItemBitmaps GetMenuCheckMarkDimensions CheckMenuItem IsDialogMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW GetClassLongW GetClassNameW DrawEdge GetLastActivePopup DispatchMessageW PeekMessageW MapWindowPoints ScrollWindow TrackPopupMenu GetKeyState SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos ValidateRect GetClassInfoExW RegisterClassW AdjustWindowRectEx EqualRect GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement GetMenu SetActiveWindow CreateDialogIndirectParamW GetNextDlgTabItem GetMenuState GetMenuStringW RemoveMenu RegisterClassExW DestroyWindow IsRectEmpty SetRectEmpty SetRect GetCapture GetClipboardOwner GetClipboardViewer GetInputState GetMessagePos GetMessageTime GetOpenClipboardWindow GetProcessWindowStation GetQueueStatus GetCaretPos ExitWindowsEx IsCharAlphaNumericW DrawFrameControl ToUnicodeEx GetKeyboardLayout GetKeyboardState CreateAcceleratorTableW SetCursorPos IsCharLowerW MapVirtualKeyExW UpdateLayeredWindow MonitorFromPoint IsMenu WaitMessage DefFrameProcW DefMDIChildProcW DrawMenuBar TranslateMDISysAccel CreateMenu IsClipboardFormatAvailable GetUpdateRect CopyIcon CharUpperBuffW RemovePropW SetPropW GetPropW IsWindowEnabled GetDlgItemTextW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard CheckDlgButton DialogBoxIndirectParamW GetDialogBaseUnits GetDoubleClickTime SubtractRect DestroyCursor WindowFromDC GetWindowRgn GetForegroundWindow DrawFocusRect GetWindowTextLengthW DrawTextW SystemParametersInfoW CallWindowProcW SetDlgItemTextW EnableMenuItem LoadBitmapW GetWindowThreadProcessId MonitorFromWindow GetMonitorInfoW MoveWindow CreateWindowExW ShowWindow DialogBoxParamW GetClipboardData GetCursor LoadMenuIndirectW CreateIconIndirect SystemParametersInfoA UnregisterClassA EndPaint GetSysColorBrush BeginPaint EndDialog SetWindowTextW GetWindowTextW GetTopWindow ModifyMenuW wsprintfW CharNextW KillTimer SetCursor PtInRect DrawIcon MessageBeep InflateRect OffsetRect CopyRect LoadStringW RegisterWindowMessageW FrameRect GetWindow SetWindowLongW ShowScrollBar SetFocus WindowFromPoint SetParent GetMenuItemID DrawIconEx GetDesktopWindow GetIconInfo UnhookWindowsHookEx SetWindowsHookExW GetParent GetDlgItem GetActiveWindow CallNextHookEx GetDlgCtrlID SetForegroundWindow AllowSetForegroundWindow ReleaseCapture SetCapture GetSysColor FillRect DestroyIcon LoadIconW UpdateWindow InsertMenuW CreatePopupMenu GetMenuItemCount DeleteMenu GetSubMenu SetMenuDefaultItem LoadMenuW AppendMenuW BeginDeferWindowPos DeferWindowPos EndDeferWindowPos IsWindow GetClassInfoW DefWindowProcW GetSystemMenu GetWindowLongW GetFocus IsChild SetTimer InvalidateRect ClientToScreen GetAsyncKeyState GetCursorPos ScreenToClient UnregisterHotKey IsWindowVisible RegisterHotKey LoadImageW PostMessageW GetWindowRect ReleaseDC GetDC GetSystemMetrics GetClientRect LoadCursorW SetWindowPos RedrawWindow EnableWindow SendMessageW MessageBoxW PostQuitMessage

gdi32

ExtSelectClipRgn CreatePatternBrush SelectPalette GetObjectType ExtCreatePen CreateHatchBrush SetRectRgn CombineRgn GetMapMode GetBkColor CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo StretchDIBits GetTextColor GetRgnBox CreatePalette GetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries CreateRoundRectRgn CreatePolygonRgn CreateEllipticRgn Polyline Polygon SetDIBColorTable GetDIBits StretchBlt SetPixel Rectangle OffsetRgn EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries SetPixelV GetNearestColor GetBkMode GetStretchBltMode ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SelectObject GetTextExtentPoint32W GetObjectW DeleteObject CreateCompatibleBitmap CreateCompatibleDC BitBlt CreateSolidBrush CreateFontW CreateRectRgn CreateDIBSection GetBitmapBits SaveDC DeleteDC RestoreDC GetStockObject CreateRectRgnIndirect CreateFontIndirectW GetDeviceCaps GetTextMetricsW GetTextFaceW Ellipse PatBlt ExtTextOutW SetBkColor SetTextColor SetBkMode RoundRect CreateDCW CreatePen SetDIBits DPtoLP CopyMetaFileW CreateBitmap SetPolyFillMode SetROP2 SetStretchBltMode SetMapMode GetClipBox ExcludeClipRect IntersectClipRect LineTo MoveToEx SetTextAlign GetLayout SetLayout CreateEllipticRgnIndirect GetTextCharset ExtCreateRegion GetDCOrgEx SelectClipRgn GetViewportExtEx GetWindowExtEx GetPixel PtVisible RectVisible TextOutW Escape RealizePalette SetViewportOrgEx

msimg32

TransparentBlt AlphaBlend

comdlg32

GetSaveFileNameW GetFileTitleW GetOpenFileNameW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegCloseKey RegOpenKeyExW InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityDescriptorSacl RegCreateKeyExW RegDeleteValueW RegSetValueExW RegQueryValueExW OpenProcessToken OpenThreadToken GetTokenInformation LookupPrivilegeValueW IsValidSid AdjustTokenPrivileges ConvertSidToStringSidW RegDeleteKeyW AllocateAndInitializeSid FreeSid CheckTokenMembership RegEnumKeyExW CryptGenRandom RegQueryValueExA RegQueryInfoKeyW RegEnumValueW RegQueryValueW RegEnumKeyW RegOpenKeyExA

shell32

ord62 ShellExecuteW ord190 SHCreateShellItem ord155 ShellExecuteExW SHChangeNotify SHGetFolderPathW SHAppBarMessage SHBrowseForFolderW SHGetPathFromIDListW DragFinish ord680 DuplicateIcon SHGetFileInfoW SHGetDesktopFolder SHGetSpecialFolderLocation SHGetMalloc DragQueryFileW

comctl32

InitCommonControlsEx _TrackMouseEvent ImageList_GetIconSize ImageList_Duplicate

shlwapi

PathFindExtensionW PathStripToRootW PathIsUNCW PathRemoveFileSpecW PathFindFileNameW

ole32

OleGetClipboard CoLockObjectExternal OleSaveToStream WriteClassStm DoDragDrop OleLockRunning IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject CoUninitialize CLSIDFromProgID OleInitialize CoFreeUnusedLibraries OleUninitialize CoCreateGuid OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoGetClassObject OleLoadFromStream OleSetContainedObject CoInitializeEx CoInitialize CoTaskMemFree CLSIDFromString RevokeDragDrop RegisterDragDrop CoCreateInstance

oleaut32

OleCreatePictureIndirect VarMul VarR8FromStr VarDiv VarBstrFromR8 VarI4FromStr VariantTimeToSystemTime SafeArrayDestroy OleCreateFontIndirect VarCyFromStr VarDateFromStr SysFreeString SysAllocString SysAllocStringLen SysStringLen VarBstrCat VarBstrCmp SysAllocStringByteLen SysStringByteLen VarBstrFromDate VariantInit VariantClear VariantCopy VariantChangeType SystemTimeToVariantTime

oledlg

OleUIBusyW

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

gdiplus

GdipSetInterpolationMode GdipDrawImageI GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipFree GdipAlloc GdipDeleteGraphics GdipDisposeImage GdipCreateBitmapFromHBITMAP GdiplusStartup GdiplusShutdown GdipCreateFromHDC GdipDrawImageRectI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePaletteSize GdipGetImagePalette

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundW

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

781KB

Virtual Size

781KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

100KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

DTShellHlp.exe

IMPHASH 08de32945df34d038905478df22125b0
SHA256 98b25cb49b86bc603016eeadc3ce6846a66db090f1fb8ade57a64fea4dcbeb08
MD5 4c944fc01424e8b14f979ae6011413a2
SHA1 2beb6aafbae370f2090e29e29de96122c62e41f5
SHA512 fc330ee0d60445d7d119f8fac9d22f327073d497c322194ff895a0174c565c62aa8bce116b968ecbda08c24a5b593af3a99db239e5e8fb2d2f040554d2b163e5
SSDEEP 49152:3mybtpS48yYO+4DGE/X0QYQj6his2LL2GC2yd9mW/a4bUH9s/ne9DplXCumoiA:3moL8yYSGE/vYQjZs2LL2GC2yB/bUH95
TLSH
T19DD59E21FE32E07ED563333F790A86A55D957E342BA3C6DB61C11E382DD01D2B928297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

34:8b:e2:df:7b:f7:b4:50:92:7e:7f:2f:94:cd:b2:12:9c:91:6b:70

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

May 13, 2013

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Serial Number

11:21:35:64:05:60:9a:b9:5f:8d:db:13:16:4b:82:f9:6d:e5

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2012 - May 30, 2015

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

1

Major OS version

5

Entry point

1190381

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Projects\dtpro5\ui\shellext\ShellHelper\Release\DTShellHlp.pdb

dtcommonres

?ShowDeviceParameters@@YGXPAUHWND__@@PAUIVirtDeviceParam@@@Z ?SelectImageCatalogFolder@@YGHPAUHWND__@@PAUIDaemonProEngine@@PAUITreeItems@@PAPAU3@@Z ?ShowBurnImageDialog@@YGXPAUIDaemonProEngine@@PAUHWND__@@PA_WHPAVIAttachedProgress@@@Z ?CheckSPTDInstallation@DTProRes@@YGHPAUHWND__@@PAUIDaemonProEngine@@HHPA_N@Z ?EditBox@@YGHPAUHWND__@@PB_W1PA_WK2H@Z ?ShowDeviceInfo@@YGXPAUHWND__@@PAUIPhysicalDevice@@PAUIDeviceInfo@@@Z

kernel32

LCMapStringW GetConsoleCP GetConsoleMode GetStringTypeW GetTimeZoneInformation EnumSystemLocalesA IsValidCodePage WriteConsoleW SetEnvironmentVariableA FindResourceW LoadLibraryExW InterlockedPopEntrySList VirtualFree InterlockedPushEntrySList GetOEMCP GetACP IsValidLocale GetCPInfo WaitForSingleObject FreeLibrary Sleep SizeofResource LockResource LoadResource CreateFileW WriteFile CloseHandle IsProcessorFeaturePresent GetLastError LoadLibraryW GetProcAddress InitializeCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar InterlockedCompareExchange CreateMutexW CreateThread GetCurrentDirectoryW SetCurrentDirectoryW TerminateThread FindFirstFileW GetVersionExW lstrlenW GetCurrentThreadId CreateNamedPipeW GetCurrentProcessId CreateEventW ConnectNamedPipe SetEvent WaitForMultipleObjects GetOverlappedResult ReadFile DisconnectNamedPipe GetModuleHandleW FlushFileBuffers GetCurrentProcess GetCurrentThread LocalFree DeleteCriticalSection CreateProcessW WaitNamedPipeW GetModuleFileNameW GetTempPathW GetTempFileNameW IsDebuggerPresent UnhandledExceptionFilter TerminateProcess HeapDestroy HeapCreate SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle SetUnhandledExceptionFilter GetFileType SetStdHandle VirtualQuery VirtualAlloc ExitProcess HeapSize HeapQueryInformation HeapReAlloc RtlUnwind EncodePointer DecodePointer ExitThread GetStartupInfoW HeapSetInformation GetCommandLineW VirtualProtect SearchPathW GetProfileIntW GetNumberFormatW GetWindowsDirectoryW GetFullPathNameW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile SetFilePointer lstrcmpiW lstrcpyW GetSystemDirectoryW GetUserDefaultUILanguage GetTickCount MoveFileExW MulDiv GetLocaleInfoW InterlockedExchange ResumeThread SetThreadPriority GlobalFlags lstrcmpA GlobalGetAtomNameW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc GetFileTime GetFileSizeEx GetFileAttributesW FileTimeToLocalFileTime FileTimeToSystemTime GetFileAttributesExW FreeResource GlobalFindAtomW GlobalDeleteAtom CompareStringW InitializeCriticalSectionAndSpinCount lstrcmpW CopyFileW GlobalSize InterlockedDecrement SetLastError ActivateActCtx ReleaseActCtx DeactivateActCtx GlobalMemoryStatus GetThreadTimes GetProcessTimes GetProcessWorkingSetSize GetStartupInfoA QueryPerformanceCounter LoadLibraryA VirtualLock VirtualUnlock GetVolumeInformationW GetSystemInfo FindClose FormatMessageW WideCharToMultiByte GetSystemTimeAsFileTime GetUserDefaultLCID FindResourceExW GetLocaleInfoA lstrlenA GlobalAddAtomW DeleteAtom GlobalFree GlobalUnlock GlobalLock GlobalAlloc RaiseException HeapFree FlushInstructionCache HeapAlloc GetProcessHeap

user32

DrawMenuBar DefMDIChildProcW DefFrameProcW ReuseDDElParam InsertMenuItemW TranslateAcceleratorW GetNextDlgGroupItem EnableScrollBar HideCaret InvertRect GetMenuDefaultItem LockWindowUpdate BringWindowToTop SetCursorPos SetRect CreateAcceleratorTableW LoadAcceleratorsW GetKeyboardState GetKeyboardLayout MapVirtualKeyW ToUnicodeEx CopyAcceleratorTableW DrawFrameControl DrawEdge DrawStateW SetClassLongW NotifyWinEvent WindowFromPoint CreatePopupMenu DestroyAcceleratorTable SetParent SetWindowRgn IsZoomed IsIconic OffsetRect IsRectEmpty DeleteMenu ShowOwnedPopups IntersectRect CharUpperW SetLayeredWindowAttributes EnumDisplayMonitors SetRectEmpty CopyImage PostQuitMessage GetMessageW TranslateMessage RealChildWindowFromPoint DestroyMenu GetMenuItemInfoW GetWindowDC ClientToScreen GrayStringW DrawTextExW TabbedTextOutW FillRect CreateDialogIndirectParamW GetNextDlgTabItem SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW CheckMenuItem IsDialogMessageW RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetClassLongW GetClassNameW GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageW BeginDeferWindowPos EndDeferWindowPos TranslateMDISysAccel DestroyWindow PeekMessageW MapWindowPoints ScrollWindow TrackPopupMenu GetKeyState SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos ShowScrollBar RedrawWindow ValidateRect GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement GetMenu GetWindow LoadMenuW GetMenuState GetWindowLongW SetWindowLongW UnregisterClassA GetActiveWindow GetMenuStringW AppendMenuW GetMenuItemID InsertMenuW GetMenuItemCount GetSubMenu RemoveMenu GetCapture GetClipboardOwner GetClipboardViewer GetDesktopWindow GetInputState GetMessagePos GetMessageTime GetOpenClipboardWindow GetProcessWindowStation GetQueueStatus GetCaretPos SetCursor RemovePropW SetCapture LoadCursorW PtInRect SetPropW ReleaseCapture GetPropW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard UpdateWindow SetFocus CheckDlgButton IsWindow MonitorFromPoint UnionRect UpdateLayeredWindow IsMenu CreateMenu PostThreadMessageW WaitMessage SetMenuDefaultItem IsClipboardFormatAvailable GetUpdateRect RegisterClipboardFormatW CopyIcon CharUpperBuffW GetDoubleClickTime IsCharLowerW GetKeyNameTextW MapVirtualKeyExW SubtractRect MapDialogRect MessageBeep LoadImageW DialogBoxIndirectParamW GetDialogBaseUnits InflateRect DrawFocusRect GetWindowTextW InvalidateRect SystemParametersInfoW GetSysColor DrawIconEx DrawIcon DestroyCursor GetWindowRgn GetTopWindow SetForegroundWindow EndDialog SendMessageW GetClientRect BeginPaint FrameRect GetSysColorBrush EndPaint DialogBoxParamW SetWindowTextW GetDlgItem ShowWindow CreateWindowExW GetWindowRect ScreenToClient MoveWindow SetWindowPos GetParent IsWindowVisible GetMonitorInfoW MonitorFromWindow CopyRect PostMessageW GetDC ReleaseDC GetIconInfo MessageBoxW DestroyIcon LoadIconW EnableWindow GetAsyncKeyState GetDlgCtrlID GetFocus CallNextHookEx SetWindowsHookExW UnhookWindowsHookEx LoadBitmapW KillTimer SetTimer AllowSetForegroundWindow GetSystemMenu EnableMenuItem SetDlgItemTextW GetCursorPos DrawTextW GetWindowTextLengthW GetWindowThreadProcessId GetSystemMetrics GetDlgItemTextW IsWindowEnabled DefWindowProcW CallWindowProcW UnpackDDElParam

gdi32

GetViewportExtEx GetWindowExtEx BitBlt GetPixel PtVisible RectVisible TextOutW Escape SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn CreatePatternBrush CreateCompatibleDC SelectPalette GetObjectType CreateHatchBrush CreateDIBitmap CreateCompatibleBitmap CreateRectRgnIndirect GetTextMetricsW EnumFontFamiliesW GetTextCharsetInfo SetRectRgn CombineRgn PatBlt CreateRectRgn CreateRoundRectRgn CreatePolygonRgn GetBkColor GetTextColor CreateEllipticRgn Polyline Ellipse Polygon CreatePalette GetPaletteEntries GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries OffsetRgn GetRgnBox SetDIBColorTable StretchBlt SetPixel Rectangle EnumFontFamiliesExW LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries GetTextFaceW SetPixelV SelectClipRgn SetLayout GetLayout SetTextAlign MoveToEx LineTo IntersectClipRect ExcludeClipRect GetClipBox SetMapMode SetROP2 SetPolyFillMode RestoreDC SaveDC CreateBitmap CopyMetaFileW SetDIBits CreateDIBSection CreatePen CreateSolidBrush DeleteDC CreateDCW RoundRect SelectObject GetTextExtentPoint32W GetObjectW GetBitmapBits DeleteObject GetDeviceCaps GetStockObject CreateFontIndirectW ExtTextOutW SetBkColor SetTextColor DPtoLP SetBkMode

msimg32

TransparentBlt AlphaBlend

comdlg32

GetOpenFileNameW GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegEnumKeyExW RegCreateKeyExW RegDeleteValueW RegSetValueExW RegCloseKey RegOpenKeyExW InitializeSecurityDescriptor ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityDescriptorSacl OpenProcessToken OpenThreadToken GetTokenInformation IsValidSid ConvertSidToStringSidW RegOpenKeyExA RegQueryValueExA CryptGenRandom RegQueryValueExW RegDeleteKeyW SetSecurityDescriptorDacl

shell32

SHGetFileInfoW DragQueryFileW ShellExecuteExW ord190 SHCreateShellItem ord155 DuplicateIcon SHBrowseForFolderW SHAppBarMessage DragFinish SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetDesktopFolder ord680 ShellExecuteW

comctl32

_TrackMouseEvent ImageList_GetIconSize

shlwapi

PathFindExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW PathRemoveFileSpecW

ole32

DoDragDrop CreateStreamOnHGlobal OleLockRunning IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor RegisterDragDrop CoUninitialize OleDuplicateData CoTaskMemAlloc ReleaseStgMedium RevokeDragDrop CoLockObjectExternal CoInitializeEx CoCreateInstance CoTaskMemFree CLSIDFromString OleGetClipboard CoInitialize

oleaut32

VarBstrCmp SysAllocStringByteLen SysStringByteLen VariantClear VariantChangeType VariantInit SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime VarBstrFromDate SysStringLen SysFreeString SysAllocStringLen

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

gdiplus

GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipDrawImageI

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

DTShl.propdesc

SHA256 45a9c17f0eb77160b1b5b2db2a8e2b9b9cb2ec32ae3d372e09a4ee8e25427352
MD5 b559881713dc26f1f3eb200dc4cf1ffe
SHA1 9258b9936b3a33acb6d5b62f9ca0c2eeaa6bbe1f
SHA512 937f76aeceeb7d7f17d53db6965dd28fcbb6a768d5370c0d280aecd9365b458873403b54bc8eb4281540102d1cd8e0e966cff483d15b117642da3ef641b05527
TLSH
T11321F610AEA4984991BD01501E60D92CED2413E3C575D6C2F7ED663BBF61BCBE8A3306
MD5 SHA1 SHA512 TLSH

DTShl32.dll

IMPHASH 7f473d3c44e1bbd9003ba9f075cc2b73
SHA256 d75f9987ccb22124df3549ba2ab83ea08edc2a9f9b4cfe352335973898c86548
MD5 d6e58d1a9072aea7a5f87f68308d4fd8
SHA1 0f70a55d8566d7f46c5470979e847b6100471e39
SHA512 7c6f4360c340d60910b7851553ec8a48fc598406bf7e5a5f3107a6183122f10180d9cf9d16e90525cfc584cdac1e18dde0c808205b9f294d68337fa25be4814c
SSDEEP 12288:MJ0cnmNCy4h+a3JZmVdaL0QfZ4SwfDhorTfjK6byFg7Wq:MBn5hbJAVda3fgDUIu
TLSH
T1B9E4AE91BA0095B8DEDA0271986F8E56116A7D76876481CF72DB3B3E2EF12E31437307
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

49:db:cc:a3:4c:53:10:3b:b2:3e:3c:1e:91:2b:1a:c2:f5:53:80:c2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

May 13, 2013

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Serial Number

11:21:35:64:05:60:9a:b9:5f:8d:db:13:16:4b:82:f9:6d:e5

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2012 - May 30, 2015

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

1

Major OS version

5

Entry point

110254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\Projects\dtpro5\ui\shellext\DaemonShellImage\bin\Win32\Release\DTShl32.pdb

kernel32

GetCurrentProcess GetCurrentThread GlobalAlloc InitializeCriticalSection CreateDirectoryW WaitForSingleObject SetEvent WaitForMultipleObjects ResetEvent CreateEventW CreateThread GetNumberFormatW GetLocaleInfoW GetSystemTimeAsFileTime LocalFree WriteConsoleW SetFilePointer FlushFileBuffers SetStdHandle GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount LCMapStringW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP TlsFree TlsSetValue TlsGetValue TlsAlloc WriteFile WaitNamedPipeW CreateFileW ReadFile CreateProcessW CloseHandle Sleep DisconnectNamedPipe GetTickCount GetThreadLocale SetThreadLocale LeaveCriticalSection EnterCriticalSection LoadLibraryA FindResourceExW LockResource GlobalLock GlobalUnlock lstrcpynW lstrcpynA FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary InterlockedDecrement InterlockedIncrement LoadLibraryExW OutputDebugStringA GetModuleFileNameW SetLastError LoadLibraryW lstrcmpiW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException lstrlenW WideCharToMultiByte GetVersion GetFileAttributesW GetModuleHandleA GetVersionExW GetModuleHandleW GetProcAddress IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStdHandle ExitProcess HeapCreate IsProcessorFeaturePresent GetCommandLineA GetCurrentThreadId DecodePointer EncodePointer RtlUnwind GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy

user32

CreatePopupMenu CharNextW RegisterClipboardFormatW GetDC SetMenuItemBitmaps GetSystemMetrics InsertMenuW DestroyIcon LoadImageW SendMessageW SetMenuDefaultItem MessageBoxW AllowSetForegroundWindow GetIconInfo GetDesktopWindow GetSysColor DrawIconEx ReleaseDC

gdi32

SaveDC CreateCompatibleDC DeleteDC RestoreDC SetBitmapBits GetObjectW GetBitmapBits SelectObject DeleteObject CreateDIBSection SetDIBits

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityDescriptorSacl OpenThreadToken OpenProcessToken GetTokenInformation IsValidSid ConvertSidToStringSidW RegEnumKeyExW RegQueryInfoKeyW RegDeleteValueW RegDeleteKeyW RegSetValueExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegOpenKeyExW

shell32

ord155 SHChangeNotify SHGetSpecialFolderLocation DragQueryFileW SHGetDesktopFolder ord256 SHGetFolderPathW ord190

ole32

CoCreateGuid CoInitialize CoCreateInstance StringFromGUID2 ReleaseStgMedium CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc StringFromCLSID

oleaut32

SysAllocStringLen SysStringByteLen VarUI4FromStr SysStringLen SysFreeString SysAllocString LoadTypeLi UnRegisterTypeLi RegisterTypeLi VarBstrCmp VariantClear SysAllocStringByteLen

shlwapi

SHStrDupW PathFindNextComponentW PathRemoveBackslashW

DTShl64.dll

IMPHASH f85b2bd8264c666f0bbc7a21c18bccf4
SHA256 1d8c8212e4c8ec017665c47c8769a0890045662828bf397c5e34f5f2d7273196
MD5 4a47736753f451c875d89a75616e4955
SHA1 1ae7bbbd4de6ce2a0cbedc9cc8b3d921dfab7fc0
SHA512 ad764dbce08ac3ab990a4e70edb021fecd17553fc19dcb37d93e32248e5dd404eaf3a0e8634847345d9dc549421729bb1e1132c558f11cb893052d29c00a20f2
SSDEEP 12288:vupcL309w4jHLRqJgb4wzmdL0QfZ4SwfDhorTfjK6byFg7N:vWwSrR6gb4wzmd3fgDUIC
TLSH
T15DE47C82B6044CB4DCA6427599578A41A2B27C668B60C3CF3296777E2FB37E3143B717
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f6:a6:27:ca:47:33:de:66:e8:3e:88:ef:b0:aa:8c:74:02:ca:38:08

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

May 13, 2013

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Serial Number

11:21:35:64:05:60:9a:b9:5f:8d:db:13:16:4b:82:f9:6d:e5

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2012 - May 30, 2015

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

2

Major OS version

5

Entry point

121528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

e:\Projects\dtpro5\ui\shellext\DaemonShellImage\bin\x64\Release\DTShl64.pdb

kernel32

WideCharToMultiByte CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW SetLastError GetModuleHandleExW OutputDebugStringA lstrlenW RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection lstrcmpiW LoadLibraryExW lstrcpynA lstrcpynW EnterCriticalSection LeaveCriticalSection SetThreadLocale GetThreadLocale DisconnectNamedPipe Sleep ReadFile WaitNamedPipeW GetCurrentThread InitializeCriticalSection LocalFree WaitForMultipleObjects ResetEvent CreateEventW CreateThread GetNumberFormatW GetLocaleInfoW WriteConsoleW SetFilePointer FlushFileBuffers SetStdHandle GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount GetStringTypeW LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP FlsAlloc FlsFree FlsGetValue RtlCaptureContext RtlVirtualUnwind CreateDirectoryW GetModuleFileNameW CreateProcessW WaitForSingleObject CreateFileW GetTickCount WriteFile GetVersionExW GetModuleHandleW GetCurrentProcess GetSystemTimeAsFileTime LoadLibraryW GetProcAddress FreeLibrary GlobalAlloc GlobalLock GlobalUnlock MultiByteToWideChar CloseHandle FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetLastError SetEvent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStdHandle ExitProcess HeapCreate GetVersion HeapSetInformation GetCommandLineA FlsSetValue GetCurrentThreadId DecodePointer EncodePointer RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy

user32

SetMenuItemBitmaps ReleaseDC GetDC SetMenuDefaultItem AllowSetForegroundWindow GetIconInfo GetDesktopWindow GetSysColor DrawIconEx InsertMenuW CreatePopupMenu MessageBoxW CharNextW RegisterClipboardFormatW LoadImageW DestroyIcon GetSystemMetrics SendMessageW

gdi32

SaveDC CreateCompatibleDC DeleteDC RestoreDC SetBitmapBits GetObjectW GetBitmapBits SelectObject DeleteObject CreateDIBSection SetDIBits

advapi32

OpenThreadToken IsValidSid ConvertSidToStringSidW RegEnumKeyExW RegQueryInfoKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExW InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityDescriptorSacl OpenProcessToken GetTokenInformation RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegCloseKey

shell32

ord155 ord190 SHGetDesktopFolder DragQueryFileW SHGetFolderPathW SHGetSpecialFolderLocation SHChangeNotify ord256

ole32

CoCreateGuid StringFromCLSID CoInitialize CoCreateInstance StringFromGUID2 ReleaseStgMedium CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree

oleaut32

SysFreeString SysAllocString LoadTypeLi UnRegisterTypeLi RegisterTypeLi VarBstrCmp VariantClear SysAllocStringByteLen SysStringByteLen SysAllocStringLen SysStringLen VarUI4FromStr

shlwapi

SHStrDupW PathFindNextComponentW PathRemoveBackslashW

Name

.text

Size

175KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

.rsrc

Size

423KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Engine.dll

IMPHASH 1f7363faf18145e28f69f63ac58313d0
SHA256 a85cffe50e250106621a28d3d42e06a1e1d1e895d17e8005d7939c83abb56250
MD5 98c6150c1993b7cc3cbd2304924247a0
SHA1 e3a27cd7138932dd4c69917fe3fd049ad7694ccc
SHA512 5d47014c0922de410271176f3199c82bb5975cc005cc2ed2fba71e6df7f1511cc7e747ce7c94b4b642f298463ebe938b273bf2588958e468da05c9407ab7ac99
SSDEEP 98304:dEmOhpHiIM0pXjLmGkgz04CkQaRgQbLsM/9bhhEJmBGK:dEmOmsRLWgw4/hgK
TLSH
T103160202B39180B6D0AF5331CB65EB5DB97DB7300726DADB62940F9D3E216E16A3431B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

37:22:42:96:b1:03:63:c2:92:72:4f:45:9c:64:fa:ac:d7:a2:5e:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

May 13, 2013

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Serial Number

11:21:35:64:05:60:9a:b9:5f:8d:db:13:16:4b:82:f9:6d:e5

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2012 - May 30, 2015

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

1

Major OS version

5

Entry point

627819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\Projects\dtpro5\service\dtprohlp\Release\Engine.pdb

advapi32

TraceEvent RegDeleteKeyW RegQueryValueExW RegCloseKey RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW ConvertSidToStringSidW LookupAccountNameW SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle RegisterTraceGuidsW UnregisterTraceGuids RegQueryInfoKeyW RegEnumKeyExW OpenProcessToken GetTokenInformation SetNamedSecurityInfoW AllocateAndInitializeSid SetEntriesInAclW FreeSid CheckTokenMembership RegOpenKeyExA RegQueryValueExA RegCreateKeyA RegSetValueExA CryptGenRandom OpenServiceW DeleteService CloseServiceHandle QueryServiceStatus RegEnumKeyW OpenSCManagerW

user32

CharNextW RegisterClassExW GetClassInfoExW RegisterWindowMessageW MessageBoxW GetQueueStatus GetProcessWindowStation GetOpenClipboardWindow GetMessageTime GetMessagePos GetInputState GetFocus GetClipboardViewer GetCapture GetActiveWindow GetCursorPos GetSystemMetrics GetCaretPos IsCharAlphaNumericW PostMessageW DestroyIcon LoadImageW GetIconInfo CreateIconFromResourceEx GetDesktopWindow GetWindowDC ReleaseDC GetClipboardOwner CreateWindowExW TranslateMessage DispatchMessageW GetMessageW DefWindowProcW wsprintfW RegisterDeviceNotificationW UnregisterDeviceNotification CharUpperBuffW LoadStringW CharLowerBuffW

shell32

SHGetFileInfoW SHGetFolderPathW ord165 ShellExecuteExW ord680 ExtractIconExW ord75 SHAddToRecentDocs

setupapi

SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW CM_Get_Device_IDW SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiCreateDeviceInfoW SetupDiSetDeviceRegistryPropertyW SetupDiCallClassInstaller SetupDiClassGuidsFromNameExW SetupDiGetClassDevsExW SetupDiEnumDeviceInfo SetupDiSetClassInstallParamsW SetupDiSetSelectedDevice SetupDiDeleteDevRegKey SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiRemoveDevice CM_Locate_DevNodeW CM_Get_DevNode_Status CM_Get_Child CM_Get_Sibling SetupDiOpenDeviceInfoW CMP_WaitNoPendingInstallEvents

version

VerQueryValueW GetFileVersionInfoA GetFileVersionInfoSizeA

gdi32

GetObjectW GetBitmapBits DeleteObject GetDeviceCaps

kernel32

SetStdHandle WriteConsoleW InterlockedExchange IsValidLocale EnumSystemLocalesA SetEndOfFile FreeEnvironmentStringsW GetModuleFileNameA FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoW SetHandleCount GetTimeZoneInformation GetStringTypeW LCMapStringW GetLocaleInfoW GetStdHandle IsValidCodePage GetOEMCP GetACP ExitProcess HeapSize SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc HeapDestroy HeapCreate IsProcessorFeaturePresent TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCommandLineA GetFullPathNameW ExitThread GetCPInfo DecodePointer EncodePointer RtlUnwind GetCurrentThreadId GlobalMemoryStatus GetThreadTimes GetProcessTimes GetProcessWorkingSetSize GetStartupInfoA QueryPerformanceCounter DuplicateHandle GetFileType DosDateTimeToFileTime VirtualLock VirtualUnlock GetVolumeNameForVolumeMountPointW FindFirstVolumeW GetSystemInfo RemoveDirectoryW CompareStringW SetEnvironmentVariableA OpenEventA ResetEvent ResumeThread DeleteFileA GetFileAttributesW SetFileAttributesW CopyFileW GetExitCodeProcess GetEnvironmentStringsW SizeofResource LockResource LoadResource FindResourceW FindResourceExW CloseHandle WideCharToMultiByte WaitForSingleObject GetTickCount CreateEventW LocalFree LocalAlloc FreeLibrary GetProcAddress LoadLibraryW GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement CreateFileW lstrlenW GetFileTime MultiByteToWideChar WriteFile CreateThread InitializeCriticalSection LeaveCriticalSection EnterCriticalSection Sleep ReadFile SetFileTime GetVersionExW GetComputerNameExW GetVolumeInformationW GetSystemDirectoryW DeviceIoControl CreateFileA GetSystemDirectoryA GetSystemTimeAsFileTime SetEvent OpenEventW GetCurrentProcessId ReleaseMutex CreateMutexW FindClose FindNextFileW DeleteFileW FindFirstFileW CreateDirectoryW SetFilePointer GetModuleHandleW GetTempFileNameW GetTempPathW LoadLibraryExW LoadLibraryA GetPrivateProfileStringW VirtualFree VirtualAlloc CreatePipe SetThreadExecutionState HeapFree GetProcessHeap OpenMutexW CreateEventA HeapAlloc GetModuleFileNameW FileTimeToSystemTime SystemTimeToFileTime GetFileSize GetFileAttributesExW GetSystemTime HeapReAlloc SetThreadPriority GetCurrentThread lstrlenA DeleteVolumeMountPointW SetCurrentDirectoryW GetCurrentDirectoryW FormatMessageW SetVolumeMountPointW GetDriveTypeW WaitForMultipleObjects InterlockedCompareExchange RaiseException lstrcmpiW SetThreadLocale GetThreadLocale WritePrivateProfileStringW FindVolumeClose GetLocaleInfoA GetCurrentProcess GetUserDefaultLCID GetLogicalDrives GlobalAlloc FindNextVolumeW FindNextVolumeMountPointW FindVolumeMountPointClose GlobalFree FindFirstVolumeMountPointW

ole32

CoUninitialize CoCreateInstance CoInitialize CoCreateGuid CoTaskMemFree StringFromCLSID StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc CoInitializeEx CreateClassMoniker GetRunningObjectTable CoFileTimeNow IIDFromString

oleaut32

VariantClear SysFreeString VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SystemTimeToVariantTime VariantTimeToSystemTime SysStringLen VarBstrCmp SysAllocStringLen SysAllocString SysAllocStringByteLen SysStringByteLen

shlwapi

PathFileExistsW PathFindExtensionW PathRemoveFileSpecW PathFindFileNameW StrToIntW wnsprintfW

crypt32

CertOpenStore CertAddEncodedCertificateToStore CertFreeCertificateContext

??_B?1??get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ@51 ??_B?1??get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@3@XZ@51 ??_B?1??get_instance@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ@51 ??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51 ??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@51 ??_B?1??get_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ@51 ?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ ?get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ ?get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@3@XZ ?get_instance@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ ?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ ?instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@A ?instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@3@A ?instance@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@3@A ?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A ?instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@A ?instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@A ?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?t@?1??get_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vbinary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@734@A ?t@?1??get_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vbinary_oarchive@archive@boost@@@?A0xab0f94b0@detail@archive@boost@@@734@A ?t@?1??get_instance@?$singleton@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vnaked_binary_iarchive@archive@boost@@@?A0x0bea4b6d@detail@archive@boost@@@734@A ?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$set@PBVvoid_caster@void_cast_detail@serialization@boost@@Uvoid_caster_compare@234@V?$allocator@PBVvoid_caster@void_cast_detail@serialization@boost@@@std@@@std@@@detail@34@A A0DB34FC6FE35D429A28ADDE5467D4D7 DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer GetDTEngine _FillWaveFormatEx@16 _FillWaveHeader@16 _GetOSDisplayString@0

Name

.text

Size

837KB

Virtual Size

836KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

264KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text0

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=2, id=152, version=20115,

count=1, id=158, productName=VS2010 build 30319, version=30319,

count=28, id=110, productName=VS2005 build 50727, version=50727,

count=1, productName=Unmarked objects (old),

count=30, id=158, productName=VS2010 SP1 build 40219, version=40219,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=411, id=1, productName=Unmarked objects,

count=29, id=171, productName=VS2010 build 30319, version=30319,

count=5, id=170, productName=VS2010 build 30319, version=30319,

count=19, id=175, version=40219,

count=215, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=207, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=151,

count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,

Extractor.exe

IMPHASH 7ed4cfa5b1efa0dbadb01e5e8eb68e5e
SHA256 b72ede5edddad7e3a2971a6d994ce8773a019db443377f3a140bbe906399c46b
MD5 5652e1080eb7eac3e493ddcd72433801
SHA1 63070cf9dc3925207f52986e4282a1dbba82e372
SHA512 079ddd2766b267e9a682ac3027a1a0090481aac7e4b2a0ce6bfbaab76dab090c54bdda015baf39dc06c87b6569b5183e5dce1b021a3191a173446d3bdf6e2547
SSDEEP 49152:G2RdztdMOJisCdfTUGnHZeTq7pqK4dH/EiKyg/2ZGt9lIlwfdsUANlbbukOmGr:XztdMOJisCdfTUGnHZeTq7plgfEi4/XL
TLSH
T11B95E0607D81C074D5D6103583A9EB6A25A7AE3843352DCBAE853D6E7D3C6E32E38347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

24:66:ea:0d:a0:f5:c2:ce:2d:bb:a6:47:d9:62:75:5e:86:ad:89:2b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

May 13, 2013

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Serial Number

11:21:35:64:05:60:9a:b9:5f:8d:db:13:16:4b:82:f9:6d:e5

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2012 - May 30, 2015

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

1

Major OS version

5

Entry point

1166634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

605KB

Virtual Size

605KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

379KB

Virtual Size

379KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

634KB

Virtual Size

634KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Lang/ENU.dll

SHA256 0b0a8b02a64a63353f2ea1d04b5a113e561592552f741a409d9d8c6a20400598
MD5 96683a89712564b069ad7ebaac72308d
SHA1 10863ef7391afeebc092b61f4831171024457e59
SHA512 98257490f4f4275afc597d7808e6f3659369d1b7f77f4c335c31d61fbf48c8c5a6d2f7f583190876e45e29243ecc1ef28f0d498944fa044b06bc7f44142bef36
SSDEEP 1536:krfVGu5MCQr/rRrNfqDXlikYwjI6fvgOhaqY:aQuyfTR8DXlikYMI6fvgOha
TLSH
T18DB39491A3F94218F2F77F75AEB952604E7ABCA6AC74D65D1250504E48B2F90CCB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/RUS.dll

SHA256 32131689eba8f5e1c39885f11d6b6009721ff7275bf562118ca853e311c61903
MD5 2b0c5302d77b198013c9f0f646101101
SHA1 b60c256512edf7a845fab05be1eab592671833c5
SHA512 5a0966c119de0482ad70f4f954b07d2c51fcfd31342efd6780b60c4cad896c67f1ffd0521750cf2bad36659991f663a7132a7eeb0ef51f65d8e3e5ce056723ab
SSDEEP 768:c3c3mLvRFn45pIY/jTmZG7VV301RoDwAbNFapafFcJ2q+f:QZ0WofVx3+2tf
TLSH
T132B3754FFABCD250F968E2710F568DD320BAB710232995CA968F7D79A02C63573246C7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/UKR.dll

SHA256 d6d9a0ddf5813e41f667761b00bac35db3f4c5cdc53e9e7f1da7e6bc9e1d091b
MD5 c12816c583fe23dff1bf7dcf4f2541ed
SHA1 38295813943e8a25c62cac2f45ac25728aa5dd86
SHA512 eb08504005fc24e7d8604cc3b42442e79e7cd9db4fc1549ee648a9e37bd78762aa5bfc5a0a51b2484bc0d6cd2ce279031f9389c151c7e879a3a6108b91f17cef
SSDEEP 1536:FX2PCmZOng/6u7FZEMb/C22SI2cyizix2I:FX2PlZOng/6uxZEMb/CAH/izix2I
TLSH
T16EB37A4FBDBC9614EA98E2B10F5285D710B8F71027A992C9B28F7D35602C7397325AC7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

MSIMG32.dll

IMPHASH 5601943053a43dd1d21a9f132d91ac35
SHA256 eca0ff493e259609fb061684255dcb950b9d345043bef560842a7b93802769d7
MD5 04ad87a923caf12e9d3e7414b6f2a220
SHA1 4d9a7f9801042fd4abcf71f7a45243c63b98619a
SHA512 a50d8c41dde45a59e3ea26e3d5e2165af22512387a634d16ad7035f7bb22a05a0ed14760aec6883a530d95cfd8a25d95982e84266565463ae663a9e9b357f4a7
TLSH
T19C51120FB5D0586BEBA00F79D5539D62E55BB11CAB527026033A132ABC644FB7338781
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Plugins/Grabbers/GenDPM.dll

IMPHASH 58014063d26992ab114d6336fb8894fe
SHA256 16add705dd6bce5fc6374487c5c74ff505064bbeca702598e69f3b402a5b3f51
MD5 7cac741d506235106fcca9e87f355536
SHA1 0942072fd2cd53a2ed59bae99f91f8f4aa540ae3
SHA512 ef0f2a4a24fa36fb6b779e5832a8a323bfc578a167689e79971eb8969fae3fa16a87b47d9815f3c4b42ed0171485e98405d05cd01705690d60a0533f4692d45c
SSDEEP 3072:LI7bwKFVlQgwP5P9rKQnR8V094+pEJajkfk:07tX+v5P0Q2V094++bf
TLSH
T184E3AD21B600C472E19F26395CB487B60E7D6A3197B189C7B3981E7D4E706D18FB632B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

61566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

GenDPM.pdb

imgengine

ord5 ord7

kernel32

InitializeCriticalSectionAndSpinCount CloseHandle CreateFileW Sleep VirtualFree SetThreadPriority GetThreadPriority GetCurrentThread GetTickCount VirtualAlloc InterlockedExchange RaiseException RtlUnwind GetCurrentThreadId DecodePointer GetCommandLineA GetLastError HeapFree EncodePointer HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError InterlockedDecrement GetProcAddress IsProcessorFeaturePresent ExitProcess SetHandleCount GetStdHandle FlushFileBuffers GetFileType GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapSize WriteFile GetModuleFileNameW GetCPInfo GetACP GetOEMCP IsValidCodePage SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc LoadLibraryW LCMapStringW MultiByteToWideChar GetStringTypeW SetStdHandle WriteConsoleW

winmm

timeBeginPeriod timeEndPeriod

Plugins/Grabbers/GenDisc.dll

IMPHASH 715957a727b18856541f13832c0d5239
SHA256 ae6fdea802fbdc9ca1a852ed26258c554b6963b55342edac6d0c1d4ee4259f4a
MD5 6d75d4d7c8ec9126933932c1e7db5876
SHA1 91c73c950beaaef5160c1603b4ceeee4cc788fe3
SHA512 ad630799c5631633a0a2069411b4188cccfd7b49e653d0413176f2655268578cb4a29f4c4f30b91b3c75141718d8a6ad90693f62da9fb1d4abc82f35afdb8505
SSDEEP 96:3SJ0Tg5RuDys/vON9HhMy0x5UlbXdCO3shkqEzri+xCe:3S7Zs/vsEy0x5UlbXMO3shkqE/i+xt
TLSH
T1B4F1D8F6B3D447B3E599773D17F32303242679A97B2A859D456132886925C02CD34B1F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

GenDisc.pdb

Plugins/Grabbers/GenSub.dll

IMPHASH bf65d90c3779987a7b5ea268747e1c0d
SHA256 dc0140dba8f142e5b15570ce44da1126a1a4ad4ef1884f71f08c303b2426d069
MD5 d7a1c31816089dd1544bab9fa66d1fbe
SHA1 ad15ebd3480107dfd7a078711c9ae036ce43b992
SHA512 8d71dc3c709b6f926d51765f3f146a00311502629f238df870bf2c38b06a7659fef7851936682edde89382c680c160f8ae4edf701cbb5454cb9f4e1f1520cae3
SSDEEP 96:LcowbJbZKDieucIKAjjD8fENDZp6TdWF+:gBb5ZLerEj0fENmMF+
TLSH
T1CFB1723293B4529BF1B307331DBB929BB2157B619A32931F0E08190D5E304418E34B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

GenSub.pdb

Plugins/Grabbers/SafeDisc.dll

IMPHASH 44433e4587fb229643874219cd33ee4b
SHA256 9d30382d14b7b15cd410f27455693ed88aee44954bd8b3f1faf2ff69e3b6312a
MD5 b5669f3d0d2802a5e5675ce7e07bd593
SHA1 507676e59975687c8f71317e3b8aa91f36b03ec9
SHA512 cf75f61fa44867d8ecde2e861cf1b2c583c557f6ed960e25ddfc116f6114d01bb47b2a85125c8afa3467911e2a2aa558b65ddf78351fd508ac67e1feffb70ba5
SSDEEP 192:8WD54ZW6FAmzpdqBwqti2MhGAPUase7sMsZ+FD:8WN4ZW6Hpdqpi2wQle7sMsZcD
TLSH
T10C1219328BED01F6E05797721A7A2613B138BB396715C2CF59961A057C34AC7AC39372
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SafeDisc.pdb

Plugins/Grabbers/Tages.dll

IMPHASH e2fc813080d68ae02b9193a40f8868e5
SHA256 38a53d54c0bbddebf2af42a58734a819e0ef7f82419e0c2cad9af6d7d8513d60
MD5 84d2eee2e7468bb904976d5d33d8f269
SHA1 f13d016a96e806df0606ef28f63c3cc063125bdd
SHA512 9af438ac1e1db32a79fb1b1abe761f0ef06b44c32df0ed76ef799d919d69d4c551768365270ab6ede42810a21b2966bd95f5d429c28505b67784fe1e73d33705
SSDEEP 3072:BUIjU+82yPBOpe4r+qDEC56eoZrdTQ2rTlGRePPPX7WrASUU/LzDHIxDZSCRtr/B:CIV82USiqDMZrbtLWrASUan8Zlr/G8PF
TLSH
T1150412C0D3ED9DBCE6E7C7388A20591FFAD7E804A16DA2EDE704A80536B2581566DF10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

237237

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

imgengine

ord5 ord7

kernel32

VirtualFree DisableThreadLibraryCalls OutputDebugStringA GetTickCount VirtualAlloc TerminateProcess HeapAlloc RtlUnwind GetLastError HeapFree GetCurrentThreadId DecodePointer GetCommandLineA IsProcessorFeaturePresent GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapCreate HeapDestroy EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess Sleep SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryW RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc HeapSize LCMapStringW MultiByteToWideChar GetStringTypeW SetStdHandle WriteConsoleW CreateFileW CloseHandle FlushFileBuffers GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

advapi32

RegisterTraceGuidsA GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags TraceMessage UnregisterTraceGuids

Name

.text

Size

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tgs0

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tgs1

Size

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tgs2

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Profiles.ini

SHA256 faeefe8290e17ab09a993dabbdefa87c52282da81f17c0bb694d6a384b3afdd1
MD5 db8aa4465ffe4ce141210918fd7c4fc6
SHA1 d266fea7540a388b97c7030841ac7bd0737c3612
SHA512 e9c64a1bf374361ffc0a5dc31b2bc35a8819b83940557951e3c7d0a073911b96841a84b83afc6d73fa13857a5982798004e98fcbd790628132ebbab95e235924
SSDEEP 48:2gteJYbhNVMi0dJP0NSzb4rDAfu5Xw8QtYOl/O1fUXO92OTydbmRT7:rteJwjSiwawb4rDd5DOMaurTyhmR/
TLSH
T13F81DD28BCD170BE09EA53834EB1CEDD387DB71004A1C0292EF5870D2F41AA9D827B97
MD5 SHA1 SHA512 SSDEEP TLSH

Uninstall-main.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 7397c42eaeb15335bf807555467b4879fbb624e2337ddf3ab517489d5467b043
MD5 3eabf49672e918b56cf73390ab3da6bd
SHA1 8c5895bba1fdd34ecf1c0a4a9a1d2d698abca981
SHA512 3a805046673f686ce67388263f7f6d9be79f83cddcd76a8983ed99be748ff63efaefdcab69e2d0881ddff19b108a0b653c5613cc2c5fbf8b1aa336dc790b3c12
SSDEEP 49152:BFUCumDQCfwPH0FISRha0tdCumQ2bwccSj1:BFVuJHPoa20uT2bweJ
TLSH
T11D951840EAA9A43DF5B75F3F787A85810CA5BC257DA2F95E2E803D4818F36C0DA24753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

64:30:ec:3d:e6:9b:1f:00:3d:17:b2:57:b7:ea:4d:26:48:6c:e3:13

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

Sep 25, 2026

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Minor OS version

0

Major OS version

5

Entry point

13333

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/InstallOptions.dll

IMPHASH cd90e33ffbc335413a25300c682c83df
SHA256 fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
MD5 67d8f4d5acdb722e9cb7a99570b3ded1
SHA1 f4a729ba77332325ea4dbdeea98b579f501fd26f
SHA512 03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f
SSDEEP 192:CsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5m78ozxGUWumle:CsUHd9GN2d2iwl0impATIPdA78Ov6
TLSH
T15862192077C650B3EF6226722AFF77179BA5B11414D29C0B4E732D472D39641EF392A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW GetModuleHandleW GlobalLock GlobalUnlock GetCurrentDirectoryW SetCurrentDirectoryW GetPrivateProfileIntW GetPrivateProfileStringW lstrcatW WritePrivateProfileStringW lstrcpynW lstrlenW lstrcpyW GlobalFree GlobalAlloc

user32

OpenClipboard DestroyIcon LoadCursorW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW ShowWindow SetWindowLongW GetClientRect SetWindowRgn LoadIconW LoadImageW CreateWindowExW MapDialogRect GetClipboardData GetWindowRect CreateDialogParamW EnableMenuItem GetSystemMenu EnableWindow GetDlgItem SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW wsprintfW CharNextW MessageBoxW CloseClipboard GetDlgCtrlID MapWindowPoints SetWindowPos PtInRect GetWindowTextW SetWindowTextW SendMessageW DestroyWindow

gdi32

SelectObject CreateRectRgn GetObjectW CombineRgn DeleteObject CreateCompatibleDC GetDIBits SetTextColor

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW CommDlgExtendedError GetSaveFileNameW

ole32

CoTaskMemFree

$PLUGINSDIR/Lang/ENU.dll

SHA256 0b0a8b02a64a63353f2ea1d04b5a113e561592552f741a409d9d8c6a20400598
MD5 96683a89712564b069ad7ebaac72308d
SHA1 10863ef7391afeebc092b61f4831171024457e59
SHA512 98257490f4f4275afc597d7808e6f3659369d1b7f77f4c335c31d61fbf48c8c5a6d2f7f583190876e45e29243ecc1ef28f0d498944fa044b06bc7f44142bef36
SSDEEP 1536:krfVGu5MCQr/rRrNfqDXlikYwjI6fvgOhaqY:aQuyfTR8DXlikYMI6fvgOha
TLSH
T18DB39491A3F94218F2F77F75AEB952604E7ABCA6AC74D65D1250504E48B2F90CCB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/SetupHelper.exe

IMPHASH 7307d85b28266b9b52f878b46ad74705
SHA256 87e6fe68014cc027bbba84b5504bdb15a70a8d849af6748634fb6f3f7a2bfcc7
MD5 1323d01fc1b3ec2ac91365a37dc0be0c
SHA1 ecdb11c3591a2d07a583f777b8cc125f5f9cc78d
SHA512 643ae5a99eee51e3b9f6bf95969735e576d1ec17dcc6d8c915324c6d4f477ff0ffdbb64a9ef3ba1449ad11ee6159512219117a73847781253759d66b6f4a0306
SSDEEP 768:RvBQKNMzCew5Q9hIqiqhWkkBEDTFn+Z01xYKYq/rAzbCm0L:NmKqzCwt3Ukzf1xqq/OCm0
TLSH
T126135C0236B0D076F8638F7048F8D6A2A97BB9529EB0918F2798056D6F713D05FB8357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b8:5e:74:8d:72:98:8c:e9:7a:75:5f:3b:70:fe:1b:d4:e5:db:5d:af

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=DT Soft Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=DT Soft Ltd,L=Belize City,ST=Belize,C=BZ

Chains

Jan 17, 2012

CN=DT Soft Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=DT Soft Ltd,L=Belize City,ST=Belize,C=BZ

Subject

CN=DT Soft Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=DT Soft Ltd,L=Belize City,ST=Belize,C=BZ

Serial Number

10:9f:1d:aa:af:b8:33:15:a6:b6:4a:6e:ed:82:d8:16

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 4, 2009 - Nov 3, 2012

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Minor OS version

1

Major OS version

5

Entry point

4712

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Projects\DTPro\setup\plugin\HelperProcess\Release\SetupHelper.pdb

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
TLSH
T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10085

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UninstHlp.dll

IMPHASH 27406a8f531f48c5cb92888d807be4cb
SHA256 d30dcb1e1ae4de957950cc91572682d2de3bfbef10b490ed1c8b8ee8e44089e6
MD5 2315aa91257e288976bbb498a2c1bdc6
SHA1 327cc98d838233f0140c48497743eb4fd67a209b
SHA512 92615e27c33a2a75ecf109dc2e5c58ab91ea6099863cf0f2c5cc36d4f455a5506a7ef85ce22129aae01d2eb17930ef883e66813987205ed66a6097dcb2327ce0
SSDEEP 24576:fCfUA4PH0tvJ+6NRhpnQ0tdC7ymQ2mWnwcc5:fCfwPH0FISRha0tdCumQ2bwcc5
TLSH
T1E0551890FD26F87CE1564E7F785A89800C84BC257E93FEAB6EC13E5418F32D4A614687
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1d:b4:4b:d7:a6:72:0a:dd:f0:2c:76:93:f4:b2:43:31:d5:ec:3e:bd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

May 13, 2013

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Serial Number

11:21:35:64:05:60:9a:b9:5f:8d:db:13:16:4b:82:f9:6d:e5

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2012 - May 30, 2015

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

1

Major OS version

5

Entry point

87004

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\Projects\dtpro5\setup\plugin\SetupHlp\ReleaseUninstaller\UninstHlp.pdb

comctl32

ImageList_Destroy ImageList_ReplaceIcon ImageList_Create

ole32

CoCreateInstance

user32

IsWindow GetClientRect GetSystemMetrics GetWindowRect ScreenToClient SetWindowPos CreateWindowExW SetFocus GetDC ReleaseDC LoadStringW wsprintfW FindWindowExW RegisterWindowMessageW EnumWindows PostMessageW GetParent SendMessageTimeoutW DialogBoxParamW GetWindowLongW SetWindowLongW GetDlgItem SetWindowTextW SetTimer EndDialog SendMessageW GetShellWindow GetWindowThreadProcessId UnregisterClassA MessageBoxW

advapi32

RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueA RegCreateKeyA SetEntriesInAclW SetNamedSecurityInfoW RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken GetTokenInformation ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityDescriptorSacl RegSetValueExA AllocateAndInitializeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCreateKeyExA RegDeleteKeyA FreeSid UnregisterTraceGuids RegisterTraceGuidsW GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags TraceEvent SaferCreateLevel SaferComputeTokenFromLevel SaferCloseLevel SetTokenInformation CreateProcessAsUserW OpenProcessToken DuplicateTokenEx GetSidLengthRequired InitializeSid GetSidSubAuthority IsValidSid CopySid GetLengthSid RegOpenKeyExA RegQueryValueExA RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW SHGetFileInfoW SHChangeNotify ShellExecuteExW SHGetFolderPathW SHGetDesktopFolder

kernel32

QueryPerformanceCounter GetTickCount LoadLibraryA DecodePointer GetPrivateProfileStringW WritePrivateProfileStringW WideCharToMultiByte ExitThread CreateThread GetCommandLineA HeapAlloc IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsSetValue TlsFree HeapCreate HeapDestroy SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection ExitProcess GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetStringTypeW HeapReAlloc WriteConsoleW SetStdHandle EnumSystemLocalesA InterlockedCompareExchange InitializeCriticalSection GetProcessHeap DeleteAtom GlobalAddAtomW RtlUnwind HeapFree TlsAlloc EncodePointer GetSystemTimeAsFileTime GetUserDefaultLCID GetLocaleInfoA SetLastError SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetLastError CreateDirectoryW GetFileAttributesW InterlockedIncrement InterlockedDecrement CloseHandle GetProcAddress GetModuleHandleW OpenProcess SetEnvironmentVariableW LocalFree LocalAlloc FreeLibrary LoadLibraryW DeleteFileW InterlockedExchange TerminateProcess WaitForSingleObject Module32NextW Module32FirstW CreateToolhelp32Snapshot GetWindowsDirectoryW Sleep Process32NextW Process32FirstW SetCurrentDirectoryW GetCurrentDirectoryW VirtualFree VirtualAlloc CreateMutexA CreateEventA lstrcatA lstrcpyA GetCurrentProcessId CreateProcessW CreateEventW SetEvent GetModuleFileNameW GetLocaleInfoW FindClose FindNextFileW IsValidLocale FindFirstFileW ReadFile CreateFileW GetVersionExW DisconnectNamedPipe WaitNamedPipeW WriteFile GetCurrentProcess GetCurrentThread WaitForMultipleObjects RaiseException EnterCriticalSection LeaveCriticalSection GetCurrentThreadId

psapi

GetModuleBaseNameW EnumProcesses EnumProcessModules

oleaut32

SysFreeString SysAllocString VariantClear

shlwapi

PathFindFileNameW PathFileExistsW

Name

.text

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text0

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

956KB

Virtual Size

955KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/ioSpecial.ini

SHA256 689a67b30946cbe12dce92d17207ec0488e850a806be608e6fb174f853f86b57
MD5 6f98fcda445825382121e480a64ae24c
SHA1 d5071f4928fc8c38fc8d015501bfc1f4229b1799
SHA512 68cb5b4ec06e4955ea8b5208f5f8569a37120c185dc9a10966c89ab5fd2bb0c6038d901d7b0fd15b1db8409a2b1ede18451f3d09cb17156a14fe4940095a7d0d
TLSH
T113E09A5739E99424F49AE51CFFF4857A9728744A185EC90EC5E24A0F88E83814127BEF
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/modern-header.bmp

SHA256 238c6b3641a4c7ced1ddda2a6e0affa675ce54e877a03c8542bc805835b606a3
MD5 7e1746d6e14cbcaf3bca0a995abcf905
SHA1 a7687ab370fd43af349e5f12a628ca9315a94dc8
SHA512 4ad4e822c562198c3637477a9b13042867d71f3fb44a945fa6d6506eecfb0892ecf690faa64bc162ea4e725327a318e84c40de68572bdd01f4c5386cf72defd1
SSDEEP 384:68tB5ePbsWXvfHRp+/aHHjYhWvjVFXIWGshpXKCa8d2RWQN/IC6gxvAbeUmjGvq0:RX5issvfxpjJvjVqWFpXKCKDNv9He
TLSH
T1E8F26C462040E5FDA8EDF251C0636F9AC38294175A746BCCEF6EA9507CDAF57E032B12
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 4142acffa512b566532bf8a6ea7a989b76e368c205fc8faa237cc0d25d9ff548
MD5 d85db276fd3aa64c7b6e5d964b36d005
SHA1 00d89da234bb67b31909962837b0c2f75e229188
SHA512 f246c6b89963c3a5447ac8edb4e51e4cbb54cf6fd3226444c338e581a598ea1bfbadd95d26c1c75233436576dc20f222ff560df11768b7d338d9e379302622c2
SSDEEP 6144:moooHooooooooooooooooooooooolTn/nnDnzuHXyl5lG0GgDxxlQrkFDGvCdhX:WTn/nnDnSHXylAQlQmrX
TLSH
T17E141B514ABE802FFB7FE362DDBD7A4BCC79B1233548549C5B2028DA4D0A246CD3A572
MD5 SHA1 SHA512 SSDEEP TLSH

Uninstall.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 2d1fa50df2a210b62024cc85695b81bfc7750e89270aae1a1a626b93037818f3
MD5 a2feff7836c63b55db52c28379259324
SHA1 78a55d70844b86a6cb7186c873b444629b44b154
SHA512 108cf54aeb713e0f4339001425ba2e2983e13525460632b71981a831ae53d421ad27d2e79eb759d274d220adaaef8cab37c243d26a13464e06e28dd8e3e3936c
SSDEEP 1536:nVdePelp2Xy+tuQOzOYE5aXPn6JeGGGGGGGj9gesF8g:wweqOYEUXPn6gGGGGGGGpLQ
TLSH
T169735B8267D8C07BE5F20BB128716B525B7AFD250875C54F9740AE8F3D72A82C82CB57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

imgengine.dll

IMPHASH 519ec37e07cf8191871cc19d8b0fd881
SHA256 79d0f74314d18a06e3ded075a7af2351d9662e27ad16a7717bc15b48aeb2b25b
MD5 f3b302c554fca6c3be17164a159be29e
SHA1 5a17a51c2fda6599447793e865f7900e5ad03af2
SHA512 bd7b11f31bf3872b7e5850eb87e69a30041e89fa74d5fc0e72bc0c5875dedcc5313fbfa274d1313486dc7b861109d29988aedb3982bd2b007aa4b3baef94ab4a
SSDEEP 6144:2B3OSBwejjfIsJEmeElSIfNlKbIZBeI4vMJY4LOnSnzjZTfBGWvl/:pcrosbnlSIfNlK8z9u2ukpDBG2l/
TLSH
T1B58423516E630A98CC53EB7C8A52FC2DBCF17E612551459A8376C7A314E3EA23738273
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2c:74:25:23:25:1a:fe:8b:af:03:82:1d:f4:90:22:62:05:37:4e:41

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Chains

Oct 21, 2012

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Serial Number

11:21:35:64:05:60:9a:b9:5f:8d:db:13:16:4b:82:f9:6d:e5

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2012 - May 30, 2015

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Minor OS version

1

Major OS version

5

Entry point

890556

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WriteFile CloseHandle VirtualAlloc VirtualFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject GetFileSize CreateFileW GetDiskFreeSpaceW InitializeCriticalSection GetTickCount CreateEventW GetCurrentThreadId DecodePointer GetCommandLineA HeapFree HeapAlloc RtlUnwind GetFullPathNameW RaiseException EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError InterlockedDecrement GetCurrentThread GetProcAddress Sleep ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate InterlockedCompareExchange QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleFileNameW GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc FreeLibrary LoadLibraryW GetConsoleCP GetConsoleMode LCMapStringW GetStringTypeW GetCurrentDirectoryW GetDriveTypeW HeapSize SetStdHandle WriteConsoleW FlushFileBuffers VirtualUnlock LoadLibraryA GetStartupInfoA GetProcessWorkingSetSize GetProcessTimes GetThreadTimes GlobalMemoryStatus GetProcessHeap VirtualLock GetLastError SetFilePointer ReadFile InterlockedExchange WideCharToMultiByte HeapDestroy MultiByteToWideChar GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

GetMessageTime GetMessagePos GetInputState GetFocus GetDesktopWindow GetClipboardViewer GetClipboardOwner GetCapture GetActiveWindow SetWindowsHookExA GetProcessWindowStation GetQueueStatus GetCaretPos GetCursorPos CallNextHookEx UnhookWindowsHookEx GetOpenClipboardWindow

advapi32

CryptGenRandom RegCloseKey RegQueryValueExA RegOpenKeyExA CryptAcquireContextA CryptReleaseContext

Name

.text

Size

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.img0

Size

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.img1

Size

376KB

Virtual Size

376KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Daemon.Tools.Pro.Advanced.v5.3.0.0359.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/Aero.dll

generic

out.upx

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/dtsoftbus01.inf

dtpro.dat

$PLUGINSDIR/en.bmp

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/nsProcess.dll

kernel32

user32

generic

$PLUGINSDIR/nsis7z.dll

kernel32

user32

oleaut32

generic

$PLUGINSDIR/ru.bmp

$PLUGINSDIR/ua.bmp

DTAgent.exe

PE Signature issue

dtcommonres

mpr

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

oleacc

gdiplus

imm32

winmm

generic

DTCommonRes.dll

PE Signature issue

comctl32

user32

kernel32

gdi32