2026-10-22_8944b240fd8ca192a80e1f00d21a7528_elex_maze_rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_8944b240fd8ca192a80e1f00d21a7528_elex_maze_rhadamanthys
Size 1.4MB
Sample261024-gfaassxv2n
SHA256 f14ed50ba8c6e4eeef76d690352ac6f8948108590d7efce5bee4a1f762b5c295
MD5 8944b240fd8ca192a80e1f00d21a7528
SHA1 cc18990e3b99ed9f800ceb49a6c21a8976d4abeb
SHA512 b2772539d3ebe9f476fb04638dbf67f47bb3bc66683d9245d97507c566ec446b15ceb6d7c4a13beea2a0799eff7df3d755fdd73cf38f4d4e896d6506f365cf01
SSDEEP 24576:bpcCOO4p8A5QGMozcYWwbtHRdFxyo/nHeRPuddmKXjsArdYRPNf/HGDgZdMy6:bpJOlNbcYjcCncGPmK4AClnkgZuV
TLSH
T1AB653352C6C864F3FB8670B411FF2049AE316D39476278EB8B94696758B2AE1FD3C443
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_8944b240fd8ca192a80e1f00d21a7528_elex_maze_rhadamanthys
unpack001/$_29_/GameHallMain.dll

File Explorer

2026-10-22_8944b240fd8ca192a80e1f00d21a7528_elex_maze_rhadamanthys

.exe 1.4MB
$PLUGINSDIR/FileInfo.dll

.dll 278KB
$PLUGINSDIR/RCWidgetPlugin.dll

.dll 1.3MB
$PLUGINSDIR/System.dll

.dll 28KB
$_28_/2345GameHall.exe

.exe 888KB
$_28_/Uninstall.exe

.exe 232KB
$PLUGINSDIR/FileInfo.dll

.dll 278KB
$PLUGINSDIR/System.dll

.dll 28KB
$_28_/coral_extract.dll

.dll 367KB
$_29_/GameHallMain.dll

.dll 844KB

2026-10-22_8944b240fd8ca192a80e1f00d21a7528_elex_maze_rhadamanthys

IMPHASH 9679f250d91a527cbbb99da9f96997e8
SHA256 f14ed50ba8c6e4eeef76d690352ac6f8948108590d7efce5bee4a1f762b5c295
MD5 8944b240fd8ca192a80e1f00d21a7528
SHA1 cc18990e3b99ed9f800ceb49a6c21a8976d4abeb
SHA512 b2772539d3ebe9f476fb04638dbf67f47bb3bc66683d9245d97507c566ec446b15ceb6d7c4a13beea2a0799eff7df3d755fdd73cf38f4d4e896d6506f365cf01
SSDEEP 24576:bpcCOO4p8A5QGMozcYWwbtHRdFxyo/nHeRPuddmKXjsArdYRPNf/HGDgZdMy6:bpJOlNbcYjcCncGPmK4AClnkgZuV
TLSH
T1AB653352C6C864F3FB8670B411FF2049AE316D39476278EB8B94696758B2AE1FD3C443
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrlenA GetPrivateProfileStringW WritePrivateProfileStringW MoveFileW MultiByteToWideChar WideCharToMultiByte CreateFileW GetFileSize GetTickCount GetModuleFileNameW GetProcAddress GetCommandLineW SetEnvironmentVariableW WriteFile GetTempPathW SetErrorMode HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId ExitProcess GetVersion GetWindowsDirectoryW LoadLibraryW CopyFileW GetDiskFreeSpaceW CreateThread GlobalLock GlobalUnlock lstrcmpiW lstrlenW CreateDirectoryW GetTempFileNameW RemoveDirectoryW WaitForSingleObject GetExitCodeProcess CreateProcessW GetSystemDirectoryW GetModuleHandleA lstrcmpiA lstrcpyA lstrcpyW lstrcatW MoveFileExW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent VirtualQuery RtlUnwind IsProcessorFeaturePresent lstrcmpW FormatMessageW MulDiv LocalFree GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep GetLastError CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW lstrcpynW ExpandEnvironmentStringsW

user32

GetSysColor GetWindowLongW SetClassLongW LoadBitmapW LoadCursorW SystemParametersInfoW wsprintfA DispatchMessageW PeekMessageW SetDlgItemTextW GetDlgItemTextW ScreenToClient CharPrevW MessageBoxIndirectW GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu CharNextA GetSystemMenu IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW RegisterClassW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetTimer CreateDialogParamW DestroyWindow PostMessageW LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC DefWindowProcW DrawTextW BeginPaint EndPaint GetClientRect SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect SetWindowTextW

gdi32

SetBkColor GetDeviceCaps SetTextColor SetBkMode SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetFileInfoW ShellExecuteExW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumValueW OpenProcessToken RegSetValueExW RegQueryValueExW RegOpenKeyExW SetFileSecurityW LookupPrivilegeValueW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyW AdjustTokenPrivileges

comctl32

ImageList_Create ImageList_Destroy ImageList_AddMasked ord17

ole32

OleUninitialize OleInitialize CoCreateInstance CoTaskMemFree

$PLUGINSDIR/FileInfo.dll

IMPHASH ad51f7bbb1176ad7ce1a3dc282e1c695
SHA256 93edd4c19314537aa106d80c2ed642c15fc6cc2f67e992f35367095c13ab5f68
MD5 7d773d726d5357b27b30ab8de1e42bb0
SHA1 593720bf9d9afa5665007304d6fb1502719d02aa
SHA512 6d399e83d6206064a328aa47e18b133c6d5f132449d4a4c791594ab903e015acfc7c23ed8e2b0853ee26e5bcb1333719e20bcf5a13b0d4772461bb06175ea5cb
SSDEEP 3072:u9so2AnuoF+tGhyrIXBeooGevi0pf3Q9GnuG9+U7dscRfUZhc9mB5ENOT:u9rIoF+Ay+BDgpnt9b+cR86QENC
TLSH
T110549E00FA43A576CDEF02741A799B09847D37618BA4CDC7E3841E5E5C36BD06A372AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

5f:5e:5b:a1:d5:ec:3a:8d:60:4e:75:d3:cb:da:67:d1:8f:1e:5d:11:3e:96:1b:64:dd:8c:6f:5b:24:71:16:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Chains

Nov 23, 2018

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

33:a0:8a:94:76:e8:18:1e:9f:0c:a4:8e:97:56:18:2c:51:1f:2b:7b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Chains

Nov 23, 2018

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

75:07:30:67:30:94:f3:8c:a9:f0:7e:06:e5:74:fb:df

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 4, 2017 - Jun 22, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

67:1d:31:6b:f6:0f:35:75:5f:07:23:72:de:ef:8f:e5

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 22, 2017 - Jun 22, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

121059

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\gamehall\GameHall\bin\InstallTool\bin\Win32\Release\pdb\FileInfo.pdb

kernel32

GetFileSize SetFilePointer WriteFile CreateFileW CloseHandle GetModuleFileNameW WritePrivateProfileStringW EnumResourceNamesW FindResourceW FreeLibrary LoadResource MoveFileExW GetPrivateProfileStringW LoadLibraryW Sleep SizeofResource GetFileAttributesW GetLastError LockResource DeleteFileW SetFileAttributesW WaitForSingleObject OpenProcess TerminateProcess GetCurrentProcessId GlobalAlloc WideCharToMultiByte lstrcpynW MultiByteToWideChar GlobalFree lstrcpyW CreateProcessW GetModuleHandleW GetProcAddress SearchPathW FindFirstFileW GetLongPathNameW GetACP GetEnvironmentVariableW GetShortPathNameW QueryDosDeviceW FindClose FindNextFileW GetVersionExW lstrcmpiW GetFullPathNameW CreateDirectoryW lstrlenW GetTempPathW SetEndOfFile ReadFile LoadLibraryExW HeapAlloc HeapFree GetProcessHeap GetCurrentThreadId GetLogicalDriveStringsW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection VirtualAlloc InitializeCriticalSectionAndSpinCount GetCurrentProcess VirtualFree VirtualQuery ResumeThread SuspendThread CreateToolhelp32Snapshot VirtualProtect OpenThread InterlockedExchange FlushInstructionCache Thread32Next HeapCreate HeapDestroy Thread32First InterlockedCompareExchange SetThreadContext GetThreadContext FlushFileBuffers WriteConsoleW EncodePointer DecodePointer IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA GetSystemTimeAsFileTime RaiseException RtlUnwind IsValidCodePage GetOEMCP GetCPInfo SetLastError ExitProcess GetModuleHandleExW AreFileApisANSI HeapSize GetStdHandle GetConsoleMode ReadConsoleW GetConsoleCP SetFilePointerEx GetFileType GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW LCMapStringW HeapReAlloc OutputDebugStringW SetStdHandle

user32

FindWindowExW

advapi32

AdjustTokenPrivileges DuplicateTokenEx

shell32

SHGetSpecialFolderPathW ord190 ord155

ole32

CoTaskMemFree PropVariantClear CoCreateInstance

shlwapi

StrCmpW SHStrDupW

$PLUGINSDIR/RCWidgetPlugin.dll

IMPHASH fdd393dfc0af747dabfdb2a6230163a2
SHA256 7f0074317a4373e10ef16344b435548370d128ad7ba7b9dd563252230d769720
MD5 73a623f6071e06c34b754923ce0bdc03
SHA1 079ac302faf96c20d52fe2e61d31ebe920af03a1
SHA512 d2387a76c7552e745bcf212241f8e88514b92c3d7a79e63c46d5345726b67f55bf2e209817c09e47c2e3cb7080d5b703946e8fd9bb24038f0bcf9b5332f30ad3
SSDEEP 24576:38Lpd74ddZ2hPs4VKoO1qAEWaaEeB/pvfe1dAWAc7Yyhv2nlnL1Inm:P2hPe11F+1dqc7YyhOlnL1Inm
TLSH
T174556C04F75781B2CFCF12B02425F75E407A6F455B684EDBA2587F4EBA300D22A3B696
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

7e:e6:cd:e3:82:02:3b:56:24:d8:2c:81:a1:51:56:37:ac:1a:42:d2:02:12:05:7e:dd:41:0d:5f:e1:58:40:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91310115591679552Q,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jan 18, 2022

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

67:b0:9b:0c:1f:ca:e9:69:1e:dd:d0:d8:56:99:61:41:e1:d8:29:66

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

Chains

Jan 18, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

Serial Number

06:ea:0d:de:d5:5e:c1:e1:a2:9f:c5:fb:5d:ab:4f:b2

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2020 - May 18, 2023

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Sep 18, 2026

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

Serial Number

05:aa:43:30:0d:17:67:ac:12:49:43:54:21:65:bb:9e

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2020 - May 18, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

Major OS version

Entry point

132398

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\CommonPlatform\GameHall_http\bin\RCSetup\bin\Release\RCWidgetPlugin.pdb

kernel32

EnterCriticalSection SetEvent Sleep ResetEvent CreateEventW InterlockedExchangeAdd CreateProcessW LocalFree GetEnvironmentVariableW GetLongPathNameW GetFileAttributesExW HeapAlloc HeapFree GetProcessHeap GetCurrentThreadId LoadLibraryExW GetFullPathNameW GetFileSize SetFilePointer WriteFile UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation LeaveCriticalSection InitializeCriticalSection QueryDosDeviceW OpenProcess GetCurrentProcess GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue DuplicateHandle GetACP LoadLibraryW FreeLibrary ExpandEnvironmentStringsW GetVolumeInformationW GetDiskFreeSpaceW GetLogicalDriveStringsW ResumeThread WaitForSingleObject lstrcmpiW LockResource GetVersionExW GetModuleHandleW LoadResource FindResourceW GetCurrentProcessId GetProcAddress lstrcatW FindClose lstrlenW GetFileAttributesW FindFirstFileW CloseHandle CreateFileW GetModuleFileNameW ReadFile SetErrorMode DeleteCriticalSection DecodePointer GetLastError RaiseException VirtualQuery SuspendThread CreateToolhelp32Snapshot OpenThread Thread32Next Thread32First InterlockedCompareExchange SetThreadContext GetThreadContext VirtualFree VirtualAlloc InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead HeapDestroy HeapCreate GetModuleHandleA DisableThreadLibraryCalls OutputDebugStringA VirtualProtect MapViewOfFileEx CreateFileMappingW UnmapViewOfFile QueryPerformanceFrequency GlobalUnlock GlobalLock FreeResource SetWaitableTimer CreateWaitableTimerW LocalAlloc MulDiv SizeofResource InterlockedExchange InterlockedDecrement InterlockedIncrement lstrcmpW FlushInstructionCache FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW SetFilePointerEx GetConsoleMode GetConsoleCP LCMapStringW HeapReAlloc RtlUnwind GetStringTypeW GetCPInfo GetOEMCP IsValidCodePage CreateSemaphoreW GetTickCount TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetModuleFileNameA GetStartupInfoW GetFileType GetStdHandle GetCurrentThread SetLastError HeapSize GetModuleHandleExW ExitProcess GetSystemTimeAsFileTime ExitThread CreateThread IsProcessorFeaturePresent IsDebuggerPresent GetCommandLineA EncodePointer InitializeCriticalSectionAndSpinCount lstrcpyW GlobalFree MultiByteToWideChar lstrcpynW WideCharToMultiByte GlobalAlloc

user32

LoadIconW UnregisterClassW DefWindowProcW SetWindowLongW CallWindowProcW MessageBoxW GetWindowLongW CharPrevW SendMessageW DestroyWindow CharNextW GetActiveWindow PostMessageW wsprintfW EndDialog RemovePropW SetPropW GetForegroundWindow GetPropW GetAsyncKeyState GetAncestor LoadStringW EnumThreadWindows DestroyAcceleratorTable CreateAcceleratorTableW GetFocus RegisterWindowMessageW GetSysColor GetIconInfo DrawIconEx GetSystemMetrics SetForegroundWindow IsClipboardFormatAvailable EmptyClipboard GetClipboardData SetClipboardData CloseClipboard GetDesktopWindow LoadImageW LoadBitmapW MsgWaitForMultipleObjects SetCaretPos SetRect FillRect UpdateLayeredWindow SetRectEmpty PtInRect UnionRect SystemParametersInfoW AttachThreadInput GetCaretBlinkTime ToAscii GetKeyboardState GetClassLongW GetClassInfoExW RegisterClassExW PostQuitMessage PeekMessageW DispatchMessageW TranslateMessage GetMessageW GetMonitorInfoW MonitorFromWindow CreateWindowExW IsWindow SetWindowPos IsIconic IsZoomed GetDCEx GetWindowDC ReleaseDC InvalidateRect RedrawWindow GetClientRect GetWindowRect SetCursor GetCursorPos ClientToScreen CopyRect IntersectRect OffsetRect IsRectEmpty EqualRect GetParent EnumChildWindows LoadCursorW DialogBoxParamW SetWindowTextW TrackMouseEvent GetKeyState SetCapture ReleaseCapture ScreenToClient IsChild ShowWindow ShowWindowAsync MoveWindow IsWindowVisible GetDlgItem OpenClipboard SetFocus SetTimer KillTimer EnableWindow GetDC BeginPaint EndPaint SetWindowRgn ValidateRect InvalidateRgn GetWindowTextW GetWindowTextLengthW AdjustWindowRectEx MapWindowPoints SetParent GetClassNameW GetWindowThreadProcessId GetWindow

gdi32

CreateSolidBrush SetBkColor SetTextColor CreateFontIndirectW EnumFontsW GetObjectW GetClipBox CreateDIBSection CreatePolygonRgn SetWorldTransform CreateRectRgnIndirect CreateRoundRectRgn PtInRegion CreateDCW GetDIBits ExtTextOutW SetGraphicsMode GetStockObject SetViewportOrgEx SelectObject GetRgnBox DeleteObject CreateCompatibleDC CreateCompatibleBitmap BitBlt GetDeviceCaps DeleteDC

advapi32

RegSetValueExW DuplicateTokenEx AdjustTokenPrivileges RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

shell32

DragQueryFileW DragFinish SHGetSpecialFolderPathW

ole32

CoInitialize OleLockRunning OleUninitialize OleInitialize StringFromGUID2 CLSIDFromProgID CLSIDFromString CoGetClassObject CreateStreamOnHGlobal CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoUninitialize

oleaut32

LoadRegTypeLi SysFreeString SysAllocString VarUI4FromStr SysAllocStringLen SysStringLen VariantInit VariantClear LoadTypeLi OleCreateFontIndirect DispCallFunc

shlwapi

PathIsRootW PathFileExistsW StrToIntA StrDupW PathFindFileNameW PathAppendW ord12

comctl32

InitCommonControlsEx _TrackMouseEvent

msimg32

AlphaBlend

urlmon

CoInternetCreateZoneManager CoInternetCreateSecurityManager

gdiplus

GdipCloneBitmapAreaI GdipCreatePath GdipDeletePath GdipClosePathFigure ord1 GdipAddPathString GdipGetPathWorldBounds GdipCreateMatrix GdipCreateMatrix2 GdipDeleteMatrix GdipGetMatrixElements GdipCloneRegion GdipDeleteRegion GdipTransformRegion GdipCloneBrush GdipDeleteBrush GdipCreateTexture GdipGetTextureTransform GdipCreateSolidFill GdipCreateLineBrushI GdipSetLinePresetBlend GdipSetLineWrapMode GdipGetLineTransform GdipCreatePen1 GdipDeletePen GdipSetPenDashStyle GdipGetImageGraphicsContext GdipCloneBitmapArea GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipSetImageAttributesWrapMode GdipCreateFromHDC GdipDeleteGraphics GdipSetCompositingQuality GdipSetSmoothingMode GdipGetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipGetTextRenderingHint GdipSetInterpolationMode GdipGetInterpolationMode GdipMultiplyWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipRotateWorldTransform GdipDrawLine GdipDrawArcI GdipCreateBitmapFromScan0 GdipDrawPath GdipGraphicsClear GdipFillRectangleI GdipFillEllipse GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusStartup GdiplusShutdown GdipGetBrushType GdipSetTextureTransform GdipSetLineTransform GdipFillPath GdipDrawImageRectRect GdipDrawImageRectRectI GdipSetClipRectI GdipSetClipRegion GdipGetClipBoundsI GdipSaveGraphics GdipRestoreGraphics GdipBeginContainer2 GdipEndContainer GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetFamilyName GdipGetEmHeight GdipCombineRegionPath GdipCreateRegionPath GdipAddPathEllipseI GdipGetCellAscent GdipGetCellDescent GdipGetLineSpacing GdipAddPathRectangleI GdipAddPathBezierI GdipAddPathArcI GdipAddPathLineI GdipCreateBitmapFromFile GdipGetImagePixelFormat GdipBitmapUnlockBits GdipDrawRectangle GdipBitmapLockBits GdipSetStringFormatTrimming GdipCreateFont GdipDeleteFont GdipGetFamily GdipGetFontStyle GdipGetFontSize GdipDrawString GdipMeasureString GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipCloneStringFormat GdipSetCompositingMode GdipCreateHBITMAPFromBitmap GdipGetStringFormatLineAlign GdipSetStringFormatLineAlign GdipSetStringFormatFlags GdipSetStringFormatAlign GdipGetStringFormatAlign GdipCombineRegionRegion

psapi

GetMappedFileNameW

imm32

ImmSetCompositionWindow ImmNotifyIME ImmGetCompositionStringW ImmAssociateContextEx ImmReleaseContext ImmGetContext

winmm

timeGetTime

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

generic

count=2, productName=Unmarked objects (old),

count=3, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=225, version=20806,

count=125, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=143, id=225, productName=VS2013 build 21005, version=21005,

count=52, id=223, productName=VS2013 build 21005, version=21005,

count=250, id=224, productName=VS2013 build 21005, version=21005,

count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=623, id=1, productName=Unmarked objects,

count=80, id=228, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,

$PLUGINSDIR/System.dll

IMPHASH 127a02894b36e3dd18bd638b1758f9f7
SHA256 86ec9f64c3635568a18c11c94e81e8cb20b94e1d97a192132bc55f9281909d60
MD5 ca1c1129591b793d2753a4c425ef6ef1
SHA1 0f417cdd887d57c5839c409b4bb76597af02ed1e
SHA512 1eded730b2e1c51fd8639e56ca532b497777f0ae1f4b5397966335d3c8966c3fb1e46742fa2fc3c84ecf687dbe19f4e3129eb3d1e0b0d72c9c154de18d3af69f
SSDEEP 384:ix8XpXIgtyMKJnoHLJ84QNindpkEYPLeZRbxeMj8pkEVSS7mb5JNNzFwhhiY:iSYgty1orJ8zNiIEFnEoS7mh3whd
TLSH
T175D23AC70E1568F2FECA893961C6E61B8D34A7D46BD654D34CF581813E81BE23B3984E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

22:bb:56:f8:17:f2:43:b7:6d:6d:18:d7:a6:ec:64:f5:7d:e8:59:be:a9:d6:be:e6:c2:19:9e:f5:81:cb:b8:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Chains

May 26, 2017

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

97:22:0a:20:93:eb:6a:4c:82:ad:37:63:39:bc:81:74:43:e6:a6:48

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Chains

May 26, 2017

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Serial Number

55:84:61:31:5b:4a:38:8f:b3:bc:78:26:9c:49:97:2d

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2014 - Sep 2, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Serial Number

21:23:96:86:f6:6c:b0:bc:11:21:e5:78:87:23:62:8a

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 23, 2016 - Sep 2, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

6928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_28_/2345GameHall.exe

IMPHASH 25ad6ace46f1ef91a36436d344e311e2
SHA256 72ccbb3889f48a3b2e01ff1ffc99fe67629e41840c8f9f08c1f41107f685fb01
MD5 2f07656681619e6e874173a097d14cee
SHA1 1601d5102560c249bfa523d9d25b3595b2049d15
SHA512 e4ec9cf789331b0cb7b2815dd25e9063780667c200a25c79db328639fb8ae2683b82297741b4ac3fc9e5ac0e5e9dda63227fff75ce882d1e5069b15cb4859911
SSDEEP 12288:PxuDto4Rg+gdeHoa6M3g1t/AyZeWWI35fubJyf0xFZ9HmBfEvLdzDk34mTk4SqO1:4Dto4Rg+lIMg1hJ1ubxdf4rTk9qNKiq
TLSH
T166153908FB43C27ACB7701B0356AEB1A406A7F454B2C4DDBE7947F0A35345C16A3BA5A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

ba:fe:a6:36:f6:d0:12:0a:07:9f:2d:00:0c:fb:9b:d7:e7:d5:3b:df:b0:09:55:15:53:ee:04:77:fe:b0:ce:4e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

Chains

Jan 19, 2022

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

b4:3f:be:37:2f:6a:8b:c2:e9:01:34:69:e1:34:8d:6b:2e:00:70:19

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

Chains

Jan 19, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

Serial Number

06:ea:0d:de:d5:5e:c1:e1:a2:9f:c5:fb:5d:ab:4f:b2

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2020 - May 18, 2023

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Sep 18, 2026

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

Serial Number

05:aa:43:30:0d:17:67:ac:12:49:43:54:21:65:bb:9e

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2020 - May 18, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

Major OS version

Entry point

413639

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\GameHall\GameHall_http\out\Release\2345GameHall.pdb

kernel32

CloseHandle HeapAlloc GetCurrentProcess HeapFree GetModuleHandleW GetProcessHeap GetModuleFileNameW GetProcAddress SetFilePointer WriteFile CreateFileW RemoveDirectoryW GetLastError Sleep OpenMutexW WritePrivateProfileStringW LoadLibraryW GetPrivateProfileStringW FreeLibrary GetFileSize SetErrorMode SetEnvironmentVariableA WriteConsoleW GetFileAttributesW CreateMutexW WaitForSingleObject ReleaseMutex FindFirstFileW GetLongPathNameW GetFileAttributesExW FindResourceW LoadResource GetVersionExW LockResource lstrcmpiW OpenProcess QueryDosDeviceW WideCharToMultiByte GetACP MultiByteToWideChar FindClose FindNextFileW GetEnvironmentVariableW GetCurrentProcessId InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection lstrlenW GetFileSizeEx SetEndOfFile ReadFile DeleteFileW GetComputerNameExW GetCurrentThreadId LocalFree GetFullPathNameW GetTempFileNameW MoveFileExW CreateDirectoryW CopyFileW GetTempPathW MoveFileW GetWindowsDirectoryW SetFileAttributesW GetLogicalDriveStringsW LoadLibraryExW CreateProcessW GetExitCodeProcess WaitForMultipleObjects GetTickCount FormatMessageW GlobalMemoryStatusEx InitializeCriticalSectionAndSpinCount RaiseException DecodePointer SetEvent ResetEvent CreateEventW InterlockedExchangeAdd InterlockedExchange SetLastError EncodePointer GetCommandLineW RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent GetSystemTimeAsFileTime ExitProcess GetModuleHandleExW HeapSize GetStdHandle GetFileType GetStartupInfoW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsValidCodePage GetOEMCP GetCPInfo GetStringTypeW GetTimeZoneInformation HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringW GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers SetStdHandle

shlwapi

SHGetValueW

$_28_/Uninstall.exe

IMPHASH 9679f250d91a527cbbb99da9f96997e8
SHA256 e8b587c65e890926d127ad454fa65ec9f1e0869697c34277a19599cccd48012d
MD5 ad999a53e962ef536c561e2b2def4390
SHA1 61a30e413966ae8093f802700c3fd3ca49f8295f
SHA512 2d8cd932d30faa22aed3394783730ae6b0028605e14b357e9713f8d605d58c52c01bdb935d03d145e1f7d8ca6b71ce840a6460c017b7895af8e8568169bc6bb5
SSDEEP 6144:bewfV4DTTTsTTHPTT+PTTaTTbTT6THTTeTTTMTt5kTRTT2PTT7PTT5TT+TTPTTRf:blVITTTsTTHPTT+PTTaTTbTT6THTTeT5
TLSH
T1B234F146DA458591DEC38870A5F9E6939C33BF0B0B2465E783843EA27D733D1AA3C359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

d9:59:9d:58:79:0c:a1:21:f6:40:ec:d8:b5:e2:1a:4e:dd:86:fa:5c:c6:67:01:e5:0d:75:31:44:d8:ec:58:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Chains

Nov 23, 2018

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

48:a8:87:df:a3:64:53:89:77:21:ec:6b:2e:27:be:40:33:24:3c:7b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Chains

Nov 23, 2018

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

75:07:30:67:30:94:f3:8c:a9:f0:7e:06:e5:74:fb:df

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 4, 2017 - Jun 22, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

67:1d:31:6b:f6:0f:35:75:5f:07:23:72:de:ef:8f:e5

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 22, 2017 - Jun 22, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

20224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps SetTextColor SetBkMode SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetFileInfoW ShellExecuteExW SHFileOperationW SHGetSpecialFolderLocation

advapi32

comctl32

ImageList_Create ImageList_Destroy ImageList_AddMasked ord17

ole32

OleUninitialize OleInitialize CoCreateInstance CoTaskMemFree

$PLUGINSDIR/FileInfo.dll

IMPHASH ad51f7bbb1176ad7ce1a3dc282e1c695
SHA256 93edd4c19314537aa106d80c2ed642c15fc6cc2f67e992f35367095c13ab5f68
MD5 7d773d726d5357b27b30ab8de1e42bb0
SHA1 593720bf9d9afa5665007304d6fb1502719d02aa
SHA512 6d399e83d6206064a328aa47e18b133c6d5f132449d4a4c791594ab903e015acfc7c23ed8e2b0853ee26e5bcb1333719e20bcf5a13b0d4772461bb06175ea5cb
SSDEEP 3072:u9so2AnuoF+tGhyrIXBeooGevi0pf3Q9GnuG9+U7dscRfUZhc9mB5ENOT:u9rIoF+Ay+BDgpnt9b+cR86QENC
TLSH
T110549E00FA43A576CDEF02741A799B09847D37618BA4CDC7E3841E5E5C36BD06A372AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

5f:5e:5b:a1:d5:ec:3a:8d:60:4e:75:d3:cb:da:67:d1:8f:1e:5d:11:3e:96:1b:64:dd:8c:6f:5b:24:71:16:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Chains

Nov 23, 2018

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

33:a0:8a:94:76:e8:18:1e:9f:0c:a4:8e:97:56:18:2c:51:1f:2b:7b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Chains

Nov 23, 2018

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

75:07:30:67:30:94:f3:8c:a9:f0:7e:06:e5:74:fb:df

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 4, 2017 - Jun 22, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

67:1d:31:6b:f6:0f:35:75:5f:07:23:72:de:ef:8f:e5

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 22, 2017 - Jun 22, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

121059

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\gamehall\GameHall\bin\InstallTool\bin\Win32\Release\pdb\FileInfo.pdb

kernel32

user32

FindWindowExW

advapi32

AdjustTokenPrivileges DuplicateTokenEx

shell32

SHGetSpecialFolderPathW ord190 ord155

ole32

CoTaskMemFree PropVariantClear CoCreateInstance

shlwapi

StrCmpW SHStrDupW

$PLUGINSDIR/System.dll

IMPHASH 127a02894b36e3dd18bd638b1758f9f7
SHA256 86ec9f64c3635568a18c11c94e81e8cb20b94e1d97a192132bc55f9281909d60
MD5 ca1c1129591b793d2753a4c425ef6ef1
SHA1 0f417cdd887d57c5839c409b4bb76597af02ed1e
SHA512 1eded730b2e1c51fd8639e56ca532b497777f0ae1f4b5397966335d3c8966c3fb1e46742fa2fc3c84ecf687dbe19f4e3129eb3d1e0b0d72c9c154de18d3af69f
SSDEEP 384:ix8XpXIgtyMKJnoHLJ84QNindpkEYPLeZRbxeMj8pkEVSS7mb5JNNzFwhhiY:iSYgty1orJ8zNiIEFnEoS7mh3whd
TLSH
T175D23AC70E1568F2FECA893961C6E61B8D34A7D46BD654D34CF581813E81BE23B3984E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

22:bb:56:f8:17:f2:43:b7:6d:6d:18:d7:a6:ec:64:f5:7d:e8:59:be:a9:d6:be:e6:c2:19:9e:f5:81:cb:b8:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Chains

May 26, 2017

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

97:22:0a:20:93:eb:6a:4c:82:ad:37:63:39:bc:81:74:43:e6:a6:48

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Chains

May 26, 2017

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Serial Number

55:84:61:31:5b:4a:38:8f:b3:bc:78:26:9c:49:97:2d

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2014 - Sep 2, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=2345.com,OU=桌面软件事业部,O=2345.com,L=shanghai,ST=shanghai,C=CN

Serial Number

21:23:96:86:f6:6c:b0:bc:11:21:e5:78:87:23:62:8a

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 23, 2016 - Sep 2, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

6928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_28_/coral_extract.dll

IMPHASH 27078d36f37371b0a00fb89ab0cc3581
SHA256 7c4e5d82b37eb114ff1da31bbe9ba1865e2e181e0c6daf097427ff102b6dfe52
MD5 38b4c50710126bb520741eb8f0e89657
SHA1 037a7c9f184ceb6aeed611f631fd411c6815f758
SHA512 6ff4c6036afca88cbf5b18d99c1d828479fb14be08a33825e66d42cfac530d605e9afd97d997636e701ac6e7b02205a5e958a74818bd106d870d2d239b48b73b
SSDEEP 6144:E3rs4BljUlCHGaR8hU3FAQ5Bu0rzGXC2oM6m1L7HurTEPtAzKIAg:E3rsmYcHGaZ3nu0rzGy2oM6m1PHy4Pt6
TLSH
T18E849E23F280C0B6C09E01757D65FB59D2F9B5A25E7A8503FBD055CADE672A2A338343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

10:59:b3:25:b1:49:34:f1:9c:33:83:5f:44:1c:b2:23:c2:a4:e3:d0:aa:16:d1:d9:19:ec:06:f7:9d:5f:5b:be

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Chains

Oct 19, 2018

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

ff:2d:ce:b1:52:96:51:96:4b:0a:18:78:fc:25:27:3e:35:07:fd:1b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Chains

Oct 19, 2018

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

48:4a:9b:11:5b:01:09:69:1e:2d:e4:1e:77:a4:4f:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 4, 2017 - Jun 22, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

1b:a6:23:e4:b0:f0:92:9b:62:02:10:e4:50:e4:0a:1e

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 22, 2017 - Jun 22, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

207973

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\rczip.dev\trunk\bin\Win32\release\pdb\Extract7z.pdb

kernel32

GetProcAddress VirtualAlloc GetModuleHandleW VirtualFree InterlockedExchangeAdd InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetVersionExW GetLastError ReadFile CreateFileW SetFilePointer CloseHandle LoadLibraryW FreeLibrary GetTickCount GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap RaiseException RtlUnwind GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate GetSystemTimeAsFileTime HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryA GetLocaleInfoA GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetFileAttributesW FormatMessageW LocalFree FindFirstFileW FindClose FindNextFileW DeleteFileW CreateDirectoryW GetFileSize GetFullPathNameW SetFileTime GetTempFileNameW SetFileAttributesW MoveFileW lstrlenW SetEndOfFile FindResourceW WaitForMultipleObjects CreateEventW ResetEvent WaitForSingleObject SetEvent CreateThread ExitThread ResumeThread

user32

LoadStringW

$_29_/GameHallMain.dll

SHA256 47b04e2b9d04f73ae23f266e46b5c9c8899f2689895e1d8258050d4dd055d309
MD5 c50ff10034c2710533e3a30e5aa51ce4
SHA1 c187ece3187e9f0f9bbdb0c11722285dd993eb00
SHA512 e01691fd3be7357abbf8cbb7886eea9566934f4be466ba3eb5ca48e85bb48298317812628b522e707399185d3ba938bdb90246981a1fb5a828750a020d8beb51
SSDEEP 12288:dJf0oU6AWRzX93QWbvbhyC7j28BUQCiNaNoBij1isOP9wMLKd7p8qA:dJcoiWRtQWByC3RCiUiQj1g9w50
TLSH
T1DC053A10F616C325D9B912F0AABE6F1E942C166813B818C3F3C65E256961CD26F37B4F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2338409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

53KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

316KB

Virtual Size

316KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

197KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ