Manalyze report for 3e2c2647766b6f0acbd122f116f3ef08

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2021-Jan-28 16:48:47
Detected languages	English - United States
CompanyName	Chogolisa Company
FileDescription	Chogolisa Purview Install
FileVersion	`1.3.9.7`
InternalName	ChogolisaPurviewInstall.exe
LegalCopyright	Copyright 2020
OriginalFilename	ChogolisaPurviewInstall.exe
ProductName	ChogolisaPurviewInstall
ProductVersion	`1.3.9.7`

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ v6.0 DLL` `Microsoft Visual C++ 6.0 - 8.0`
Info	Interesting strings found in the binary:	`Contains domain names: curl.haxx.se example.com https://curl.haxx.se https://curl.haxx.se/docs/http-cookies.html`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to MD5` `Uses constants related to AES` `Microsoft's Cryptography API`
Suspicious	The PE is possibly packed.	`Unusual section name found: .text1` `Unusual section name found: .text2` `Unusual section name found: .mdata` `Unusual section name found: .text3` `Unusual section name found: .fdata`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryA LoadLibraryExW GetProcAddress LoadLibraryW` `Functions which can be used for anti-debugging purposes: CreateToolhelp32Snapshot` `Can access the registry: RegDeleteKeyTransactedA RegEnumValueW RegSetKeySecurity RegQueryValueW RegDeleteValueW RegOpenKeyExW RegEnumKeyExW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCloseKey RegReplaceKeyW RegQueryValueExW RegSetValueA RegCreateKeyExW` `Possibly launches other programs: CreateProcessW ShellExecuteW` `Uses Microsoft's cryptographic API: CryptDestroyHash CryptAcquireContextA CryptReleaseContext CryptGenRandom CryptCreateHash CryptHashData CryptDestroyKey CryptImportKey CryptGetHashParam CryptEncrypt` `Can create temporary files: CreateFileW GetTempPathW` `Uses functions commonly found in keyloggers: CallNextHookEx MapVirtualKeyW GetForegroundWindow GetAsyncKeyState` `Memory manipulation functions often used by packers: VirtualProtect VirtualAlloc` `Leverages the raw socket API to access the Internet: #14 #8 #57 #10 #20 #17 #13 #1 WSAIoctl getaddrinfo freeaddrinfo #23 #21 #15 #9 #7 #115 #116 #111 #151 #18 #112 #16 #19 #2 #3 #4 #5 #6` `Functions related to the privilege level: OpenProcessToken AdjustTokenPrivileges` `Enumerates local disk drives: GetDriveTypeA GetVolumeInformationW GetDriveTypeW` `Manipulates other processes: Process32FirstW Process32NextW OpenProcess` `Can take screenshots: GetDC BitBlt CreateCompatibleDC`
Malicious	VirusTotal score: 3/70 (Scanned on 2021-01-30 22:21:10)	`DrWeb: Adware.Siggen.33074` `Webroot: W32.Adware.Gen` `Gridinsoft: Adware.SpecialSearchOffer.dd!c`

Hashes

MD5	`3e2c2647766b6f0acbd122f116f3ef08`
SHA1	`6fd48c0c71264af04aeaf49aac9fc1f70d98a081`
SHA256	`64ba9ee6bfaa9b9b53d8bb00d92777766c4655814ee1e5de8d9dadd170c3730a`
SHA3	`832e53c86e836ba34475b225dacefc9d87e7558034de20b0bea96807482a8b38`
SSDeep	`49152:9vDS09ZYI+m4nuosAjft9zvmK5MCeioTtM92kZC3CL47hVXm8Kr/DETbg20Yt:9v28wm4uosAt9zOK5leioTtM92kZC3Co`
Imports Hash	`8032d02fdca6399c76e6b2198bb2419d`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x128`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`10`
TimeDateStamp	2021-Jan-28 16:48:47
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0x1d1e00`
SizeOfInitializedData	`0xf1800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x001522A0 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x1d5000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x2c8000`
SizeOfHeaders	`0x400`
Checksum	`0x2cd89b`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`bd97f2dd8ccb5326d48e8ad7e99c3d83`
SHA1	`84150956a6c52bbaf3927665db375577bb033637`
SHA256	`beaa26b448ab97adbeebc617982cc0b793f2b17056eb6ed6d3cd4e8a4a6045fe`
SHA3	`7035bd94931901ab8e42c271e07aeab65f4f4bc0ca426abaa83f55a1a51c2225`
VirtualSize	`0x1cd8ea`
VirtualAddress	`0x1000`
SizeOfRawData	`0x1cda00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.5567`

.text1

MD5	`8c1e149cd4560af7ca6e14065fb9aece`
SHA1	`d2d013813b9ad88b33b181884100df8026d228a0`
SHA256	`9b5d2c5cc87a4c769f2934b65afcb516865fb1a3fb6b8c618d1dbcb1cbd9b438`
SHA3	`9146c65d7a44f9ea0441e4c3cfcf9ddcb8467836eed5372009d5f1b5073e7191`
VirtualSize	`0xbba`
VirtualAddress	`0x1cf000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x1cde00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.08472`

.text2

MD5	`17fa0d96efa7ab86268e87d47ca6f4f0`
SHA1	`0a5ed3bb8baf7511600a508cea6810ac389d4632`
SHA256	`60501225f2fea3ab672994bdae9759961308b6317f2bc706c0f8e575b767538e`
SHA3	`ed85bfc57057d4e28ff33054c34bc1eda4dcfefa7e32b049584926097d705759`
VirtualSize	`0x1795`
VirtualAddress	`0x1d0000`
SizeOfRawData	`0x1800`
PointerToRawData	`0x1cea00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.93394`

.mdata

MD5	`844d8e2b8836ee4e404350bc255f747d`
SHA1	`0f42d9ccaa65e1fe9e54f2ecb1000b795bc38d3c`
SHA256	`7ee57080ac6373405b5de38d041f911b39a40df5339c60d16a461668f5970bb0`
SHA3	`e0f009f044af9f702e83b3c47471949b0138a780ff8b8b9342ae7f2363f7ba4e`
VirtualSize	`0xf4b`
VirtualAddress	`0x1d2000`
SizeOfRawData	`0x1000`
PointerToRawData	`0x1d0200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.27269`

.text3

MD5	`8387a358b75363db008a1ba3dbaf6454`
SHA1	`76ce0c18a05cc68ec334ddc54cfc84324daa0ef9`
SHA256	`94520d47cee34338d58a7ad2dbb474e856a38f734f1d206e70f62aca50bf482f`
SHA3	`24d930ed0b9a95e4958619775e05040b68efefa50768640f2310eace906a1d8d`
VirtualSize	`0x44a`
VirtualAddress	`0x1d3000`
SizeOfRawData	`0x600`
PointerToRawData	`0x1d1200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`4.84746`

.fdata

MD5	`48b8170dab913240409e8d2eb470e85a`
SHA1	`46169a0388634daf4b4d92f93e5349aad3ff26d3`
SHA256	`7b9a1668631536de476b711e1ef7a7e5661ad3f2365910fa2578c4be436446dc`
SHA3	`34e12aeb4e86b3ccd89052b2da065cb19fcd9cdda7759b00ad5751537187acd8`
VirtualSize	`0x9fa`
VirtualAddress	`0x1d4000`
SizeOfRawData	`0xa00`
PointerToRawData	`0x1d1800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.10216`

.rdata

MD5	`f518f27ed2a316d463754fe2535ffff1`
SHA1	`ce4fba8c9ee93d3652a1b906b316093b95de9a0e`
SHA256	`2ba2473901619e306a7be30c8877e4f7e43adc1f3951fb823907419cd8986bef`
SHA3	`6164b5042bc1853e4c03ecbdb0141271be1b48f20326e8bba48504d1fb1863b7`
VirtualSize	`0x6a7dc`
VirtualAddress	`0x1d5000`
SizeOfRawData	`0x6a800`
PointerToRawData	`0x1d2200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.26133`

.data

MD5	`1297ec890700c66ca552a535ff972e07`
SHA1	`06c7bfe4b5fecd387d86df4d691e18d04087b3fa`
SHA256	`3b59b7909451f1f8fcc47a39427ccbb749ac96253289e06e124e872db076bf21`
SHA3	`72823707fbdf08cc0e653fcee298c39a343e51c39f0cf403f95758cd71ed109e`
VirtualSize	`0x9f44`
VirtualAddress	`0x240000`
SizeOfRawData	`0x5600`
PointerToRawData	`0x23ca00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`4.65266`

.rsrc

MD5	`4ee2e93afe82467357b632214c5821e3`
SHA1	`f668ccd9db76ad1bde0a48eac989693cfb3876be`
SHA256	`d7f3370ef60acd530c5934adfbd9b39469f783230868d0cf073588865372bc17`
SHA3	`d19d3270fbdf2ac8aa87e480359322b37895f279cf8a574863d6450839481a9e`
VirtualSize	`0x57158`
VirtualAddress	`0x24a000`
SizeOfRawData	`0x57200`
PointerToRawData	`0x242000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.38462`

.reloc

MD5	`5a8774d6dbb2ec3fac75c88ae94bfcc2`
SHA1	`78b5b71cb2396a3ec45d22fe9e0a4a2a88f9e887`
SHA256	`c6eacc69236a3ad13cde1839212e6d553a9ab1bd83a5efa58e97b640985c2d57`
SHA3	`233925562553054a2da1c5683715ea310d0dcd9b0c51333be2c5aea4d5e8f5e5`
VirtualSize	`0x25da8`
VirtualAddress	`0x2a2000`
SizeOfRawData	`0x25e00`
PointerToRawData	`0x299200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.59071`

Imports

KERNEL32.dll	`SetEndOfFile` `GetDriveTypeA` `GetCurrentThreadId` `RaiseException` `FlushFileBuffers` `LCMapStringW` `GetCurrentDirectoryW` `GlobalHandle` `GetWindowsDirectoryW` `LoadLibraryA` `UnlockFile` `CancelSynchronousIo` `AddVectoredContinueHandler` `GetSystemDefaultUILanguage` `IsProcessorFeaturePresent` `lstrcmpW` `FileTimeToLocalFileTime` `FindFirstVolumeW` `MoveFileExW` `Process32FirstW` `GetCurrentProcessId` `GetACP` `WaitForSingleObjectEx` `UnhandledExceptionFilter` `GetStringTypeW` `IsValidCodePage` `DisassociateCurrentThreadFromCallback` `GetCPInfo` `GetOEMCP` `FindResourceExW` `SetFilePointerEx` `CreateToolhelp32Snapshot` `FindFirstFileExW` `WaitForSingleObject` `GetEnvironmentVariableW` `GetCurrentProcess` `GlobalFree` `GetPrivateProfileStringW` `FileTimeToSystemTime` `SystemTimeToTzSpecificLocalTime` `SetThreadPriority` `LoadResource` `TlsFree` `ResetEvent` `CreateMutexW` `CloseHandle` `GetTempFileNameW` `WaitForMultipleObjects` `CreateEventExW` `GetFullPathNameW` `GetModuleHandleExW` `DecodePointer` `SetEnvironmentVariableW` `HeapQueryInformation` `GetConsoleMode` `SleepEx` `HeapReAlloc` `CommConfigDialogA` `HeapFree` `GetStartupInfoW` `GetUserDefaultUILanguage` `FindNextFileW` `SearchPathW` `TlsAlloc` `InitializeCriticalSection` `GetEnvironmentStringsW` `Process32NextW` `FormatMessageW` `CreateFileW` `SetEvent` `QueryPerformanceCounter` `SetLastError` `GetVolumeInformationW` `GlobalFlags` `ExitProcess` `SetupComm` `TlsGetValue` `GetTempPathW` `QueryPerformanceFrequency` `Sleep` `LocalReAlloc` `LoadLibraryExW` `LocalAlloc` `ExpandEnvironmentStringsA` `GenerateConsoleCtrlEvent` `FreeLibraryAndExitThread` `GetSystemDirectoryA` `CreateDirectoryTransactedA` `ExitThread` `SetStdHandle` `OutputDebugStringA` `GetSystemInfo` `OutputDebugStringW` `GetPrivateProfileIntW` `GetTickCount64` `WritePrivateProfileStructA` `FormatMessageA` `GetModuleFileNameW` `DuplicateHandle` `GlobalAlloc` `GetProfileIntW` `InitializeSListHead` `GetSystemTimeAsFileTime` `LocalFree` `GetModuleHandleA` `GetDriveTypeW` `GetTimeZoneInformation` `GetVersionExW` `TerminateProcess` `GetAtomNameA` `InitializeCriticalSectionEx` `VirtualQuery` `LockResource` `GetFileSize` `ResumeThread` `SignalObjectAndWait` `GetFileAttributesW` `DeleteFileW` `RemoveDirectoryW` `GlobalDeleteAtom` `HeapAlloc` `SetUnhandledExceptionFilter` `GetStdHandle` `SizeofResource` `GetConsoleCP` `CopyFileW` `OpenProcess` `GetConsoleTitleA` `VirtualProtect` `GlobalSize` `GetNLSVersionEx` `WriteFile` `GlobalReAlloc` `FindFirstFileW` `DeleteCriticalSection` `GetFileType` `lstrcpyW` `LockFile` `MulDiv` `GetFileAttributesExW` `PeekNamedPipe` `LeaveCriticalSection` `GetLocaleInfoW` `GetModuleHandleW` `GetSystemDirectoryW` `GetCurrentThread` `GetShortPathNameW` `QueryFullProcessImageNameW` `ReadFile` `GetProcAddress` `GetTickCount` `GlobalLock` `OpenEventA` `InitializeCriticalSectionAndSpinCount` `Thread32Next` `ReadConsoleW` `GetFileSizeEx` `HeapSize` `CompareStringA` `SetFilePointer` `GlobalFindAtomW` `EnterCriticalSection` `FreeEnvironmentStringsW` `WriteConsoleW` `CreateEventW` `GetCommandLineW` `MultiByteToWideChar` `WideCharToMultiByte` `GlobalUnlock` `VirtualAlloc` `VerSetConditionMask` `GetLastError` `CreateProcessW` `CreateThread` `GlobalAddAtomW` `GetProcessHeap` `FindClose` `SetThreadpoolThreadMinimum` `LoadLibraryW` `LeaveCriticalSectionWhenCallbackReturns` `GetFileTime` `RtlUnwind` `WritePrivateProfileStringW` `CreateDirectoryW` `CreateDirectoryExA` `SetErrorMode` `GetFileInformationByHandle` `TlsSetValue` `EncodePointer` `lstrcmpA` `VerifyVersionInfoW` `GetCommandLineA` `FindResourceW` `GlobalGetAtomNameW` `IsDebuggerPresent` `CompareStringW` `FreeLibrary` `lstrcmpiW` `VerifyVersionInfoA`
USER32.dll	`ValidateRect` `GetScrollInfo` `TrackPopupMenu` `TabbedTextOutW` `GetMenuDefaultItem` `GetMenuCheckMarkDimensions` `ShowWindow` `SetCursorPos` `GetDlgCtrlID` `GetSysColorBrush` `CopyAcceleratorTableW` `SetRectEmpty` `DispatchMessageW` `BroadcastSystemMessageExW` `IsCharLowerA` `GetWindowPlacement` `MapVirtualKeyExW` `IsWindowEnabled` `WinHelpW` `GetClassLongW` `SetCapture` `PostQuitMessage` `GetDC` `DestroyMenu` `LoadIconW` `SetMenuItemInfoW` `MapWindowPoints` `EnumDisplayMonitors` `ReleaseCapture` `CallNextHookEx` `SetCursor` `GetMenu` `DestroyWindow` `CheckDlgButton` `SetDlgItemTextW` `MonitorFromPoint` `GetScrollRange` `IsCharLowerW` `WaitMessage` `DestroyAcceleratorTable` `GetDesktopWindow` `InvalidateRect` `SetClassLongW` `EmptyClipboard` `CreatePopupMenu` `CreateIconFromResourceEx` `SetParent` `GetMessageTime` `PeekMessageW` `GetComboBoxInfo` `GetMessagePos` `IsGUIThread` `LockWindowUpdate` `IsClipboardFormatAvailable` `DeferWindowPos` `ModifyMenuW` `SubtractRect` `SetScrollInfo` `DefMDIChildProcW` `UnpackDDElParam` `ReuseDDElParam` `SendMessageW` `SetMenuItemBitmaps` `DrawTextW` `PostThreadMessageW` `CheckMenuItem` `CreateWindowExW` `InsertMenuItemW` `BeginDeferWindowPos` `IntersectRect` `CreateAcceleratorTableW` `DestroyCursor` `MapVirtualKeyW` `GetWindow` `GetPropW` `KillTimer` `MessageBoxW` `DrawStateW` `DeleteMenu` `PostMessageW` `OemKeyScan` `DrawFocusRect` `LoadBitmapW` `CallWindowProcW` `GetActiveWindow` `GetKeyboardState` `GetMonitorInfoW` `InvertRect` `UnionRect` `GetForegroundWindow` `RemovePropW` `GetKeyNameTextW` `CopyImage` `DrawEdge` `RedrawWindow` `GetUpdateRect` `FrameRect` `GetMenuStringW` `IsWindow` `CharUpperBuffW` `SetTimer` `TranslateMDISysAccel` `PtInRect` `UpdateLayeredWindow` `SetForegroundWindow` `GetWindowContextHelpId` `GetSysColor` `ReleaseDC` `SetWindowsHookExW` `IsIconic` `MonitorFromWindow` `SetPropW` `GetClassInfoExW` `ScrollWindow` `OpenClipboard` `GetMenuState` `FindWindowExW` `OffsetRect` `MessageBeep` `SetMenu` `GetMenuItemInfoW` `GetWindowRect` `SetWindowPlacement` `GetMessageW` `SendMessageA` `SystemParametersInfoW` `ClientToScreen` `UpdateWindow` `NotifyWinEvent` `GetClientRect` `DrawIconEx` `GetClassNameW` `SetLayeredWindowAttributes` `GetNextDlgTabItem` `EnumChildWindows` `TranslateAcceleratorW` `MoveWindow` `EndDialog` `GetCursorPos` `ShowScrollBar` `GetMenuItemID` `LoadAcceleratorsW` `EnableWindow` `IsZoomed` `DefWindowProcW` `RealChildWindowFromPoint` `GetSubMenu` `DrawFrameControl` `GetFocus` `IsRectEmpty` `GetWindowTextW` `LoadCursorW` `TranslateMessage` `DestroyIcon` `CopyIcon` `ScreenToClient` `GetWindowTextLengthW` `HideCaret` `SetRect` `IsMenu` `GetSystemMetrics` `GetDoubleClickTime` `SetClipboardData` `SendDlgItemMessageA` `GrayStringW` `RegisterClipboardFormatW` `SetMenuDefaultItem` `GetKeyboardLayout` `BeginPaint` `GetWindowThreadProcessId` `IsDialogMessageW` `GetDlgItem` `InsertMenuW` `CreateMenu` `EnableMenuItem` `OpenIcon` `WindowFromPoint` `MapDialogRect` `AppendMenuW` `GetSystemMenu` `UnhookWindowsHookEx` `EndPaint` `SetWindowLongW` `SetActiveWindow` `CharUpperW` `ToUnicodeEx` `GetParent` `SetScrollRange` `GetNextDlgGroupItem` `IsCharAlphaW` `EndDeferWindowPos` `LoadMenuW` `GetKeyState` `GetWindowLongW` `SetFocus` `FillRect` `GetTopWindow` `RemoveMenu` `SetWindowPos` `BringWindowToTop` `TrackMouseEvent` `GetCapture` `UnregisterClassW` `DrawIcon` `SetWindowRgn` `CopyRect` `GetMenuItemCount` `CreateDesktopA` `CloseClipboard` `GetAsyncKeyState` `GetWindowRgn` `DrawTextExW` `GetLastActivePopup` `AdjustWindowRectEx` `EqualRect` `EnableScrollBar` `InflateRect` `DefFrameProcW` `GetScrollPos` `GetIconInfo` `SetWindowTextW` `RegisterClassW` `IsWindowVisible` `SetScrollPos` `RegisterWindowMessageW` `IsChild` `DrawMenuBar` `GetClassInfoW` `CreateDialogIndirectParamW` `LoadImageW` `ShowOwnedPopups` `GetWindowDC`
GDI32.dll	`StretchBlt` `OffsetViewportOrgEx` `GetViewportExtEx` `GetPaletteEntries` `CreateSolidBrush` `LineTo` `GetBkColor` `SetDIBColorTable` `ExtFloodFill` `GetSystemPaletteEntries` `GetWindowExtEx` `SetROP2` `GetObjectType` `PtInRegion` `RealizePalette` `CreatePatternBrush` `Ellipse` `CreateDCW` `OffsetRgn` `Polyline` `GetNearestPaletteIndex` `MoveToEx` `CreateDIBSection` `GetStockObject` `BitBlt` `DeleteDC` `GetTextExtentPoint32W` `GetLayout` `SetPolyFillMode` `ExtSelectClipRgn` `CreateCompatibleDC` `RestoreDC` `GetBoundsRect` `CreateHatchBrush` `GetWindowOrgEx` `CopyMetaFileW` `ExtTextOutW` `CreatePolygonRgn` `CreateFontIndirectW` `TextOutW` `DPtoLP` `RoundRect` `EnumFontFamiliesW` `CreateDIBitmap` `GetObjectW` `CreateRoundRectRgn` `GetPixel` `CreateRectRgnIndirect` `SetTextColor` `CreateEllipticRgn` `IntersectClipRect` `SetPaletteEntries` `CreateCompatibleBitmap` `CreateBitmap` `SetBkMode` `SelectObject` `GetTextMetricsW` `RectVisible` `SetPixel` `SetViewportOrgEx` `OffsetWindowOrgEx` `GetTextColor` `GetViewportOrgEx` `CombineRgn` `CreateRectRgn` `SelectClipRgn` `SetMapMode` `FrameRgn` `PtVisible` `PatBlt` `CreatePen` `GetDeviceCaps` `FillRgn` `SetBkColor` `SetPixelV` `GetDIBits` `SelectPalette` `SetTextAlign` `ExcludeClipRect` `Rectangle` `SaveDC` `LPtoDP` `SetLayout` `GetTextFaceW` `Escape` `SetViewportExtEx` `Polygon` `CreatePalette` `GetRgnBox` `GetTextCharsetInfo` `ScaleViewportExtEx` `SetWindowOrgEx` `ScaleWindowExtEx` `DeleteObject` `SetRectRgn` `EnumFontFamiliesExW` `GetClipBox` `SetWindowExtEx`
MSIMG32.dll	`TransparentBlt` `AlphaBlend`
WINSPOOL.DRV	`DocumentPropertiesW` `OpenPrinterW` `ClosePrinter`
ADVAPI32.dll	`RegDeleteKeyTransactedA` `RegConnectRegistryExW` `CryptDestroyHash` `RegEnumValueW` `OpenProcessToken` `CryptAcquireContextA` `PerfStartProvider` `RegSetKeySecurity` `RegQueryValueW` `BuildImpersonateTrusteeA` `ObjectPrivilegeAuditAlarmW` `LookupPrivilegeValueW` `RegDeleteValueW` `AllocateAndInitializeSid` `BuildTrusteeWithSidA` `AdjustTokenGroups` `RegOpenKeyExW` `FreeSid` `DestroyPrivateObjectSecurity` `CryptReleaseContext` `OpenEncryptedFileRawA` `RegEnumKeyExW` `RegEnumKeyW` `ObjectDeleteAuditAlarmA` `AdjustTokenPrivileges` `RegDeleteKeyW` `ConvertStringSecurityDescriptorToSecurityDescriptorA` `RegSetValueExW` `AddAuditAccessAce` `CryptGenRandom` `CryptCreateHash` `FindFirstFreeAce` `CryptHashData` `BackupEventLogW` `RegCloseKey` `RegReplaceKeyW` `CryptDestroyKey` `RegQueryValueExW` `RegSetValueA` `IsTokenRestricted` `RegCreateKeyExW` `CryptImportKey` `CryptGetHashParam` `CryptEncrypt` `ObjectCloseAuditAlarmW`
SHELL32.dll	`ExtractIconExW` `ShellExecuteW` `SHGetPathFromIDListW` `ShellExecuteExW` `SHAppBarMessage` `SHGetFileInfoW` `SHGetMalloc` `SHGetSpecialFolderPathW` `SHBrowseForFolderW` `SHGetDesktopFolder` `#63` `SHGetDataFromIDListA` `#42` `DragQueryFileW` `DragFinish` `SHGetSpecialFolderLocation` `CommandLineToArgvW`
COMCTL32.dll	`InitCommonControlsEx`
SHLWAPI.dll	`PathAppendW` `PathRelativePathToA` `PathFindExtensionW` `PathIsUNCW` `PathStripToRootW` `StrCatW` `StrSpnW` `#15` `#462` `PathIsRootW` `UrlIsNoHistoryW` `ColorHLSToRGB` `PathRemoveFileSpecW` `PathFindFileNameW` `PathFileExistsW` `UrlIsW` `PathStripPathW` `StrFormatKBSizeW`
UxTheme.dll	`GetThemePartSize` `IsThemeBackgroundPartiallyTransparent` `OpenThemeData` `IsAppThemed` `GetThemeColor` `CloseThemeData` `DrawThemeText` `DrawThemeBackground` `GetCurrentThemeName` `DrawThemeParentBackground` `GetWindowTheme` `GetThemeSysColor`
ole32.dll	`OleDuplicateData` `CoInitializeSecurity` `CoInitializeEx` `CoUninitialize` `OleGetClipboard` `CoTaskMemAlloc` `CoCreateGuid` `CoCreateInstance` `CoDisconnectObject` `CreateStreamOnHGlobal` `OleTranslateAccelerator` `OleDestroyMenuDescriptor` `CoTaskMemFree` `CoInitialize` `ReleaseStgMedium` `DoDragDrop` `OleLockRunning` `IsAccelerator` `RevokeDragDrop` `CoLockObjectExternal` `OleCreateMenuDescriptor` `RegisterDragDrop`
OLEAUT32.dll	`#4` `#6` `#2` `#337` `#211` `#346` `#238` `#147` `#77` `#16` `#303` `#177` `#167` `#185` `#8` `#10` `#114` `#9` `#12` `#7` `#161` `#184`
gdiplus.dll	`GdipDrawImageI` `GdipGetImageHeight` `GdipFree` `GdipGetImageGraphicsContext` `GdipCreateBitmapFromHBITMAP` `GdipDeleteGraphics` `GdipGetImagePaletteSize` `GdipDrawImageRectI` `GdipCloneImage` `GdipCreateBitmapFromStream` `GdipCreateFromHDC` `GdipSetInterpolationMode` `GdipGetImagePalette` `GdipDisposeImage` `GdipBitmapLockBits` `GdiplusShutdown` `GdipGetImageWidth` `GdipCreateBitmapFromScan0` `GdipAlloc` `GdipGetImagePixelFormat` `GdipBitmapUnlockBits` `GdiplusStartup`
WS2_32.dll	`#14` `#8` `#57` `#10` `#20` `#17` `#13` `#1` `WSAIoctl` `getaddrinfo` `freeaddrinfo` `#23` `#21` `#15` `#9` `#7` `#115` `#116` `#111` `#151` `#18` `#112` `#16` `#19` `#2` `#3` `#4` `#5` `#6`
CRYPT32.dll	`CertFreeCertificateContext`
WLDAP32.dll	`#79` `#200` `#33` `#32` `#27` `#35` `#30` `#301` `#26` `#22` `#41` `#50` `#45` `#60` `#46` `#143` `#211`
Normaliz.dll	`IdnToAscii`
WTSAPI32.dll	`WTSShutdownSystem` `WTSEnumerateProcessesW` `WTSVirtualChannelClose` `WTSVirtualChannelPurgeInput` `WTSVirtualChannelRead`
OLEACC.dll	`LresultFromObject` `AccessibleObjectFromWindow` `CreateStdAccessibleObject`
IMM32.dll	`ImmGetOpenStatus` `ImmGetContext` `ImmReleaseContext`
WINMM.dll	`PlaySoundW`

Delayed Imports

1

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x42028`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.30233`
MD5	`06b6119cbfb0b1c5f6bddac1d2b7c8e1`
SHA1	`c61ca692bd0b9f7f1271123f32777f8d95cbd950`
SHA256	`e4c3be8056f8937d56d74a086fb0ef9fae6bba2088683098d5f71d8b71913700`
SHA3	`58bafa7d1ef53709318a4ce4f8414a527836edeec2bacaedfa02bc15e7ae07b9`

2

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x10828`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.34521`
MD5	`32a582f48d83b18b5689fe0a328c58db`
SHA1	`0c16dac110a0e0633f8f39ad21a81c62bdf72a24`
SHA256	`756c27843f325e43c9b681a1fcd763466435f4efdd5c3a080808854010ef7c73`
SHA3	`1b2fb9c24d3ad054f5a5c20352435393c081e2902851c8443870866f851abcdd`

3

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x25a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.55707`
MD5	`e1c4a122f63bc1958726936a625041d1`
SHA1	`e1640db882e814be1adf66051c417d25985b0aab`
SHA256	`8e65a77886736303b7d50e6942e0bbc0c870eedf6ba056b25fbb303e05b8bce0`
SHA3	`40b2b2283c1604ea1b078164b9dd58546cfc7e34d9ceca7628f4533ba04618bd`

4

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x10a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.54633`
MD5	`813187d63f94bb98563ff43a8907f27c`
SHA1	`ecc1bb5ae93ff9ddd5c6e2c8ac2e402bd07b784d`
SHA256	`3e0206e0013d8f7be3f71dcc3a20003f7b5e3045baf097be864ac49934a6e579`
SHA3	`5990a8e929d30f938fa117dcb8e7dbd09ab3931191c11daf6eb99ec0bc5ec2e4`

5

Type	`RT_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x468`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.51751`
MD5	`43f1f436fe5d7d132595f57c5da6dd1e`
SHA1	`e26802b492e1ef4cb5eff32daaefd77f3faea460`
SHA256	`05d04c1a9c32228a4466a700ba3178e841f0eb0253062c89be80cbb3503c61de`
SHA3	`24b380f8cf9b924c456cfdedab97d9cd8cfa585bde9c157a7182673ca48c3fb8`

102

Type	`RT_DIALOG`
Language	English - United States
Codepage	UNKNOWN
Size	`0xd2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.16908`
MD5	`3e01ea09a24a6da28ed2db9d50a30084`
SHA1	`d26b9002e2e3b61906fa78cec66e82dc8d436ad6`
SHA256	`517e9a4f2b40027da3e4c3fc1c908b2ffd431c4baa5b606249cb32e667e7f289`
SHA3	`10cbf7d7e81b408a8c4e46d7fc2fca1d8d536b62787fe50354aff1e429da040d`

128

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	UNKNOWN
Size	`0x4c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.6474`
Detected Filetype	Icon file
MD5	`d64020e1074b6df9dc2c4bb34320134d`
SHA1	`583f4547f7d22568d7035a7c357157ee83dbf604`
SHA256	`40daebf4311b90eab9709571698979bbd161a7018b6eac1a18798cd10598b026`
SHA3	`06ef6158b6876e799ff82d58bae2e315c9accfd48ef61fd3cc5474cb17a735ec`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x32c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.41708`
MD5	`5e8faf96772717bc9baf161599e26a27`
SHA1	`5bd66347ecba83ddaada7a0aef3ece104c09600b`
SHA256	`b812a0be5d747a383756622f8f45ddf5ddbef9e428f6126da549295df0dfb5d3`
SHA3	`fc5d962e3246c0f0208b2c81c82521669d52c57f076bbeaade26b7a847aceaea`

1 (#3)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	UNKNOWN
Size	`0x7b6`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.17402`
MD5	`d7199aae26127c14e7362a3825f10aa7`
SHA1	`5ed9b1cbb7246095aed412acc181363b9675f538`
SHA256	`877bc691a7767b3c49abee05c0ee7e0c19612a1df65c95bc917117402290ccd7`
SHA3	`3a91a70bf2bad182494091853affd83af378b1d63172149e3f7f8a307580659c`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.3.9.7
ProductVersion	1.3.9.7
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	Chogolisa Company
FileDescription	Chogolisa Purview Install
FileVersion (#2)	1.3.9.7
InternalName	ChogolisaPurviewInstall.exe
LegalCopyright	Copyright 2020
OriginalFilename	ChogolisaPurviewInstall.exe
ProductName	ChogolisaPurviewInstall
ProductVersion (#2)	1.3.9.7

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2021-Jan-28 16:48:47
Version	`0.0`
SizeofData	`1120`
AddressOfRawData	`0x2252fc`
PointerToRawData	`0x2224fc`

TLS Callbacks

StartAddressOfRawData	`0x62576c`
EndAddressOfRawData	`0x625774`
AddressOfIndex	`0x6493d4`
AddressOfCallbacks	`0x5d6054`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0xbc`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x641058`
SEHandlerTable	`0x623b14`
SEHandlerCount	`1530`

RICH Header

XOR Key	`0xcbde03d8`
Unmarked objects	`0`
ASM objects (26715)	`28`
Imports (65501)	`8`
C objects (VS2015 UPD3.1 build 24215)	`99`
199 (41118)	`6`
C objects (26715)	`33`
C++ objects (26715)	`209`
262 (26715)	`2`
Imports (26715)	`37`
Total imports	`930`
C objects (VS 2015/2017/2019 runtime 29118)	`20`
ASM objects (VS 2015/2017/2019 runtime 29118)	`26`
C++ objects (VS 2015/2017/2019 runtime 29118)	`357`
C++ objects (VS2019 Update 8 (16.8.4) compiler 29336)	`14`
Resource objects (VS2019 Update 8 (16.8.4) compiler 29336)	`1`
151	`1`
Linker (VS2019 Update 8 (16.8.4) compiler 29336)	`1`

Errors

[*] Warning: [plugin_authenticode] Error reading the PKCS7 certificate.