pcworldpro[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

pcworldpro.zip
Size

44.0MB
MD5

6f3d04a3d775709f956d8e4a9c68ec04
SHA1

2dab665a16ad0ee949f30f8ffeddc9dd5f1a54d8
SHA256

be45b2950d1e3142a44a3f9eba82bb49a2e6f0782b188dcab492bfadbfa8a103
SHA512

d40c930439730e5bb298a29b0e1544b57f2761f62e3c4361c101ca4769c5f209a8be602e06bc370de4ee04a43d68ff323753d30752902a5a831be6fa928a0a0d
SSDEEP

786432:lAEWabHRVGjufgcxlDOlU5UxxLkz/jMlzNuGknEElEuMb2d/b2dmx:bW+xQmgylD1XLIlNuGknEEldDY4x

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/pcworldpro/Data/TabS.ocx	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/pcworldpro/Data/TabS.ocx	upx

Files

pcworldpro.zip
.zip
pcworldpro/Data/QtCore4.dll
.dll windows x86

ab8e1e9eb2026051e03c52024771ef37

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

libgcc_s_dw2-1

_Unwind_DeleteException
_Unwind_GetDataRelBase
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
__deregister_frame_info
__divdi3
__emutls_get_address
__moddi3
__register_frame_info
__udivdi3
__umoddi3

advapi32

CopySid
FreeSid
GetLengthSid
GetTokenInformation
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW

kernel32

CloseHandle
CompareStringW
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileMappingW
CreateFileW
CreatePipe
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationW
FindFirstFileExW
FindFirstFileW
FindNextChangeNotification
FindNextFileW
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetCommandLineW
GetCurrencyFormatW
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLogicalDrives
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetStartupInfoW
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetTempPathW
GetThreadPriority
GetTickCount
GetTimeFormatW
GetUserDefaultLCID
GetUserDefaultUILanguage
GetVersionExW
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileW
MultiByteToWideChar
OpenFileMappingW
OutputDebugStringW
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
ResumeThread
SetCurrentDirectoryW
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetFilePointerEx
SetLastError
SetThreadPriority
Sleep
SwitchToThread
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnmapViewOfFile
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile

mingwm10

__mingwthr_key_dtor

msvcrt

_close
_lseek
_open
_putenv
_read
_write
__dllonexit
__lc_codepage
__mb_cur_max
__p__environ
_assert
_beginthreadex
_clearfp
_close
_control87
_endthreadex
_errno
_filelengthi64
_get_osfhandle
_getdrive
_iob
_isctype
_lseeki64
_open_osfhandle
_pctype
_read
_tzname
_tzset
_vsnprintf
_waccess
_wchmod
_wgetdcwd
_wgetenv
_write
abort
acos
asin
atan2
calloc
ceil
cos
fclose
fflush
fgetpos
fgets
floor
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getenv
gmtime
localeconv
localtime
malloc
memchr
memcmp
memmove
memset
mktime
pow
printf
puts
rand
realloc
sin
sprintf
sqrt
srand
strcat
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
wcschr
wcslen

ole32

CoCreateGuid
CoCreateInstance
CoInitialize
CoUninitialize

user32

CallNextHookEx
CharNextExA
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EnumWindows
GetMessageW
GetQueueStatus
GetWindowLongW
GetWindowThreadProcessId
KillTimer
MsgWaitForMultipleObjectsEx
PeekMessageW
PostMessageW
PostThreadMessageW
RegisterClassW
SetTimer
SetWindowLongW
SetWindowsHookExW
TranslateMessage
UnhookWindowsHookEx
UnregisterClassW

ws2_32

WSAAsyncSelect

Exports

Exports

_Z10forcepointR11QTextStream
_Z10noshowbaseR11QTextStream
_Z10qAllocMoreii
_Z10qHBNewFacePvPF8HB_ErrorS_jPhPjE
_Z10qShapeItemP14HB_ShaperItem_
_Z10qvsnprintfPcjPKcS_
_Z10scientificR11QTextStream
_Z11noforcesignR11QTextStream
_Z11qHBFreeFaceP11HB_FaceRec_
_Z11qUncompressPKhi
_Z11qWinAppInstv
_Z11qt_assert_xPKcS0_S0_i
_Z11qt_int_sqrtj
_Z12noforcepointR11QTextStream
_Z12qAppFileNamev
_Z12qFreeAlignedPv
_Z12qInstallPathv
_Z12qSharedBuildv
_Z13lowercasebaseR11QTextStream
_Z13qErrnoWarningPKcz
_Z13qErrnoWarningiPKcz
_Z13qFlagLocationPKc
_Z13uppercasebaseR11QTextStream
_Z13winGetMessageP6tagMSGP6HWND__jj
_Z14qDecodeDataUrlRK4QUrl
_Z14qMallocAlignedjj
_Z14qSystemWarningPKci
_Z14qWinAppCmdShowv
_Z14qWinMsgHandler9QtMsgTypePKc
_Z14winPeekMessageP6tagMSGP6HWND__jjj
_Z14winPostMessageP6HWND__jjl
_Z15lowercasedigitsR11QTextStream
_Z15qAddPostRoutinePFvvE
_Z15qInitResourceIOv
_Z15qIsEffectiveTLDRK7QString
_Z15qReallocAlignedPvjjj
_Z15qTopLevelDomainRK7QString
_Z15qWinAppPrevInstv
_Z15qt_error_stringi
_Z15uppercasedigitsR11QTextStream
_Z16qInstallPathBinsv
_Z16qInstallPathDatav
_Z16qInstallPathDocsv
_Z16qInstallPathLibsv
_Z16qt_check_pointerPKci
_Z17qt_localeFromLCIDm
_Z17qt_message_output9QtMsgTypePKc
_Z18qDetectCPUFeaturesv
_Z18qGetCharAttributesPKtjPK13HB_ScriptItemjP17HB_CharAttributes
_Z18qInstallMsgHandlerPFv9QtMsgTypePKcE
_Z18qRemovePostRoutinePFvvE
_Z19qInstallPathHeadersv
_Z19qInstallPathPluginsv
_Z19qInstallPathSysconfv
_Z19qcoreVariantHandlerv
_Z20qt_qFindChild_helperPK7QObjectRK7QStringRK11QMetaObject
_Z21qDeleteInEventHandlerP7QObject
_Z21qRegisterResourceDataiPKhS0_S0_
_Z21qt_call_post_routinesv
_Z21qt_regexp_toCanonicalRK7QStringN7QRegExp13PatternSyntaxE
_Z23qUnregisterResourceDataiPKhS0_S0_
_Z23qt_qFindChildren_helperPK7QObjectRK7QStringPK7QRegExpRK11QMetaObjectP5QListIPvE
_Z24qGlobalPostedEventsCountv
_Z24qInstallPathTranslationsv
_Z24qcoreStateMachineHandlerv
_Z2wsR11QTextStream
_Z32qt_register_signal_spy_callbacksRK21QSignalSpyCallbackSet
_Z37qRegisterStaticPluginInstanceFunctionPFP7QObjectvE
_Z3binR11QTextStream
_Z3bomR11QTextStream
_Z3decR11QTextStream
_Z3hexR11QTextStream
_Z3octR11QTextStream
_Z4endlR11QTextStream
_Z4leftR11QTextStream
_Z4qInfv
_Z5fixedR11QTextStream
_Z5flushR11QTextStream
_Z5qFreePv
_Z5qHashRK10QByteArray
_Z5qHashRK10QStringRef
_Z5qHashRK7QString
_Z5qHashRK9QBitArray
_Z5qQNaNv
_Z5qSNaNv
_Z5qdtoadiiPiS_PPcS1_
_Z5qrandv
_Z5resetR11QTextStream
_Z5rightR11QTextStream
_Z6centerR11QTextStream
_Z6qDebugPKcz
_Z6qDebugv
_Z6qFatalPKcz
_Z6qIsInfd
_Z6qIsInff
_Z6qIsNaNd
_Z6qIsNaNf
_Z6qsrandj
_Z6qtTrIdPKci
_Z7qMallocj
_Z7qMemSetPvij
_Z7qgetenvPKc
_Z7qputenvPKcRK10QByteArray
_Z7qstrcmpPKcS0_
_Z7qstrcmpRK10QByteArrayPKc
_Z7qstrcmpRK10QByteArrayS1_
_Z7qstrcpyPcPKc
_Z7qstrdupPKc
_Z7qstrtodPKcPS0_Pb
_Z8qAppNamev
_Z8qMemCopyPvPKvj
_Z8qReallocPvj
_Z8qVersionv
_Z8qWarningPKcz
_Z8qWarningv
_Z8qWinMainP11HINSTANCE__S0_PciRiR7QVectorIS1_E
_Z8qstricmpPKcS0_
_Z8qstrncpyPcPKcj
_Z8showbaseR11QTextStream
_Z9decodeMSGRK6tagMSG
_Z9forcesignR11QTextStream
_Z9qBadAllocv
_Z9qChecksumPKcj
_Z9qCompressPKhii
_Z9qCriticalPKcz
_Z9qIsFinited
_Z9qIsFinitef
_Z9qsnprintfPcjPKcz
_Z9qstrnicmpPKcS0_j
_Z9qt_assertPKcS0_i
_ZN10QByteArray10fromBase64ERKS_
_ZN10QByteArray10setRawDataEPKcj
_ZN10QByteArray11fromRawDataEPKci
_ZN10QByteArray11shared_nullE
_ZN10QByteArray12shared_emptyE
_ZN10QByteArray19fromPercentEncodingERKS_c
_ZN10QByteArray4chopEi
_ZN10QByteArray4dataEv
_ZN10QByteArray4fillEci
_ZN10QByteArray5clearEv
_ZN10QByteArray6appendEPKc
_ZN10QByteArray6appendEPKci
_ZN10QByteArray6appendERKS_
_ZN10QByteArray6appendEc
_ZN10QByteArray6expandEi
_ZN10QByteArray6insertEiPKc
_ZN10QByteArray6insertEiPKci
_ZN10QByteArray6insertEiRKS_
_ZN10QByteArray6insertEic
_ZN10QByteArray6numberEdci
_ZN10QByteArray6numberEii
_ZN10QByteArray6numberEji
_ZN10QByteArray6numberExi
_ZN10QByteArray6numberEyi
_ZN10QByteArray6removeEii
_ZN10QByteArray6resizeEi
_ZN10QByteArray6setNumEdci
_ZN10QByteArray6setNumExi
_ZN10QByteArray6setNumEyi
_ZN10QByteArray7fromHexERKS_
_ZN10QByteArray7prependEPKc
_ZN10QByteArray7prependEPKci
_ZN10QByteArray7prependERKS_
_ZN10QByteArray7prependEc
_ZN10QByteArray7reallocEi
_ZN10QByteArray7replaceEPKcRKS_
_ZN10QByteArray7replaceEPKciS1_i
_ZN10QByteArray7replaceERKS_S1_
_ZN10QByteArray7replaceEcRKS_
_ZN10QByteArray7replaceEcc
_ZN10QByteArray7replaceEiiPKc
_ZN10QByteArray7replaceEiiPKci
_ZN10QByteArray7replaceEiiRKS_
_ZN10QByteArray8truncateEi
_ZN10QByteArrayC1EPKc
_ZN10QByteArrayC1EPKci
_ZN10QByteArrayC1EiN2Qt14InitializationE
_ZN10QByteArrayC1Eic
_ZN10QByteArrayC2EPKc
_ZN10QByteArrayC2EPKci
_ZN10QByteArrayC2EiN2Qt14InitializationE
_ZN10QByteArrayC2Eic
_ZN10QByteArrayD1Ev
_ZN10QByteArrayaSEPKc
_ZN10QByteArrayaSERKS_
_ZN10QEventLoop11qt_metacallEN11QMetaObject4CallEiPPv
_ZN10QEventLoop11qt_metacastEPKc
_ZN10QEventLoop13processEventsE6QFlagsINS_17ProcessEventsFlagEE
_ZN10QEventLoop13processEventsE6QFlagsINS_17ProcessEventsFlagEEi
_ZN10QEventLoop16staticMetaObjectE
_ZN10QEventLoop18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
_ZN10QEventLoop25staticMetaObjectExtraDataE
_ZN10QEventLoop4execE6QFlagsINS_17ProcessEventsFlagEE
_ZN10QEventLoop4exitEi
_ZN10QEventLoop4quitEv
_ZN10QEventLoop6wakeUpEv
_ZN10QEventLoopC1EP7QObject
_ZN10QEventLoopC2EP7QObject
_ZN10QEventLoopD0Ev
_ZN10QEventLoopD1Ev
_ZN10QEventLoopD2Ev
_ZN10QMutexPool11createMutexEi
_ZN10QMutexPool17globalInstanceGetEPKv
_ZN10QMutexPool8instanceEv
_ZN10QMutexPoolC1EN6QMutex13RecursionModeEi
_ZN10QMutexPoolC2EN6QMutex13RecursionModeEi
_ZN10QMutexPoolD1Ev
_ZN10QMutexPoolD2Ev
_ZN10QSemaphore10tryAcquireEi
_ZN10QSemaphore10tryAcquireEii
_ZN10QSemaphore7acquireEi
_ZN10QSemaphore7releaseEi
_ZN10QSemaphoreC1Ei
_ZN10QSemaphoreC2Ei
_ZN10QSemaphoreD1Ev
_ZN10QSemaphoreD2Ev
_ZN10QTextCodec11codecForMibEi
_ZN10QTextCodec11validCodecsEv
_ZN10QTextCodec12codecForHtmlERK10QByteArray
_ZN10QTextCodec12codecForHtmlERK10QByteArrayPS_
_ZN10QTextCodec12codecForNameEPKc
_ZN10QTextCodec12codecForNameERK10QByteArray
_ZN10QTextCodec13availableMibsEv
_ZN10QTextCodec14ConverterStateD1Ev
_ZN10QTextCodec14ConverterStateD2Ev
_ZN10QTextCodec14codecForLocaleEv
_ZN10QTextCodec15availableCodecsEv
_ZN10QTextCodec15codecForUtfTextERK10QByteArray
_ZN10QTextCodec15codecForUtfTextERK10QByteArrayPS_
_ZN10QTextCodec17setCodecForLocaleEPS_
_ZN10QTextCodec4cftrE
_ZN10QTextCodec6localeEv
_ZN10QTextCodecC1Ev
_ZN10QTextCodecC2Ev
_ZN10QTextCodecD0Ev
_ZN10QTextCodecD1Ev
_ZN10QTextCodecD2Ev
_ZN11QBasicTimer4stopEv
_ZN11QBasicTimer5startEiP7QObject
_ZN11QBasicTimerD1Ev
_ZN11QChildEventC1EN6QEvent4TypeEP7QObject
_ZN11QChildEventC2EN6QEvent4TypeEP7QObject
_ZN11QChildEventD0Ev
_ZN11QChildEventD1Ev
_ZN11QChildEventD2Ev
_ZN11QDataStream10writeBytesEPKcj
_ZN11QDataStream11readRawDataEPci
_ZN11QDataStream11resetStatusEv
_ZN11QDataStream11skipRawDataEi
_ZN11QDataStream11unsetDeviceEv
_ZN11QDataStream12setByteOrderENS_9ByteOrderE
_ZN11QDataStream12writeRawDataEPKci
_ZN11QDataStream25setFloatingPointPrecisionENS_22FloatingPointPrecisionE
_ZN11QDataStream9readBytesERPcRj
_ZN11QDataStream9setDeviceEP9QIODevice
_ZN11QDataStream9setStatusENS_6StatusE
_ZN11QDataStreamC1EP10QByteArray6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QDataStreamC1EP10QByteArrayi
_ZN11QDataStreamC1EP9QIODevice
_ZN11QDataStreamC1ERK10QByteArray
_ZN11QDataStreamC1Ev
_ZN11QDataStreamC2EP10QByteArray6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QDataStreamC2EP10QByteArrayi
_ZN11QDataStreamC2EP9QIODevice
_ZN11QDataStreamC2ERK10QByteArray
_ZN11QDataStreamC2Ev
_ZN11QDataStreamD0Ev
_ZN11QDataStreamD1Ev
_ZN11QDataStreamD2Ev
_ZN11QDataStreamlsEPKc
_ZN11QDataStreamlsEa
_ZN11QDataStreamlsEb
_ZN11QDataStreamlsEd
_ZN11QDataStreamlsEf
_ZN11QDataStreamlsEi
_ZN11QDataStreamlsEs
_ZN11QDataStreamlsEx
_ZN11QDataStreamrsERPc
_ZN11QDataStreamrsERa
_ZN11QDataStreamrsERb
_ZN11QDataStreamrsERd
_ZN11QDataStreamrsERf
_ZN11QDataStreamrsERi
_ZN11QDataStreamrsERs
_ZN11QDataStreamrsERx
_ZN11QFinalState11qt_metacallEN11QMetaObject4CallEiPPv
_ZN11QFinalState11qt_metacastEPKc
_ZN11QFinalState16staticMetaObjectE
_ZN11QFinalState18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
_ZN11QFinalState25staticMetaObjectExtraDataE
_ZN11QFinalState5eventEP6QEvent
_ZN11QFinalState6onExitEP6QEvent
_ZN11QFinalState7onEntryEP6QEvent
_ZN11QFinalStateC1EP6QState
_ZN11QFinalStateC2EP6QState
_ZN11QFinalStateD0Ev
_ZN11QFinalStateD1Ev
_ZN11QFinalStateD2Ev
_ZN11QMetaObject10disconnectEPK7QObjectiS2_i
_ZN11QMetaObject11changeGuardEPP7QObjectS1_
_ZN11QMetaObject11removeGuardEPP7QObject
_ZN11QMetaObject12invokeMethodEP7QObjectPKcN2Qt14ConnectionTypeE22QGenericReturnArgument16QGenericArgumentS7_S7_S7_S7_S7_S7_S7_S7_S7_
_ZN11QMetaObject13disconnectOneEPK7QObjectiS2_i
_ZN11QMetaObject14normalizedTypeEPKc
_ZN11QMetaObject16checkConnectArgsEPKcS1_
_ZN11QMetaObject18connectSlotsByNameEP7QObject
_ZN11QMetaObject19normalizedSignatureEPKc
_ZN11QMetaObject7connectEPK7QObjectiS2_iiPi
_ZN11QMetaObject8activateEP7QObjectPKS_iPPv
_ZN11QMetaObject8activateEP7QObjectPKS_iiPPv
_ZN11QMetaObject8activateEP7QObjectiPPv
_ZN11QMetaObject8activateEP7QObjectiiPPv
_ZN11QMetaObject8addGuardEPP7QObject
_ZN11QMetaObject8metacallEP7QObjectNS_4CallEiPPv
_ZN11QReadLockerC1EP14QReadWriteLock
_ZN11QReadLockerD1Ev
_ZN11QTextStream10setPadCharE5QChar
_ZN11QTextStream11resetStatusEv
_ZN11QTextStream11setEncodingENS_8EncodingE
_ZN11QTextStream13flagsInternalEi
_ZN11QTextStream13setFieldWidthEi
_ZN11QTextStream14setIntegerBaseEi
_ZN11QTextStream14setNumberFlagsE6QFlagsINS_10NumberFlagEE
_ZN11QTextStream14skipWhiteSpaceEv
_ZN11QTextStream17setFieldAlignmentENS_14FieldAlignmentE
_ZN11QTextStream20setAutoDetectUnicodeEb
_ZN11QTextStream21setRealNumberNotationENS_18RealNumberNotationE
_ZN11QTextStream22setRealNumberPrecisionEi
_ZN11QTextStream24setGenerateByteOrderMarkEb
_ZN11QTextStream4readEx
_ZN11QTextStream4seekEx
_ZN11QTextStream5flushEv
_ZN11QTextStream5resetEv
_ZN11QTextStream7readAllEv
_ZN11QTextStream8readLineEx
_ZN11QTextStream8setCodecEP10QTextCodec
_ZN11QTextStream8setCodecEPKc
_ZN11QTextStream9setDeviceEP9QIODevice
_ZN11QTextStream9setLocaleERK7QLocale
_ZN11QTextStream9setStatusENS_6StatusE
_ZN11QTextStream9setStringEP7QString6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QTextStreamC1EP10QByteArray6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QTextStreamC1EP6_iobuf6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QTextStreamC1EP7QString6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QTextStreamC1EP9QIODevice
_ZN11QTextStreamC1ERK10QByteArray6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QTextStreamC1Ev
_ZN11QTextStreamC2EP10QByteArray6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QTextStreamC2EP6_iobuf6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QTextStreamC2EP7QString6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QTextStreamC2EP9QIODevice
_ZN11QTextStreamC2ERK10QByteArray6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QTextStreamC2Ev
_ZN11QTextStreamD0Ev
_ZN11QTextStreamD1Ev
_ZN11QTextStreamD2Ev
_ZN11QTextStreamlsE5QBool
_ZN11QTextStreamlsE5QChar
_ZN11QTextStreamlsEPKc
_ZN11QTextStreamlsEPKv
_ZN11QTextStreamlsERK10QByteArray
_ZN11QTextStreamlsERK7QString
_ZN11QTextStreamlsEc
_ZN11QTextStreamlsEd
_ZN11QTextStreamlsEf
_ZN11QTextStreamlsEi
_ZN11QTextStreamlsEj
_ZN11QTextStreamlsEl
_ZN11QTextStreamlsEm
_ZN11QTextStreamlsEs
_ZN11QTextStreamlsEt
_ZN11QTextStreamlsEx
_ZN11QTextStreamlsEy
_ZN11QTextStreamrsEPc
_ZN11QTextStreamrsER10QByteArray
_ZN11QTextStreamrsER5QChar
_ZN11QTextStreamrsER7QString
_ZN11QTextStreamrsERc
_ZN11QTextStreamrsERd
_ZN11QTextStreamrsERf
_ZN11QTextStreamrsERi
_ZN11QTextStreamrsERj
_ZN11QTextStreamrsERl
_ZN11QTextStreamrsERm
_ZN11QTextStreamrsERs
_ZN11QTextStreamrsERt
_ZN11QTextStreamrsERx
_ZN11QTextStreamrsERy
_ZN11QThreadPool11qt_metacallEN11QMetaObject4CallEiPPv
_ZN11QThreadPool11qt_metacastEPKc
_ZN11QThreadPool11waitForDoneEi
_ZN11QThreadPool11waitForDoneEv
_ZN11QThreadPool13releaseThreadEv
_ZN11QThreadPool13reserveThreadEv
_ZN11QThreadPool14globalInstanceEv
_ZN11QThreadPool16setExpiryTimeoutEi
_ZN11QThreadPool16staticMetaObjectE
_ZN11QThreadPool17setMaxThreadCountEi
_ZN11QThreadPool18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
_ZN11QThreadPool25staticMetaObjectExtraDataE
_ZN11QThreadPool5startEP9QRunnablei
_ZN11QThreadPool8tryStartEP9QRunnable
_ZN11QThreadPoolC1EP7QObject
_ZN11QThreadPoolC2EP7QObject
_ZN11QThreadPoolD0Ev
_ZN11QThreadPoolD1Ev
_ZN11QThreadPoolD2Ev
_ZN11QTimerEventC1Ei
_ZN11QTimerEventC2Ei
_ZN11QTimerEventD0Ev
_ZN11QTimerEventD1Ev
_ZN11QTimerEventD2Ev
_ZN11QTranslator11qt_metacallEN11QMetaObject4CallEiPPv
_ZN11QTranslator11qt_metacastEPKc
_ZN11QTranslator16staticMetaObjectE
_ZN11QTranslator18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
_ZN11QTranslator25staticMetaObjectExtraDataE
_ZN11QTranslator4loadEPKhi
_ZN11QTranslator4loadERK7QLocaleRK7QStringS5_S5_S5_
_ZN11QTranslator4loadERK7QStringS2_S2_S2_
_ZN11QTranslatorC1EP7QObject
_ZN11QTranslatorC1EP7QObjectPKc
_ZN11QTranslatorC2EP7QObject
_ZN11QTranslatorC2EP7QObjectPKc
_ZN11QTranslatorD0Ev
_ZN11QTranslatorD1Ev
_ZN11QTranslatorD2Ev
_ZN11QVectorData10reallocateEPS_iii
_ZN11QVectorData11shared_nullE
_ZN11QVectorData4freeEPS_i
_ZN11QVectorData4growEiiib
_ZN11QVectorData6mallocEiiiPS_
_ZN11QVectorData8allocateEii
_ZN12QCustomEventC1EiPv
_ZN12QCustomEventC2EiPv
_ZN12QCustomEventD0Ev
_ZN12QCustomEventD1Ev
_ZN12QCustomEventD2Ev
_ZN12QDirIterator4nextEv
_ZN12QDirIteratorC1ERK4QDir6QFlagsINS_12IteratorFlagEE
_ZN12QDirIteratorC1ERK7QString6QFlagsIN4QDir6FilterEES3_INS_12IteratorFlagEE
_ZN12QDirIteratorC1ERK7QString6QFlagsINS_12IteratorFlagEE
_ZN12QDirIteratorC1ERK7QStringRK11QStringList6QFlagsIN4QDir6FilterEES6_INS_12IteratorFlagEE
_ZN12QDirIteratorC2ERK4QDir6QFlagsINS_12IteratorFlagEE
_ZN12QDirIteratorC2ERK7QString6QFlagsIN4QDir6FilterEES3_INS_12IteratorFlagEE
_ZN12QDirIteratorC2ERK7QString6QFlagsINS_12IteratorFlagEE
_ZN12QDirIteratorC2ERK7QStringRK11QStringList6QFlagsIN4QDir6FilterEES6_INS_12IteratorFlagEE
_ZN12QDirIteratorD0Ev
_ZN12QDirIteratorD1Ev
_ZN12QDirIteratorD2Ev
_ZN12QEasingCurve12setAmplitudeEd
_ZN12QEasingCurve12setOvershootEd
_ZN12QEasingCurve13setCustomTypeEPFddE
_ZN12QEasingCurve16staticMetaObjectE
_ZN12QEasingCurve7setTypeENS_4TypeE
_ZN12QEasingCurve9setPeriodEd
_ZN12QEasingCurveC1ENS_4TypeE
_ZN12QEasingCurveC1ERKS_
_ZN12QEasingCurveC2ENS_4TypeE
_ZN12QEasingCurveC2ERKS_
_ZN12QEasingCurveD1Ev
_ZN12QEasingCurveD2Ev
_ZN12QEasingCurveaSERKS_
_ZN12QLibraryInfo16licensedProductsEv
_ZN12QLibraryInfo8buildKeyEv
_ZN12QLibraryInfo8licenseeEv
_ZN12QLibraryInfo8locationENS_15LibraryLocationE
_ZN12QLibraryInfo9buildDateEv
_ZN12QLibraryInfoC1Ev
_ZN12QLibraryInfoC2Ev
_ZN12QMutexLocker6relockEv
_ZN12QMutexLocker6unlockEv
_ZN12QMutexLockerD1Ev
_ZN12QSystemError8toStringEv
_ZN12QTextDecoder9toUnicodeEP7QStringPKci
_ZN12QTextDecoder9toUnicodeEPKci
_ZN12QTextDecoder9toUnicodeERK10QByteArray
_ZN12QTextDecoderC1EPK10QTextCodec6QFlagsINS0_14ConversionFlagEE
_ZN12QTextDecoderC2EPK10QTextCodec6QFlagsINS0_14ConversionFlagEE
_ZN12QTextDecoderD1Ev
_ZN12QTextDecoderD2Ev
_ZN12QTextEncoder11fromUnicodeEPK5QChari
_ZN12QTextEncoder11fromUnicodeERK7QString
_ZN12QTextEncoder11fromUnicodeERK7QStringRi
_ZN12QTextEncoderC1EPK10QTextCodec6QFlagsINS0_14ConversionFlagEE
_ZN12QTextEncoderC2EPK10QTextCodec6QFlagsINS0_14ConversionFlagEE
_ZN12QTextEncoderD1Ev
_ZN12QTextEncoderD2Ev
_ZN12QWriteLockerD1Ev
_ZN12QtConcurrent15ResultStoreBase10addResultsEiPKvii
_ZN12QtConcurrent15ResultStoreBase13setFilterModeEb
_ZN12QtConcurrent15ResultStoreBase15syncResultCountEv
_ZN12QtConcurrent15ResultStoreBase16insertResultItemEiRNS_10ResultItemE
_ZN12QtConcurrent15ResultStoreBase17updateInsertIndexEii
_ZN12QtConcurrent15ResultStoreBase18syncPendingResultsEv
_ZN12QtConcurrent15ResultStoreBase23insertResultItemIfValidEiRNS_10ResultItemE
_ZN12QtConcurrent15ResultStoreBase9addResultEiPKv
_ZN12QtConcurrent15ResultStoreBaseC1Ev
_ZN12QtConcurrent15ResultStoreBaseC2Ev
_ZN12QtConcurrent15ResultStoreBaseD0Ev

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 822KB - Virtual size: 821KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/Data/TabS.oca
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/Data/TabS.ocx
.dll regsvr32 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

UPX0
Size: - Virtual size: 148KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pcworldpro/Data/aero.skn
pcworldpro/Data/libgcc_s_dw2-1.dll
.dll windows x86

22de106f971ff0449d33ea6ca7f9dcba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateSemaphoreA
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

__dllonexit
_errno
_global_unwind2
abort
calloc
fflush
free
malloc
realloc

Exports

Exports

_Unwind_Backtrace
_Unwind_DeleteException
_Unwind_FindEnclosingFunction
_Unwind_Find_FDE
_Unwind_ForcedUnwind
_Unwind_GetCFA
_Unwind_GetDataRelBase
_Unwind_GetGR
_Unwind_GetIP
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
__absvdi2
__absvsi2
__addvdi3
__addvsi3
__ashldi3
__ashrdi3
__bswapdi2
__bswapsi2
__clear_cache
__clzdi2
__clzsi2
__cmpdi2
__ctzdi2
__ctzsi2
__deregister_frame
__deregister_frame_info
__deregister_frame_info_bases
__divdc3
__divdi3
__divsc3
__divxc3
__emutls_get_address
__emutls_register_common
__enable_execute_stack
__ffsdi2
__ffssi2
__fixdfdi
__fixsfdi
__fixunsdfdi
__fixunsdfsi
__fixunssfdi
__fixunssfsi
__fixunsxfdi
__fixunsxfsi
__fixxfdi
__floatdidf
__floatdisf
__floatdixf
__floatundidf
__floatundisf
__floatundixf
__gcc_except_handler
__gcc_personality_v0
__lshrdi3
__moddi3
__muldc3
__muldi3
__mulsc3
__mulvdi3
__mulvsi3
__mulxc3
__negdi2
__negvdi2
__negvsi2
__paritydi2
__paritysi2
__popcountdi2
__popcountsi2
__powidf2
__powisf2
__powixf2
__register_frame
__register_frame_info
__register_frame_info_bases
__register_frame_info_table
__register_frame_info_table_bases
__register_frame_table
__subvdi3
__subvsi3
__ucmpdi2
__udivdi3
__udivmoddi4
__umoddi3

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 264B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/Data/mingwm10.dll
.dll windows x86

03e7672c8b423d2d726a1731f8c39711

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

__dllonexit
_errno
calloc
fflush
free
malloc

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
TlsGetValue

Exports

Exports

__mingwthr_key_dtor
__mingwthr_remove_key_dtor

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 132B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/Data/slibgcc_s_dw2-1.dll
.dll windows x86

22de106f971ff0449d33ea6ca7f9dcba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateSemaphoreA
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

__dllonexit
_errno
_global_unwind2
abort
calloc
fflush
free
malloc
realloc

Exports

Exports

_Unwind_Backtrace
_Unwind_DeleteException
_Unwind_FindEnclosingFunction
_Unwind_Find_FDE
_Unwind_ForcedUnwind
_Unwind_GetCFA
_Unwind_GetDataRelBase
_Unwind_GetGR
_Unwind_GetIP
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
__absvdi2
__absvsi2
__addvdi3
__addvsi3
__ashldi3
__ashrdi3
__bswapdi2
__bswapsi2
__clear_cache
__clzdi2
__clzsi2
__cmpdi2
__ctzdi2
__ctzsi2
__deregister_frame
__deregister_frame_info
__deregister_frame_info_bases
__divdc3
__divdi3
__divsc3
__divxc3
__emutls_get_address
__emutls_register_common
__enable_execute_stack
__ffsdi2
__ffssi2
__fixdfdi
__fixsfdi
__fixunsdfdi
__fixunsdfsi
__fixunssfdi
__fixunssfsi
__fixunsxfdi
__fixunsxfsi
__fixxfdi
__floatdidf
__floatdisf
__floatdixf
__floatundidf
__floatundisf
__floatundixf
__gcc_except_handler
__gcc_personality_v0
__lshrdi3
__moddi3
__muldc3
__muldi3
__mulsc3
__mulvdi3
__mulvsi3
__mulxc3
__negdi2
__negvdi2
__negvsi2
__paritydi2
__paritysi2
__popcountdi2
__popcountsi2
__powidf2
__powisf2
__powixf2
__register_frame
__register_frame_info
__register_frame_info_bases
__register_frame_info_table
__register_frame_info_table_bases
__register_frame_table
__subvdi3
__subvsi3
__ucmpdi2
__udivdi3
__udivmoddi4
__umoddi3

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 264B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/Data/zlib1.dll
.dll windows x86

6d4d29bd73030d9ea2c10c17cb1710df

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
FindAtomA
GetAtomNameA

msvcrt

_fdopen
__dllonexit
_assert
_errno
_filelengthi64
_vsnprintf
abort
clearerr
fclose
fflush
fgetpos
fopen
fprintf
fputc
fread
free
fsetpos
fwrite
malloc
memcpy
memset
sprintf
strcat
strcpy
strerror

Exports

Exports

DllGetVersion
adler32
adler32_combine
compress
compress2
compressBound
crc32
crc32_combine
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePrime
deflateReset
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
gzclearerr
gzclose
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzungetc
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateGetHeader
inflateInit2_
inflateInit_
inflatePrime
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
inflate_fast
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 208B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/Installx64.exe
.exe windows x64

4cea7ae85c87ddc7295d39ff9cda31d1

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:73:4d:11:1b:4b:5c:87:9b:bd:5a:8c:49:ab:2a:90
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

07/12/2021, 00:00

Not After

06/12/2024, 23:59

Subject

SERIALNUMBER=0400751588,CN=Comodo Security Solutions\, Inc,O=Comodo Security Solutions\, Inc,ST=New Jersey,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a4e6577204a6572736579,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:d4:63:d6:92:1b:29:7a:59:f9:a4:d5:57:98:96:29:15:da:8c:7f:01:bd:2f:8d:79:3b:16:f4:36:e3:8a:5c
Signer

Actual PE Digest

ad:d4:63:d6:92:1b:29:7a:59:f9:a4:d5:57:98:96:29:15:da:8c:7f:01:bd:2f:8d:79:3b:16:f4:36:e3:8a:5c

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=0400751588,CN=Comodo Security Solutions\, Inc,O=Comodo Security Solutions\, Inc,ST=New Jersey,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a4e6577204a6572736579,1.3.6.1.4.1.311.60.2.1.3=#13025553

09/03/2023, 18:59
Valid: true

Chain 1

SERIALNUMBER=0400751588,CN=Comodo Security Solutions\, Inc,O=Comodo Security Solutions\, Inc,ST=New Jersey,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a4e6577204a6572736579,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

GetTokenInformation
RegDeleteValueA
RegOpenKeyExA
RegQueryInfoKeyA
FreeSid
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
LookupPrivilegeValueA
AllocateAndInitializeSid
RegQueryValueExA
EqualSid
RegCloseKey
AdjustTokenPrivileges

kernel32

_lopen
_llseek
CompareStringA
GetLastError
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
GlobalAlloc
GlobalFree
CloseHandle
WritePrivateProfileStringA
IsDBCSLeadByte
GetWindowsDirectoryA
SetFileAttributesA
GetProcAddress
GlobalLock
LocalFree
RemoveDirectoryA
FreeLibrary
_lclose
CreateDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalUnlock
ReadFile
SizeofResource
WriteFile
GetDriveTypeA
LoadLibraryExA
SetFileTime
SetFilePointer
FindResourceA
CreateMutexA
GetVolumeInformationA
WaitForSingleObject
GetCurrentDirectoryA
FreeResource
GetVersion
SetCurrentDirectoryA
GetTempPathA
LocalFileTimeToFileTime
CreateFileA
SetEvent
TerminateThread
GetVersionExA
LockResource
GetSystemInfo
CreateThread
ResetEvent
LoadResource
ExitProcess
GetModuleHandleW
CreateProcessA
FormatMessageA
GetTempFileNameA
DosDateTimeToFileTime
CreateEventA
GetExitCodeProcess
ExpandEnvironmentStringsA
LocalAlloc
lstrcmpA
FindNextFileA
GetCurrentProcess
FindFirstFileA
GetModuleFileNameA
GetShortPathNameA
Sleep
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
GetDiskFreeSpaceA
MulDiv
FindClose

gdi32

GetDeviceCaps

user32

ShowWindow
MsgWaitForMultipleObjects
SetWindowPos
GetDC
GetWindowRect
DispatchMessageA
GetSystemMetrics
CallWindowProcA
SetWindowTextA
MessageBoxA
SendDlgItemMessageA
SendMessageA
GetDlgItem
DialogBoxIndirectParamA
GetWindowLongPtrA
SetWindowLongPtrA
SetForegroundWindow
ReleaseDC
EnableWindow
CharNextA
LoadStringA
CharPrevA
EndDialog
MessageBeep
ExitWindowsEx
SetDlgItemTextA
CharUpperA
GetDesktopWindow
PeekMessageA
GetDlgItemTextA

msvcrt

?terminate@@YAXXZ
_commode
_fmode
_acmdln
__C_specific_handler
memset
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
memcpy_s
_vsnprintf
_initterm
memcpy

comctl32

ord17

cabinet

ord20
ord21
ord23
ord22

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 577KB - Virtual size: 577KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/med/LICENSE
pcworldpro/med/NOTICE
pcworldpro/med/README.md
pcworldpro/med/app data/.github/FUNDING.yml
pcworldpro/med/app data/.github/ISSUE_TEMPLATE/bug_report.md
pcworldpro/med/app data/.github/ISSUE_TEMPLATE/feature_request.md
pcworldpro/med/app data/.github/workflows/app_build_and_test.yml
pcworldpro/med/app data/.github/workflows/app_playstore_publish.yml
pcworldpro/med/app data/.github/workflows/publish_maven.yml
pcworldpro/med/app data/.github/workflows/stale.yml
pcworldpro/med/app data/CONTRIBUTING.md
pcworldpro/med/app data/LICENSE
pcworldpro/med/app data/app/.gitignore
pcworldpro/med/app data/app/build.gradle
pcworldpro/med/app data/app/proguard-rules.pro
pcworldpro/med/app data/app/src/main/AndroidManifest.xml
.xml
pcworldpro/med/app data/app/src/main/ic_launcher-playstore.png
.png
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/ColorPickerAdapter.kt
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/EmojiBSFragment.kt
.js
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/FileSaveHelper.kt
.js
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/PhotoApp.kt
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/PropertiesBSFragment.kt
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/ShapeBSFragment.kt
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/StickerBSFragment.kt
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/TextEditorDialogFragment.kt
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/base/BaseActivity.kt
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/base/BaseFragment.kt
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/filters/FilterListener.kt
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/filters/FilterViewAdapter.kt
.js
pcworldpro/med/app data/app/src/main/java/com/burhanrashid52/photoediting/tools/ToolType.kt
pcworldpro/med/app data/app/src/main/res/drawable-v24/ic_launcher_foreground.xml
pcworldpro/med/app data/app/src/main/res/drawable/blank_image.jpg
pcworldpro/med/app data/app/src/main/res/drawable/ic_brush.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_camera.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_close.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_eraser.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_gallery.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_insert_emoticon.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_launcher_background.xml
.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_oval.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_photo_filter.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_rectangle.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_redo.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_save.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_share.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_sticker.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_text.xml
pcworldpro/med/app data/app/src/main/res/drawable/ic_undo.xml
pcworldpro/med/app data/app/src/main/res/drawable/original.jpg
.jpg
pcworldpro/med/app data/app/src/main/res/drawable/paris_tower.jpg
.jpg
pcworldpro/med/app data/app/src/main/res/drawable/rounded_border_text_view.xml
.xml
pcworldpro/med/app data/app/src/main/res/font/roboto_medium.xml
.xml
pcworldpro/med/app data/app/src/main/res/layout/activity_edit_image.xml
.xml
pcworldpro/med/app data/app/src/main/res/layout/add_text_dialog.xml
.xml
pcworldpro/med/app data/app/src/main/res/layout/color_picker_item_list.xml
.xml
pcworldpro/med/app data/app/src/main/res/layout/fragment_bottom_custom_effect_dialog.xml
.xml
pcworldpro/med/app data/app/src/main/res/layout/fragment_bottom_properties_dialog.xml
.xml
pcworldpro/med/app data/app/src/main/res/layout/fragment_bottom_shapes_dialog.xml
.xml
pcworldpro/med/app data/app/src/main/res/layout/fragment_bottom_sticker_emoji_dialog.xml
.xml
pcworldpro/med/app data/app/src/main/res/layout/row_editing_tools.xml
.xml
pcworldpro/med/app data/app/src/main/res/layout/row_emoji.xml
.xml
pcworldpro/med/app data/app/src/main/res/layout/row_filter_view.xml
.xml
pcworldpro/med/app data/app/src/main/res/layout/row_sticker.xml
.xml
pcworldpro/med/app data/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml
.xml
pcworldpro/med/app data/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml
.xml
pcworldpro/med/app data/app/src/main/res/mipmap-hdpi/ic_launcher.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-hdpi/ic_launcher_foreground.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-hdpi/ic_launcher_round.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-mdpi/ic_launcher.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-mdpi/ic_launcher_foreground.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-mdpi/ic_launcher_round.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-xhdpi/ic_launcher.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-xhdpi/ic_launcher_foreground.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-xxhdpi/ic_launcher.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-xxhdpi/ic_launcher_foreground.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-xxxhdpi/ic_launcher_foreground.png
.png
pcworldpro/med/app data/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png
.png
pcworldpro/med/app data/app/src/main/res/values-fr/strings.xml
pcworldpro/med/app data/app/src/main/res/values/colors.xml
.xml
pcworldpro/med/app data/app/src/main/res/values/dimens.xml
pcworldpro/med/app data/app/src/main/res/values/font_certs.xml
.xml
pcworldpro/med/app data/app/src/main/res/values/ic_launcher_background.xml
.xml
pcworldpro/med/app data/app/src/main/res/values/preloaded_fonts.xml
.xml
pcworldpro/med/app data/app/src/main/res/values/strings.xml
pcworldpro/med/app data/app/src/main/res/values/styles.xml
pcworldpro/med/app data/app/src/main/res/xml/file_paths.xml
.xml
pcworldpro/med/app data/app/src/test/java/com/burhanrashid52/photoediting/SampleTest.kt
pcworldpro/med/app data/build.gradle
pcworldpro/med/app data/gradle.properties
pcworldpro/med/app data/gradlew
.sh linux
pcworldpro/med/app data/metadata/en-US/changelogs/2.txt
pcworldpro/med/app data/metadata/en-US/full_description.txt
pcworldpro/med/app data/metadata/en-US/images/phoneScreenshots/photoeditor_home.jpg
.png
pcworldpro/med/app data/metadata/en-US/images/phoneScreenshots/photoeditor_image_edited.jpg
.png
pcworldpro/med/app data/metadata/en-US/short_description.txt
pcworldpro/med/app data/metadata/en-US/title.txt
pcworldpro/med/app data/photoeditor/.gitignore
pcworldpro/med/app data/photoeditor/build.gradle
pcworldpro/med/app data/photoeditor/proguard-rules.pro
pcworldpro/med/app data/photoeditor/src/androidTest/java/ja/burhanrashid52/photoeditor/BaseDrawingViewTest.kt
pcworldpro/med/app data/photoeditor/src/androidTest/java/ja/burhanrashid52/photoeditor/DrawingViewApiTest.kt
pcworldpro/med/app data/photoeditor/src/androidTest/java/ja/burhanrashid52/photoeditor/DrawingViewTouchEventTest.kt
pcworldpro/med/app data/photoeditor/src/androidTest/java/ja/burhanrashid52/photoeditor/DrawingViewUndoRedoTest.kt
pcworldpro/med/app data/photoeditor/src/main/AndroidManifest.xml
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/BitmapUtil.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/BoxHelper.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/BrushDrawingStateListener.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/BrushViewChangeListener.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/CustomEffect.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/DrawingView.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/Emoji.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/FilterImageView.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/GLToolbox.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/Graphic.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/GraphicManager.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/ImageFilterView.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/MultiTouchListener.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/OnPhotoEditorListener.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/OnSaveBitmap.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/PhotoEditor.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/PhotoEditorImageViewListener.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/PhotoEditorImpl.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/PhotoEditorView.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/PhotoEditorViewState.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/PhotoFilter.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/PhotoSaverTask.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/SaveFileResult.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/SaveSettings.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/ScaleGestureDetector.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/Sticker.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/Text.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/TextBorder.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/TextShadow.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/TextStyleBuilder.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/TextureRenderer.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/Vector2D.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/ViewType.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/shape/AbstractShape.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/shape/ArrowPointerLocation.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/shape/BrushShape.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/shape/LineShape.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/shape/OvalShape.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/shape/RectangleShape.kt
.js
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/shape/Shape.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/shape/ShapeAndPaint.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/shape/ShapeBuilder.kt
pcworldpro/med/app data/photoeditor/src/main/java/ja/burhanrashid52/photoeditor/shape/ShapeType.kt
pcworldpro/med/app data/photoeditor/src/main/res/drawable-hdpi/ic_remove.png
.png
pcworldpro/med/app data/photoeditor/src/main/res/drawable-mdpi/ic_remove.png
.png
pcworldpro/med/app data/photoeditor/src/main/res/drawable-xhdpi/ic_remove.png
.png
pcworldpro/med/app data/photoeditor/src/main/res/drawable-xxhdpi/ic_remove.png
.png
pcworldpro/med/app data/photoeditor/src/main/res/drawable/rounded_border_tv.xml
.xml
pcworldpro/med/app data/photoeditor/src/main/res/layout/view_photo_editor_image.xml
.xml
pcworldpro/med/app data/photoeditor/src/main/res/layout/view_photo_editor_text.xml
.xml
pcworldpro/med/app data/photoeditor/src/main/res/values/attrs.xml
.xml
pcworldpro/med/app data/photoeditor/src/test/java/ja/burhanrashid52/photoeditor/EnumTest.kt
pcworldpro/med/app data/photoeditor/src/test/java/ja/burhanrashid52/photoeditor/GraphicManagerTest.kt
.js
pcworldpro/med/app data/photoeditor/src/test/java/ja/burhanrashid52/photoeditor/SaveSettingsTest.kt
pcworldpro/med/app data/photoeditor/src/test/java/ja/burhanrashid52/photoeditor/TextStyleBuilderTest.kt
.js
pcworldpro/med/app data/photoeditor/src/test/resources/robolectric.properties
pcworldpro/med/app data/scripts/publish-mavencentral.gradle
pcworldpro/med/lib/peace/cmiv2.dll
.dll regsvr32 windows x64

572b57c62546550908cc7d5215424d83

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:77:46:8f:b9:55:79:a2:be:e5:cc:ad:c9:9e:62:ba:fb:dd:8e:f7:55:06:34:0a:f8:05:db:3b:c0:01:ce:d3
Signer

Actual PE Digest

06:77:46:8f:b9:55:79:a2:be:e5:cc:ad:c9:9e:62:ba:fb:dd:8e:f7:55:06:34:0a:f8:05:db:3b:c0:01:ce:d3

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

09/03/2023, 18:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
wcscpy_s
wcscat_s
_waccess
iswspace
wcsncmp
_wcsicmp
_onexit
malloc
free
__C_specific_handler
_ltow
wcstol
wcschr
_vsnwprintf
_purecall
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??1type_info@@UEAA@XZ
memset
memmove
memcpy
memcmp
memchr
__CxxFrameHandler3
_wcsupr
_errno
towupper
?what@exception@@UEBAPEBDXZ
__dllonexit
realloc
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
wcsstr
_wtoi
_itow_s
wcstoul
_vsnprintf
printf
wcsrchr
_itow
_isctype
towlower
toupper
iswctype
tolower
wcscmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
NtLoadKey2
RtlInitUnicodeString
RtlCopyUnicodeString
LdrGetProcedureAddress
LdrGetDllHandle
RtlUpcaseUnicodeChar
RtlInitString
RtlAppendUnicodeStringToString
RtlNtStatusToDosErrorNoTeb
DbgPrintEx
RtlRaiseStatus
LdrUnloadDll
LdrLoadDll
RtlVirtualUnwind
RtlAllocateHeap
NtSetInformationFile
RtlDosPathNameToNtPathName_U
NtClose
RtlFreeHeap
RtlNtStatusToDosError
NtCreateFile
NtQueryInformationFile
NtOpenFile
RtlDosPathNameToRelativeNtPathName_U
NtOpenProcess
NtQueryInformationProcess

oleaut32

SysStringLen
SysAllocString
SysFreeString
VariantClear
LoadRegTypeLi
VariantCopyInd
SafeArrayGetVartype
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayGetElement
SafeArrayDestroy
SafeArrayCreateVector
VarUI4FromStr
VariantInit
UnRegisterTypeLi
LoadTypeLibEx
SystemTimeToVariantTime
VariantTimeToSystemTime
CreateErrorInfo
GetErrorInfo
LoadTypeLi
RegisterTypeLi
SysAllocStringLen
VariantCopy
DispCallFunc
SetErrorInfo
SafeArrayPutElement
SysStringByteLen
SafeArrayCreateVectorEx
VariantChangeType
VarCmp

xmllite

CreateXmlWriterOutputWithEncodingName
CreateXmlWriter
CreateXmlReader

setupapi

SetupGetStringFieldW
SetupGetBinaryField
SetupFindNextMatchLineW
SetupCloseInfFile
SetupFindFirstLineW
SetupOpenInfFileW
SetupGetMultiSzFieldW
SetupGetFieldCount
SetupGetIntField
SetupGetLineCountW

advapi32

GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetSecurityDescriptorControl
GetSecurityDescriptorControl
RegSaveKeyExW
RegUnLoadKeyW
RegDeleteKeyW
AdjustTokenPrivileges
OpenProcessToken
OpenThreadToken
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

kernel32

ReadProcessMemory
GlobalUnlock
GlobalLock
ReadFile
CreateFileW
SetFilePointer
WriteFile
GetLocalTime
GetEnvironmentVariableW
GetSystemWindowsDirectoryW
GetTempFileNameW
CloseHandle
GetCurrentThread
GetTempPathW
SetErrorMode
RemoveDirectoryW
FindNextFileW
GetFullPathNameW
FindFirstFileW
CreateFileMappingW
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
FlushViewOfFile
UnmapViewOfFile
MapViewOfFile
GetFileAttributesExW
CreateDirectoryW
LocalAlloc
FormatMessageW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
HeapAlloc
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Sleep
LocalFree
WideCharToMultiByte
lstrcpyW
HeapDestroy
DisableThreadLibraryCalls
InitializeCriticalSection
GetModuleFileNameW
LoadResource
SizeofResource
MultiByteToWideChar
lstrcpynW
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FreeLibrary
DeleteFileW
MoveFileExW
CopyFileW
SetFileAttributesW
GetFileAttributesW
SetLastError
FindClose
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
lstrcmpW
LCMapStringW
EnterCriticalSection
GetProcessHeap
HeapFree
ExpandEnvironmentStringsW
SetEnvironmentVariableW
FindResourceW
LockResource
GlobalMemoryStatusEx
DeviceIoControl
GetVolumePathNameW
GetVolumeInformationW
QueryPerformanceFrequency
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
LoadLibraryW
FindResourceExW
VirtualFree
GetVersionExA
PrivCopyFileExW
UnhandledExceptionFilter
DebugBreak
GetLastError
CompareStringW
LeaveCriticalSection

ole32

CLSIDFromString
StringFromGUID2
CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CreateStreamOnHGlobal
GetHGlobalFromStream
IIDFromString

user32

CharNextW
CharPrevW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 780KB - Virtual size: 779KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 193KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/med/lib/peace/mcupdate_GenuineIntel.dll
.exe windows x64

a43a3e7c022b8819b72e9dd93ec10e0d

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:c8:3a:ec:b3:ce:a9:c0:e6:27:6e:9a:c6:1d:40:32:4d:2b:bf:f5:c3:26:c4:9e:c6:74:0e:36:8e:57:67:1b
Signer

Actual PE Digest

32:c8:3a:ec:b3:ce:a9:c0:e6:27:6e:9a:c6:1d:40:32:4d:2b:bf:f5:c3:26:c4:9e:c6:74:0e:36:8e:57:67:1b

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

09/03/2023, 18:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlInitUnicodeString
RtlCopyUnicodeString
RtlIntegerToUnicodeString
ZwClose
ZwSetValueKey
ZwOpenKey
RtlAppendUnicodeStringToString

Exports

Exports

McImageInfo

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 346B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEUPDT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 114B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

MCDATA
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

GFIDS
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/med/lib/peace/mfdvdec.dll
.dll windows x64

c2cd05a80ef743073eadb33662f239d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

strncpy_s
strnlen
_purecall
memset
_XcptFilter
_amsg_exit
free
_callnewh
_initterm
__C_specific_handler
_lock
malloc
_onexit
_unlock
__dllonexit
qsort
memcpy

api-ms-win-core-com-l1-1-0

PropVariantClear

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
TlsGetValue
TlsSetValue
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

mfplat

MFCreateMediaType
MFGetStrideForBitmapInfoHeader
MFGetCallStackTracingWeakReference
MFCalculateImageSize
MFGetSystemTime

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/med/locales/MemoryDiagnostic.dll
.dll regsvr32 windows x64

c539f5fac8e8357033ae954f9286a2ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_wcsdup
memset
memcpy
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
bsearch
qsort
wcscmp

ntdll

NtQuerySystemInformation
WinSqmSetIfMaxDWORD
NtSetSystemInformation
WinSqmSetDWORD
WinSqmIncrementDWORD
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
GetModuleHandleExW
WaitForSingleObject
FreeLibraryAndExitThread
ResumeThread
CreateEventW
GetTickCount64
GetLastError
SetEvent
DisableThreadLibraryCalls
CloseHandle
GetSystemInfo
CreateThread
FreeLibrary
GetSystemTimeAsFileTime
UnhandledExceptionFilter

ole32

CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

advapi32

EventWrite
RegCloseKey
EventRegister
TraceMessage
GetTraceLoggerHandle
GetTraceEnableFlags
RegSetValueExW
GetTraceEnableLevel
OpenProcessToken
RegisterTraceGuidsW
UnregisterTraceGuids
RegOpenKeyExW
EventUnregister
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW

wevtapi

EvtClose
EvtCreateRenderContext
EvtRender
EvtNext
EvtQuery

bcd

BcdOpenObject
BcdSetElementData
BcdCloseStore
BcdOpenSystemStore
BcdCloseObject
BcdGetElementData

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/med/locales/MessagingDataModel2.dll
.dll windows x64

7993a0c7d9c117435c3aafec5a60abec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcmp
_wtoi64
__C_specific_handler
_onexit
memmove
__CxxFrameHandler3
__dllonexit
memcpy
_wtoi
realloc
_lock
_initterm
_amsg_exit
_XcptFilter
wcscpy_s
_callnewh
malloc
free
wcstok_s
wcstoul
toupper
memset
_errno
_vsnwprintf_s
towlower
memmove_s
_wcslwr_s
wcsncmp
iswdigit
_wgetenv
_wcsicmp
wcsrchr
swscanf_s
_wcstoui64
wcschr
_unlock
_vsnwprintf
memcpy_s
_wcsnicmp
_purecall
wcsftime
wcscmp

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetProcAddress
FreeLibraryAndExitThread
GetModuleHandleExW
FreeLibrary
LoadStringW
GetModuleFileNameA
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
SetEvent
InitializeCriticalSection
CreateMutexExW
CreateEventW
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockShared
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
LeaveCriticalSection
CreateEventExW
WaitForSingleObjectEx
ReleaseSRWLockShared
WaitForSingleObject
ResetEvent
ReleaseMutex
OpenSemaphoreW

oleaut32

SysStringLen
SysAllocStringLen
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantInit
VarBstrFromUI8
VarBstrCat

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
EventProviderEnabled

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoWaitForMultipleObjects
StringFromGUID2
CLSIDFromString
StringFromCLSID
CoTaskMemFree
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoTaskMemAlloc

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathSkipRootW
PathGetDriveNumberW
PathFindExtensionW

api-ms-win-core-path-l1-1-0

PathCchRenameExtension
PathCchCanonicalize

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
CreateProcessW
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentThread
CreateThread
GetThreadPriority
GetCurrentProcessId

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegNotifyChangeKeyValue
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegGetValueW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-file-l1-1-0

GetFileSizeEx
DeleteFileW
CompareFileTime
CreateFileW
FileTimeToLocalFileTime

api-ms-win-core-localization-l1-2-0

GetUserGeoID
GetGeoInfoW
FormatMessageW
GetUserDefaultLocaleName
GetLocaleInfoW
GetThreadUILanguage

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptCreateHash
CryptHashData
CryptAcquireContextW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolWork
CloseThreadpool
SubmitThreadpoolWork
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
CreateThreadpool
WaitForThreadpoolWorkCallbacks
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWait
CloseThreadpoolWork
SetThreadpoolThreadMaximum

xmllite

CreateXmlReader

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetCurrentDirectoryW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

phoneutil

CellularApiHelper_FreeCountedSlotCanAssociationArray
GetDialStringFromTelUri
MaskPhoneUri
Phone_FmtText_NonDialerFormat
IsDialableChar
IsNumberDialable
GetCchTailMin
CellularApiHelper_CreateInstance
MaskPhoneNumber
OneShotTimer_CreateInstance
GetTelUriFromDialString
ComparePhoneNumbers

pimstore

FindAllMatchingContactsEx
FindMatchingContactEx

cemapi

MAPIAllocateBuffer
CreateMAPITableWalker
MAPIInitialize
MAPILogonEx
FreeProws
GetNamedPropTag
HrSetOneProp
MAPIFreeBuffer
HrGetOneProp
MAPI_CompareEntryIDs
MAPIUninitialize

userdataplatformhelperutil

CreateKnownFolderPath
StartAndWaitForServiceForUser
IsCommsSystemService
SetThreadIOPriority
GetThreadIOPriority
GetUserTokenFromContext
GetFileExtensionFromContentType
GetContentTypeFromFilePath

userdatatypehelperutil

BytesToDigits
ReadStreamContent
CreateWrapFileNameStm
StringToBytes
CreateWrapFileStreamFromDssToken
CopyStream
StreamFromStringW
FormatPoomIdToString

ntdll

RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsDeleteString

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-base-l1-1-0

GetTokenInformation

rpcrt4

RpcBindingCreateW
RpcExceptionFilter
RpcBindingFree
NdrClientCall2
RpcBindingBind

Exports

Exports

?CommitAllAttachments@MessagingDeferredAttachment@@YAJPEAUISmMessage@@@Z
?CommitDeferredContent@MessagingDeferredAttachment@@YAJPEAUIStream@@0@Z
?DeleteMessageAndTempFiles@MessagingDeferredAttachment@@YAJPEAUISmMessage@@@Z
?DeleteTempFiles@MessagingDeferredAttachment@@YAJPEAUISmMessage@@@Z
?GetData@MessagingDeferredAttachment@@YAJPEAUISmAttachment@@PEAPEAUIStream@@1@Z
?GetDeferredAttachmentFilePath@MessagingDeferredAttachment@@YAJPEAUISmMessage@@KPEAHPEAV?$basic_string@GU?$char_traits@G@utl@@V?$allocator@G@2@@utl@@@Z
CellMessagingHelper_CreateInstance
DllCanUnloadNow
DllGetClassObject
GetActiveMmsProfile
GetDirectionalMarkerForCurrentLocale
GetHasInternationalCapability
GetMaxAuthorizedSizeOfMMS
MOCloudCorrelation_CreateInstance
MOCloudCorrelation_CreateInstance2
MessagingAsyncDeletion_CreateInstance
MessagingMultiSimConverter_CreateInstanceWithPhoneOM
MessagingMultiSimConverter_CreateInstanceWithSimOM
MessagingMultiSimConverter_CreateSynchronousInstanceWithSimOM
MessagingRegistryGetDWORDFromPerSimMmsProfile
MessagingRegistryGetDWORDPerSim
MessagingRegistryGetStringFromPerSimMmsProfile
MessagingRegistryGetStringPerSim
MessagingRegistrySetDWORDPerSim
MessagingRegistrySetDWORDToPerSimMmsProfile
MessagingRegistrySetStringPerSim
MessagingRegistrySetStringToPerSimMmsProfile
Messaging_ChatTransportIdToStoreId
Messaging_CreateMessageInConversation
Messaging_CreateMessageInConversationWithRecipients
Messaging_CreateMessageInConversationWithRecipientsAndRemoteId
Messaging_FormatPhoneNumber
Messaging_FormatRecipient
Messaging_FormatRecipientFromAggregate
Messaging_FormatStringWithLeftToRightMarkers
Messaging_FormatStringWithLeftToRightMarkersIfPhoneNumber
Messaging_GetAddressType
Messaging_GetContentTypeFromFilePath
Messaging_GetFileExtensionFromContentType
Messaging_GetMediaTempFilePath
Messaging_GetMediaTempFolder
Messaging_GetMediaTypeFromMimeTag
Messaging_GetMessageAttachmentText
Messaging_GetMessagePreview
Messaging_GetPlatformType
Messaging_GetRecipientsPreviewWithBiDiMarkers
Messaging_GetRecipientsString
Messaging_GetSmsCharacterCount
Messaging_GetUnFormattedMessagePreview
Messaging_GetValidSimId
Messaging_HasEmbeddedModem
Messaging_InitializeRcsSlotMessagingSettings
Messaging_IsContentSupported
Messaging_IsCustomAppProviderId
Messaging_IsDataRoamingRestrictionActive
Messaging_IsFilterProviderId
Messaging_IsMediaType
Messaging_IsMmsMessage
Messaging_IsRcsEnabled
Messaging_IsRcsMessage
Messaging_IsSIMMessage
Messaging_IsThreadedByRemoteConversationId
Messaging_IsUnderMediaTempFolder
Messaging_IsVoiceRoamingRestrictionActive
Messaging_MarkMessageAsFailed
Messaging_MessagingOMStartupShutdown
Messaging_MessagingOMStartupStoreScan
Messaging_ResolveRecipientEx
Messaging_RetryDownloadCloudServiceMessage
Messaging_ShowToastForRcsEndUserMessage
Messaging_ShutdownCloudServices
Messaging_ShutdownMessageMaintenance
Messaging_ShutdownNotification
Messaging_SmEntryIdToUdmObjectId
Messaging_StartCloudServiceSync
Messaging_StartCloudServices
Messaging_StartMessageMaintenance
Messaging_StartNotification
UnInitMessagingObjectModelModule
WwanConnectionConfiguration_CreateInstance

Sections

.text
Size: 831KB - Virtual size: 830KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/med/locales/mcupdate_GenuineIntel.dll
.exe windows x64

a43a3e7c022b8819b72e9dd93ec10e0d

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:c8:3a:ec:b3:ce:a9:c0:e6:27:6e:9a:c6:1d:40:32:4d:2b:bf:f5:c3:26:c4:9e:c6:74:0e:36:8e:57:67:1b
Signer

Actual PE Digest

32:c8:3a:ec:b3:ce:a9:c0:e6:27:6e:9a:c6:1d:40:32:4d:2b:bf:f5:c3:26:c4:9e:c6:74:0e:36:8e:57:67:1b

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

09/03/2023, 18:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlInitUnicodeString
RtlCopyUnicodeString
RtlIntegerToUnicodeString
ZwClose
ZwSetValueKey
ZwOpenKey
RtlAppendUnicodeStringToString

Exports

Exports

McImageInfo

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 346B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEUPDT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 114B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

MCDATA
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

GFIDS
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/med/prop/AppInfo/Launcher/DiffImgPortable.ini
pcworldpro/med/prop/AppInfo/Launcher/splash.jpg
pcworldpro/med/prop/AppInfo/appcompactor.ini
pcworldpro/med/prop/AppInfo/appicon.ico
pcworldpro/med/prop/AppInfo/appicon_128.png
.png .ps1
pcworldpro/med/prop/AppInfo/appicon_16.png
.png
pcworldpro/med/prop/AppInfo/appicon_32.png
.png
pcworldpro/med/prop/AppInfo/appinfo.ini
pcworldpro/med/prop/AppInfo/installer.ini
pcworldpro/med/prop/AppManMigrationPlugin.dll
.dll regsvr32 windows x64

3426e31e2eb9a00393a44c4098df121d

Code Sign

33:00:00:03:8b:79:45:c1:8b:0e:b6:87:ec:00:00:00:00:03:8b
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/05/2022, 19:23

Not After

04/05/2023, 19:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:8b:ac:8f:3f:a6:f2:e6:3e:b2:83:f0:c0:3d:a0:b0:f6:d2:87:c0:bd:a6:46:dc:6f:ae:bb:35:50:98:3e:fe
Signer

Actual PE Digest

c5:8b:ac:8f:3f:a6:f2:e6:3e:b2:83:f0:c0:3d:a0:b0:f6:d2:87:c0:bd:a6:46:dc:6f:ae:bb:35:50:98:3e:fe

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

09/03/2023, 18:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

msvcrt

___lc_collate_cp_func
setlocale
__pctype_func
isupper
___lc_handle_func
___lc_codepage_func
memcmp
___mb_cur_max_func
_ismbblead
__uncaught_exception
islower
_wcsdup
??8type_info@@QEBAHAEBV0@@Z
__crtCompareStringW
__crtCompareStringA
__crtLCMapStringW
__crtLCMapStringA
_wsetlocale
isspace
tolower
memchr
abort
memset
isalnum
_Getdays
ungetc
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
__mb_cur_max
_Gettnames
_Strftime
strchr
_wcsicmp
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
strerror
ldexp
fseek
mbstowcs_s
?name@type_info@@QEBAPEBDXZ
_fseeki64
_wfsopen
fsetpos
setvbuf
fgetpos
fwrite
fgetc
fclose
fflush
fputc
sprintf_s
_stricmp
localeconv
strcspn
_wcsnicmp
time
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
swprintf_s
ldiv
_Getmonths
isdigit
calloc
_wtoi
wcscat_s
wcsncpy_s
malloc
memmove_s
free
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
wcscpy_s
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
__C_specific_handler
__CxxFrameHandler3
??3@YAXPEAX@Z
wcscmp

ntdll

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

kernel32

SleepConditionVariableSRW
WakeAllConditionVariable
DecodePointer
EncodePointer
GetLocaleInfoW
GetStringTypeW
LocalAlloc
GetProcessMitigationPolicy
TlsFree
TlsGetValue
TlsAlloc
GetModuleFileNameA
SizeofResource
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
LockResource
OpenSemaphoreW
CloseHandle
RaiseException
FindResourceExW
LoadResource
HeapAlloc
GetProcAddress
CreateMutexExW
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
lstrcmpiW
LoadLibraryExW
FreeLibrary
MultiByteToWideChar
GetThreadLocale
SetThreadLocale
InitOnceBeginInitialize
InitOnceComplete
FindFirstFileW
FindNextFileW
FindClose
GetSystemDirectoryW
GetFileAttributesW
HeapSize
HeapReAlloc
HeapDestroy
WideCharToMultiByte
LocalFree
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
TlsSetValue
ResetEvent
OpenEventA
ProcessIdToSessionId
GetFileTime
GetFileSize
SetEvent
SetFileAttributesW
CreateFileW
ExpandEnvironmentStringsW
WriteFile
CreateEventA
ReadFile
GetComputerNameExW
lstrlenA
SystemTimeToFileTime
GetLocalTime
LocalUnlock
DeleteFileW
LocalLock
AcquireSRWLockShared
AreFileApisANSI
CreateDirectoryW
DeviceIoControl
GetCurrentDirectoryW
IsDebuggerPresent
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
AcquireSRWLockExclusive
CloseThreadpoolTimer
ReleaseSRWLockExclusive
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
FormatMessageA

ole32

OleRun
CoCreateInstance
CLSIDFromString
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromCLSID
CLSIDFromProgID
CoUninitialize
CoInitializeEx
StringFromGUID2

oleaut32

SysAllocStringByteLen
VarUI4FromStr
SysStringLen
SysFreeString
LoadTypeLi
LoadRegTypeLi
UnRegisterTypeLi
SysAllocString
RegisterTypeLi
VariantInit
VariantClear
GetErrorInfo

user32

UnregisterClassA
CharNextW

advapi32

EventUnregister
EventWriteTransfer
EventRegister
RegGetValueW
RegDeleteValueW
RegQueryInfoKeyW
RegSetKeyValueW
EventSetInformation
RegQueryValueExW
RegDeleteKeyExW
RegEnumValueW
EqualSid
CreateWellKnownSid
GetNamedSecurityInfoW
OpenProcessToken
GetTokenInformation
RegDeleteTreeW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW

shell32

SHGetFileInfoW
SHGetKnownFolderPath

activeds

ord3

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 835KB - Virtual size: 834KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pcworldpro/med/prop/winsetup.dll
.dll windows x64

13ac5715282cc532d7063b3f0eee1e63

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:49:eb:75:82:fc:24:8d:f5:60:7e:ba:e6:d8:06:1c:5a:f4:89:a4:7f:08:2f:ee:49:58:ce:e8:d8:b6:2c:bd
Signer

Actual PE Digest

76:49:eb:75:82:fc:24:8d:f5:60:7e:ba:e6:d8:06:1c:5a:f4:89:a4:7f:08:2f:ee:49:58:ce:e8:d8:b6:2c:bd

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

09/03/2023, 18:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

msvcrt

__crtLCMapStringW
setlocale
_wfsopen
__mb_cur_max
___lc_codepage_func
___lc_handle_func
__pctype_func
_errno
vswprintf_s
wcstol
iswalpha
wcscspn
rand
time
srand
getchar
wprintf
?name@type_info@@QEBAPEBDXZ
abort
fwrite
___mb_cur_max_func
fputwc
ungetwc
ungetc
fgetc
fgetwc
fgetpos
fseek
fsetpos
setvbuf
iswctype
_vscwprintf
_wtoi64
_purecall
_itow_s
fwprintf
fclose
__crtGetStringTypeW
iswdigit
fflush
swscanf_s
wcsspn
qsort
_snwscanf_s
strncmp
_wcsupr
wcsnlen
strcpy_s
wcsncpy_s
_vsnwprintf_s
wcscat_s
wcscpy_s
_ultow_s
bsearch
_wcsrev
_strnicmp
strncpy_s
_wcstoi64
wcstok_s
__iob_func
realloc
_wcslwr
__RTDynamicCast
memcmp
memcpy
memmove
memset
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
towupper
swprintf_s
_callnewh
malloc
_stricmp
calloc
free
_wtoi
_wcsicmp
wcsncmp
_wcsnicmp
_vsnwprintf
wcsrchr
wcschr
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
swscanf
_vsnprintf
__CxxFrameHandler3
_wcstoui64
wcstoul
_wtol
wcsstr
__C_specific_handler
wcscmp

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GetSystemTimeAsFileTime
FlushFileBuffers
FindClose
FindNextFileW
FindFirstFileW
RtlCompareMemory
WritePrivateProfileStringW
GetSystemDirectoryW
Sleep
GetDiskFreeSpaceExW
SystemTimeToFileTime
GetVersionExW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
CreateEventW
CreateThread
VirtualQuery
LoadLibraryExA
VirtualProtect
AcquireSRWLockExclusive
WakeAllConditionVariable
GetCurrentThreadId
GetCurrentProcessId
ReleaseSRWLockExclusive
GetSystemPowerStatus
OpenEventW
CreateDirectoryW
FindResourceW
MulDiv
GetLocaleInfoEx
DebugBreak
WaitForMultipleObjects
LockFileEx
UnlockFileEx
SetEndOfFile
SetVolumeLabelW
MoveFileWithProgressW
RemoveDirectoryW
RaiseException
MapViewOfFileEx
DefineDosDeviceW
WaitForSingleObjectEx
ReleaseMutex
GetPrivateProfileStringW
SetComputerNameExW
GetStartupInfoW
SleepEx
ResetEvent
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
SetThreadPreferredUILanguages
GetFileTime
GetFinalPathNameByHandleW
GetLongPathNameW
IsWow64Process
HeapReAlloc
SetFilePointerEx
GetDiskFreeSpaceW
GetFileSize
LCMapStringW
GetVersionExA
CopyFileExW
ExpandEnvironmentStringsW
DeleteFileW
GetTempFileNameW
SetFilePointer
ReadFile
LocalAlloc
GetVersion
QueryPerformanceCounter
IsValidLocale
IsValidCodePage
lstrcmpW
GetFileAttributesExW
LockResource
SizeofResource
lstrcmpiW
GetCurrentThread
DeviceIoControl
GetFileSizeEx
FindNextVolumeW
DeleteVolumeMountPointW
FindVolumeClose
SetVolumeMountPointW
FormatMessageW
FindFirstVolumeW
GetVolumeNameForVolumeMountPointW
GetPrivateProfileSectionW
WriteFile
GetVolumeInformationW
QueryDosDeviceW
GetExitCodeProcess
CreateProcessW
LoadLibraryExW
MapViewOfFile
CreateFileMappingW
LoadResource
FindResourceExW
UnmapViewOfFile
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SearchPathW
GetLocalTime
GetDateFormatW
FileTimeToSystemTime
GetEnvironmentVariableW
GetLogicalDrives
SetEnvironmentVariableW
GetDriveTypeW
GetNativeSystemInfo
GetLogicalDriveStringsW
CreateFileW
GetSystemDefaultLangID
GetUserDefaultLangID
GetPrivateProfileIntW
GetSystemWindowsDirectoryW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeThread
GetVolumePathNamesForVolumeNameW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
CreateSemaphoreExW
WaitForMultipleObjectsEx
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetVolumeInformationByHandleW
CreateSemaphoreW
ReleaseSemaphore
DuplicateHandle
InitializeCriticalSectionAndSpinCount
OpenProcess
SetThreadIdealProcessor
GetOverlappedResult
GetHandleInformation
VirtualFree
VirtualAlloc
GetLastError
SetThreadExecutionState
CreateMutexW
GetModuleFileNameW
GetCommandLineW
CompareStringW
HeapFree
GetProcessHeap
SetEvent
WaitForSingleObject
CloseHandle
GetFileAttributesW
MoveFileW
HeapAlloc
LocalFree
SetLastError
GetWindowsDirectoryW
CopyFileW
LoadLibraryW
GetTickCount
GlobalFree
GetSystemInfo
VerifyVersionInfoW
GetTempPathW
GlobalMemoryStatusEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetVolumePathNameW
MoveFileExW
SetFileAttributesW
GetFullPathNameW
SleepConditionVariableSRW

advapi32

RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent
UnregisterTraceGuids
ConvertStringSecurityDescriptorToSecurityDescriptorW
MakeAbsoluteSD
InitiateSystemShutdownExW
OpenSCManagerW
OpenServiceW
AllocateAndInitializeSid
FreeSid
NotifyServiceStatusChangeW
ControlService
EnumDependentServicesW
StartServiceW
RegDeleteKeyExW
RegDeleteTreeW
RegQueryInfoKeyW
EqualSid
RegEnumKeyExW
PrivilegeCheck
RegDeleteKeyW
RegEnumValueW
EventRegister
EventUnregister
EventWriteTransfer
LookupPrivilegeValueW
GetSecurityDescriptorSacl
AdjustTokenPrivileges
GetSecurityDescriptorGroup
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
OpenProcessToken
ConvertSidToStringSidW
OpenThreadToken
GetTokenInformation
RegGetValueW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
QueryServiceStatus
CloseServiceHandle
GetSecurityDescriptorDacl
SetNamedSecurityInfoW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegRestoreKeyW
RegLoadKeyW
RegUnLoadKeyW
RegFlushKey
SetThreadToken
ReadEncryptedFileRaw
CloseEncryptedFileRaw
WriteEncryptedFileRaw
GetSecurityDescriptorLength
OpenEncryptedFileRawW
RevertToSelf
GetSecurityInfo
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
GetAclInformation
InitializeSecurityDescriptor
DuplicateTokenEx

dnsapi

DnsValidateName_W

ole32

CoSetProxyBlanket
CoCreateInstance
CLSIDFromString
StringFromCLSID
StringFromGUID2
CoTaskMemFree
CoInitializeSecurity
CoInitializeEx
CoUninitialize

oleaut32

VarUI4FromDec
VarBstrFromDate
VarI4FromDec
SysStringLen
SafeArrayGetElement
VariantClear
SysFreeString
SysAllocString

rpcrt4

RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall3
I_RpcMapWin32Status
RpcBindingSetAuthInfoW
UuidFromStringW
UuidToStringW
RpcStringFreeW
RpcBindingFree
UuidCreate

shell32

CommandLineToArgvW

shlwapi

PathFileExistsW
PathIsUNCW
PathRemoveBackslashW
StrStrW

user32

CharLowerW
MessageBoxW
CharNextW
LoadStringW
CharUpperBuffW
GetSystemMetrics
GetWindowTextW
EndPaint
GetKeyboardLayout
IsCharAlphaW
LoadBitmapW
FillRect
GetWindowLongW
GetMessageW
DefWindowProcW
BeginPaint
ReleaseDC
InvalidateRect
LoadImageW
UpdateWindow
PostQuitMessage
CharUpperW
DrawTextW
GetClientRect
SetCursor
TranslateMessage
SetPropW
SetFocus
MapWindowPoints
SetTimer
FindWindowExW
DispatchMessageW
ShowWindow
SetThreadDesktop
RegisterClassExW
NotifyWinEvent
SetClassLongPtrW
SetWindowTextW
SendMessageW
CreateWindowExW
GetPropW
SetWindowPos
IsWindowVisible
GetDC
DestroyWindow
KillTimer

wintrust

CryptCATAdminCalcHashFromFileHandle

imagehlp

CheckSumMappedFile

wdscore

WdsInitializeDataStringW
WdsFreeCollection
WdsPackCollection
WdsCollectionAddValue
WdsAllocCollection
WdsAddModule
WdsExitImmediatelyEx
ConstructPartialMsgVA
WdsDeleteBlackboardValue
WdsSetBlackboardValue
WdsInitializeDataUInt64
WdsSetNextExecutionGroup
WdsInitializeDataBinary
WdsPublishImmediateEx
WdsFreeData
WdsSetupLogMessageA
WdsCopyBlackboardItemsEx
WdsDestroyBlackboard
WdsUnpackCollection
WdsEnableExit
WdsInitializeDataUInt32
WdsGetBlackboardValue
WdsValidBlackboard
WdsInitialize
WdsSetupLogMessageW
CurrentIP
ConstructPartialMsgVW
WdsExecuteWorkQueueEx
WdsSetupLogDestroy
WdsTerminate
WdsEnumFirstBlackboardItem
WdsEnumNextBlackboardItem
WdsAbortBlackboardItemEnum
WdsInitializeCallbackArray
WdsPublish
WdsSubscribeEx
WdsCreateBlackboard
WdsCollectionGetValue

wdsutil

WdsPickTempDriveBasedOnInstallDrive
PublishMessage
SignalSetupComplianceBlock
GetDiskKey
GetRegionKey
IsCrossArchitectureInstall
CallbackGetArgumentInt32
?IsUpgrade@CUpgradeUserSetting@@SAHXZ
WdsValidateInstallDrive
GetApplicableDiskRegionReason
FreeReason
GetApplicableDiskReason
LogDiskRegionReasons
DiskRegionSupportsCapabilityForType
LogDiskReasons
DiskSupportsCapabilityForType
CallbackGetArgumentUInt64

ntdll

NtOpenFile
NtSetValueKey
NtDeviceIoControlFile
NtQuerySymbolicLinkObject
NtOpenKey
NtOpenSymbolicLinkObject
RtlImpersonateSelf
NtShutdownSystem
RtlAdjustPrivilege
RtlNtStatusToDosError
RtlInitUnicodeString
NtCreatePagingFile
ZwQuerySystemInformation
RtlGUIDFromString
RtlFreeUnicodeString
RtlStringFromGUID
RtlFreeHeap
RtlAllocateHeap
RtlAppendUnicodeToString
ZwQueryAttributesFile
ZwWaitForSingleObject
ZwQueryKey
ZwReleaseMutant
ZwOpenFile
ZwOpenMutant
ZwClose
RtlLengthSecurityDescriptor
NtPrivilegeCheck
RtlSetOwnerSecurityDescriptor
RtlSetDaclSecurityDescriptor
ZwCreateFile
ZwCreateKey
ZwLoadKey
RtlAddAccessAllowedAceEx
RtlAllocateAndInitializeSid
RtlLengthSid
ZwFlushKey
ZwDeleteValueKey
ZwSaveKey
RtlFreeSid
ZwDeleteKey
ZwEnumerateKey
ZwQueryValueKey
RtlCreateAcl
ZwSetSecurityObject
ZwUnloadKey
RtlCreateSecurityDescriptor
NtClose
RtlRaiseStatus
DbgPrintEx
LdrAccessResource
LdrFindResource_U
NtWaitForSingleObject
NtQueryInformationThread
NtQueryInformationFile
NtCreateEvent
RtlImageNtHeader
NtOpenProcess
NtQueryInformationProcess
NtSetInformationFile
NtCreateFile
NtQueryObject
RtlImageDirectoryEntryToData
RtlVerifyVersionInfo
VerSetConditionMask
LdrResSearchResource
ZwMapViewOfSection
ZwUnmapViewOfSection
RtlAnsiStringToUnicodeString
RtlxAnsiStringToUnicodeSize
RtlInitString
ZwSetInformationProcess
ZwCreateSection
RtlFormatCurrentUserKeyPath
RtlInitUnicodeStringEx
RtlNtPathNameToDosPathName
RtlpEnsureBufferSize
ZwQueryDirectoryFile
RtlDosPathNameToNtPathName_U_WithStatus
RtlGetNativeSystemInformation
RtlUpcaseUnicodeChar
NtReadFile
NtWriteFile
NtQueryValueKey
RtlRunOnceExecuteOnce
RtlAppendUnicodeStringToString
RtlReAllocateHeap
RtlGetVersion
NtCreateKey
NtEnumerateBootEntries
NtQueryDirectoryObject
NtOpenDirectoryObject
NtTranslateFilePath
NtSetSecurityObject
NtQueryBootOptions
NtQueryBootEntryOrder
NtDeleteKey
DbgPrint
NtDeleteFile
RtlGetThreadErrorMode
RtlSetThreadErrorMode
NtFsControlFile
NtQueryDirectoryFile
RtlDosPathNameToNtPathName_U
NtOpenEvent
RtlValidSid
EtwEventWrite
NtQueryKey
NtFlushKey
NtDeleteValueKey
NtSaveKeyEx
NtQuerySystemTime
RtlSetEnvironmentVariable
RtlCreateEnvironment
RtlDestroyEnvironment
RtlExpandEnvironmentStrings_U
RtlGetControlSecurityDescriptor
RtlConvertSidToUnicodeString
RtlSetControlSecurityDescriptor
NtQuerySecurityObject
NtQuerySystemEnvironmentValueEx
NtEnumerateKey
NtEnumerateValueKey
NtLoadKey
NtDelayExecution
NtUnloadKey
RtlGetAce
RtlAddAccessAllowedAce
NtRestoreKey
RtlEqualUnicodeString
NtQueryVolumeInformationFile
NtQueryAttributesFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetSystemInformation
RtlGetLastNtStatus
RtlFindAceByType
NtUnloadKey2
NtQueryEaFile
NtSetEaFile
RtlInitializeResource
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlReleaseResource
RtlDeleteResource
RtlInitializeCriticalSection
ZwSetValueKey
ZwOpenKey
ZwAllocateUuids
ZwQuerySymbolicLinkObject
ZwDeviceIoControlFile
ZwQueryDirectoryObject
ZwOpenSymbolicLinkObject
ZwOpenDirectoryObject
LdrGetProcedureAddress
ZwQueryVolumeInformationFile
LdrGetDllHandle
ZwQueryInformationProcess
RtlInitAnsiString
ZwDeleteFile
ZwQueryInformationFile
ZwOpenProcess
NtQuerySystemInformation
NtAdjustPrivilegesToken
NtOpenProcessTokenEx
NtSetInformationThread
NtOpenThreadTokenEx

input

ord104
ord109
ord112
ord107
ord106
ord105

unbcl

??0?$SmartPtr@V?$Array@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAA@PEAV?$Array@PEAVString@UnBCL@@@1@@Z
?GetFiles@Directory@UnBCL@@SAPEAV?$Array@PEAVString@UnBCL@@@2@PEBVString@2@0H@Z
??1?$SmartPtr@V?$Array@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@UEAA@XZ
??C?$SmartPtr@V?$Array@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$Array@PEAVString@UnBCL@@@1@XZ
?GetFileName@Path@UnBCL@@SAPEAVString@2@PEBV32@@Z
?Combine@Path@UnBCL@@SAPEAVString@2@PEBV32@0@Z
?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ
?Compare@String@UnBCL@@SAHPEBG0H@Z
?GetDirectoriesAndFiles@Directory@UnBCL@@SAPEAV?$Array@PEAVString@UnBCL@@@2@PEBVString@2@0W4EnumerationType@12@H@Z
?get_IsEmpty@String@UnBCL@@QEBAHXZ
??0Win32Exception@UnBCL@@QEAA@KPEBG@Z
??1Win32Exception@UnBCL@@UEAA@XZ
?CreateDir@Directory@UnBCL@@SAPEAVDirectoryInfo@2@PEBVString@2@@Z
??0?$Array@E@UnBCL@@QEAA@HH@Z
??_D?$Array@E@UnBCL@@QEAAXXZ
?GetBuffer@?$Array@E@UnBCL@@UEAAPEAEH@Z
?get_P@?$SmartPtr@V?$Array@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$Array@PEAVString@UnBCL@@@2@XZ
?get_Chars@String@UnBCL@@QEBAAEBGH@Z
?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAPEAVString@2@XZ
??0String@UnBCL@@QEAA@PEBV01@@Z
?EndsWith@String@UnBCL@@QEBAHPEBGH@Z
?StartsWith@String@UnBCL@@QEBAHPEBGH@Z
??1Exception@UnBCL@@UEAA@XZ
?get_Length@String@UnBCL@@QEBAHXZ
??1ISerializable@UnBCL@@UEAA@XZ
??1?$IList@E@UnBCL@@UEAA@XZ
??1?$ICollection@E@UnBCL@@UEAA@XZ
?Exists@File@UnBCL@@SAHPEBVString@2@@Z
?Nullify@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV12@XZ
??D?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAAEAVString@1@XZ
?SetCompressionState@File@UnBCL@@SAHPEBVString@2@G@Z
?Delete@File@UnBCL@@SAXPEBVString@2@@Z
??0?$Array@E@UnBCL@@QEAA@PEBU?$ICollection@E@1@@Z
?Clone@?$Array@E@UnBCL@@UEBAPEAVObject@2@XZ
?Equals@?$Array@E@UnBCL@@UEBAHPEBVObject@2@@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@H@Z
?WriteBytes@SerializationStream@UnBCL@@QEAAXPEBEH@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAH@Z
?ReadBytes@SerializationStream@UnBCL@@QEAAXPEAEH@Z
?SanitizeTypeName@SerializationStream@UnBCL@@SAPEAVString@2@AEBV32@@Z
??2Object@UnBCL@@SAPEAX_KI@Z
??0String@UnBCL@@QEAA@AEBV01@@Z
?GetCallingModule@SerializationStream@UnBCL@@SAPEAUHINSTANCE__@@XZ
?CanRegister@SerializationStream@UnBCL@@SAHXZ
?RegisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z
?EnqueueSbRegistration@SbRegistrationList@UnBCL@@SAXPEBDHPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z
??0Exception@UnBCL@@QEAA@PEBG@Z
?UnregisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@@Z
??0IInstanceFactory@UnBCL@@QEAA@XZ
??0ISerializable@UnBCL@@QEAA@XZ
??0?$IList@E@UnBCL@@QEAA@XZ
??0?$ICollection@E@UnBCL@@QEAA@XZ
??0?$IEnumerable@E@UnBCL@@QEAA@XZ
?ExpandEnvironmentVariables@Environment@UnBCL@@SAPEAVString@2@PEBV32@@Z
?Delete@Directory@UnBCL@@SAXPEBVString@2@H@Z
?Concat@String@UnBCL@@SAPEAV12@PEBG0@Z
?Substring@String@UnBCL@@QEBAPEAV12@HH@Z
?get_Win32ErrorCode@Win32Exception@UnBCL@@QEBAKXZ
?GetEnvironmentVar@Environment@UnBCL@@SAPEAVString@2@PEBV32@@Z
?Assign@?$SmartPtr@VString@UnBCL@@@UnBCL@@AEAAXPEAVString@2@@Z
?get_Item@XmlAttributeCollection@UnBCL@@QEAAPEAVXmlAttribute@2@PEAVString@2@@Z
?GetStackTrace@Exception@UnBCL@@QEBAPEAVString@2@XZ
?Clone@?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@UEBAPEAVObject@2@XZ
??0?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@QEAA@HH@Z
??0InvalidCastException@UnBCL@@QEAA@XZ
?SelectSingleNode@XmlNode@UnBCL@@QEAAPEAV12@PEAVString@2@@Z
?SelectNodes@XmlNode@UnBCL@@QEAAPEAVXmlNodeList@2@PEAVString@2@@Z
?get_Value@XmlNode@UnBCL@@QEAAPEAVString@2@XZ
?get_Attributes@XmlNode@UnBCL@@QEAAPEAVXmlAttributeCollection@2@XZ
?Load@XmlDocument@UnBCL@@QEAAXPEAVString@2@@Z
??1XmlDocument@UnBCL@@UEAA@XZ
??0XmlDocument@UnBCL@@QEAA@XZ
?get_P@?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@2@XZ
??C?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@1@XZ
??4?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z
??1?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@UEAA@XZ
??0?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAA@XZ
??0?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAA@PEAV?$ArrayList@PEAVString@UnBCL@@@1@@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAK@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAVString@1@@Z
??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAUISerializable@1@@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@K@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@PEBVString@1@@Z
??6SerializationStream@UnBCL@@QEAAAEAV01@PEBUISerializable@1@@Z
?Compare@String@UnBCL@@SAHPEBV12@0H@Z
?ToLower@String@UnBCL@@QEBAPEAV12@XZ
?Split@String@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@2@PEBG@Z
?LastIndexOf@String@UnBCL@@QEBAHG@Z
?CompareTo@String@UnBCL@@QEBAHPEBG@Z
?CompareTo@String@UnBCL@@QEBAHPEBGH@Z
?get_Item@XmlNodeList@UnBCL@@QEAAPEAVXmlNode@2@H@Z
?get_Count@XmlNodeList@UnBCL@@QEAAHXZ
??0Object@UnBCL@@QEAA@AEBV01@@Z
??0Win32Exception@UnBCL@@QEAA@K@Z
??1InvalidCastException@UnBCL@@UEAA@XZ
??1?$IEnumerator@PEAVString@UnBCL@@@UnBCL@@UEAA@XZ
??0?$IEnumerator@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ
??4Object@UnBCL@@QEAAAEAV01@AEBV01@@Z
??0?$ICollection@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ
??0?$IEnumerable@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ
??1?$ICollection@PEAVString@UnBCL@@@UnBCL@@UEAA@XZ
??_D?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@QEAAXXZ
?Append@MutableString@UnBCL@@QEAAXPEBG@Z
?Clone@MultiSz@UnBCL@@UEBAPEAVObject@2@XZ
?ToString@MultiSz@UnBCL@@UEBAPEAVString@2@XZ
?Add@MultiSz@UnBCL@@QEAAXPEBG@Z
?get_Buffer@MultiSz@UnBCL@@QEBAPEBGXZ
??0MultiSz@UnBCL@@QEAA@XZ
?Trim@String@UnBCL@@QEBAPEAV12@PEBG@Z
?Substring@String@UnBCL@@QEBAPEAV12@H@Z
?IndexOf@String@UnBCL@@QEBAHPEBGH@Z
??_DMultiSz@UnBCL@@QEAAXXZ
?MakeTrim@MutableString@UnBCL@@QEAAXPEBG@Z
??0MutableString@UnBCL@@QEAA@PEBG@Z
?IsEnvironmentVarSetTrue@Environment@UnBCL@@SAHPEBVString@2@H@Z
??0OutOfMemoryException@UnBCL@@QEAA@XZ
?IndexOf@String@UnBCL@@QEBAHG@Z
??0String@UnBCL@@QEAA@PEBGHH@Z
??1OutOfMemoryException@UnBCL@@UEAA@XZ
?get_ChildNodes@XmlNode@UnBCL@@QEAAPEAVXmlNodeList@2@XZ
?get_Name@XmlNode@UnBCL@@QEAAPEAVString@2@XZ
?get_Count@XmlAttributeCollection@UnBCL@@QEAAHXZ
?FormatV@String@UnBCL@@SAPEAV12@PEBGPEAD@Z
??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z
?Concat@String@UnBCL@@SAPEAV12@PEBG00@Z
?Copy@Directory@UnBCL@@SAXPEBVString@2@0HPEAUICopyDelegate@12@@Z
?Exists@Directory@UnBCL@@SAHPEBVString@2@@Z
??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ
??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ
?GetParentPath@Path@UnBCL@@SAPEAVString@2@PEBV32@@Z
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z
??4MutableString@UnBCL@@QEAAAEAV01@PEBG@Z
??0MutableString@UnBCL@@QEAA@XZ
?Tokenize@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBA?AV12@PEBGAEAH@Z
??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@AEBV01@@Z
?Compare@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAHPEBG@Z
??1?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@XZ
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBD@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBG@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@XZ
?SetAt@?$CSimpleStringT@G$0A@@ATL@@QEAAXHG@Z
?GetManager@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBAPEAUIAtlStringMgr@2@XZ
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@AEBV01@@Z
??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEAUIAtlStringMgr@1@@Z
?Concatenate@?$CSimpleStringT@G$0A@@ATL@@KAXAEAV12@PEBGH1H@Z
?Append@?$CSimpleStringT@G$0A@@ATL@@QEAAXPEBG@Z
?Empty@?$CSimpleStringT@G$0A@@ATL@@QEAAXXZ
??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@PEBG@Z
?Format@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXPEBGZZ
??3Object@UnBCL@@SAXPEAX@Z
??1String@UnBCL@@UEAA@XZ
??0String@UnBCL@@QEAA@PEBG@Z
??0Object@UnBCL@@QEAA@XZ
??1Object@UnBCL@@UEAA@XZ
??2Object@UnBCL@@SAPEAX_K@Z
?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z
?MemAllocFailed@Allocator@UnBCL@@SAHXZ
??0ArgumentOutOfRangeException@UnBCL@@QEAA@PEBG@Z
??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z
??0ArgumentException@UnBCL@@QEAA@PEBG@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@PEAVException@1@@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBG@Z
??0NotSupportedException@UnBCL@@QEAA@PEBG@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@@Z
?Equals@Object@UnBCL@@UEBAHPEBV12@@Z
?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z
?AddRef@Object@UnBCL@@QEAAXXZ
?DecRef@Object@UnBCL@@QEAAHXZ
?SetLiteralStorage@_@UnBCL@@YAXPEAPEBVString@2@PEBG@Z
?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z
?GetHashCode@String@UnBCL@@UEBAHXZ
?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ
?ToString@String@UnBCL@@UEBAPEAV12@XZ
?GetObjectID@Object@UnBCL@@UEBAIXZ
?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z
?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ
?GetHashCode@Object@UnBCL@@UEBAHXZ
?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ
?Clone@Object@UnBCL@@UEBAPEAV12@XZ
?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ
?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ
?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z
?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ
?get_HResult@Exception@UnBCL@@UEBAJXZ
?set_HResult@Exception@UnBCL@@MEAAXJ@Z
?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z
?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ
?FromASCII@String@UnBCL@@SAPEAV12@PEBD@Z
??1NotSupportedException@UnBCL@@UEAA@XZ
??1InvalidOperationException@UnBCL@@UEAA@XZ
??1ArgumentOutOfRangeException@UnBCL@@UEAA@XZ
??1ArgumentException@UnBCL@@UEAA@XZ
??1ArgumentNullException@UnBCL@@UEAA@XZ
??1MutableString@UnBCL@@UEAA@XZ
?get_CString@String@UnBCL@@QEBAPEBGXZ
??0ApplicationException@UnBCL@@QEAA@PEBG@Z
??1ApplicationException@UnBCL@@UEAA@XZ
?Format@String@UnBCL@@SAPEAV12@PEBGZZ
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@XZ

unattend

UnattendEnumFree
UnattendCtxEnumGet
UnattendCtxEnumOrderedSubNodes
UnattendFreeNode
UnattendCtxOpenNode
UnattendCtxGetCount
UnattendFreeResults
UnattendCtxGetFlag
UnattendCtxGetString
UnattendCtxGetShowUI
UnattendCtxGetCountByNode
UnattendCtxCommitModify
UnattendCtxOpenNodeByNode
UnattendCtxGetUlongByNode
UnattendCtxDeserializeBuffer
UnattendCtxCleanup
UnattendCtxGetEnumValueByNode
UnattendCtxCancelModify
UnattendCtxSerializeSettingsStream
UnattendCtxGetRootNode
UnattendCtxSerializeToBuffer
UnattendCtxReplaceNode
UnattendCtxGetStringByNode
UnattendCtxSerialize
UnattendCtxGetUlong
UnattendCtxSetNodeName
UnattendCtxPrettyPrint
UnattendCtxGetLongByNode
UnattendCtxGetExpandedStringByNode
UnattendFindAnswerFileWithResults
UnattendGetImplicitContext
UnattendGetFirstFailingSetting
UnattendCleanup
UnattendCtxGetFlagByNode
UnattendFreeSetting
UnattendIsNodeValid
UnattendCtxSpliceTrees
UnattendCtxSetStringByNode
UnattendCtxSerializeToBufferFromNode
UnattendCtxSetString
UnattendCtxDeserializeString
UnattendAddResults
UnattendCtxDeserialize
UnattendMarkPassUsedInCtx
UnattendCtxBeginModify
UnattendDeserializeWithResults
UnattendCtxGetLong
UnattendFormatPath
UnattendCtxReplaceMatchedNodesWithText

gdi32

GdiAlphaBlend
CreateDIBitmap
GetTextMetricsW
SetBkColor
SetLayout
GetTextAlign
SetMapMode
SetTextAlign
SetWorldTransform
SetGraphicsMode
AddFontMemResourceEx
SetBrushOrgEx
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetStockObject
GetDeviceCaps
GetTextExtentPoint32W
SetTextColor
SetBkMode
GetObjectW
TranslateCharsetInfo
DeleteDC
CreateDCW
EnumFontFamiliesExW
SetTextCharacterExtra
CreateFontIndirectW
RemoveFontMemResourceEx
CreateSolidBrush
DeleteObject
SetStretchBltMode
TextOutW

mpr

WNetCancelConnection2W
WNetAddConnection2W

version

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

wininet

InternetQueryOptionW
InternetGetConnectedState
InternetSetOptionW

cfgmgr32

CMP_WaitNoPendingInstallEvents
CM_Get_Parent
CM_Get_Device_ID_ExW
CM_Get_DevNode_Registry_PropertyW
CM_Get_Device_ID_Size_Ex

bcrypt

BCryptHashData
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
BCryptDestroyKey
BCryptVerifySignature
BCryptImportKeyPair
BCryptFinishHash

fltlib

FilterAttach
FilterLoad

cabinet

ord23
ord20
ord22

Exports

Exports

??4DUMgr@@QEAAAEAV0@AEBV0@@Z
?GetModuleId@DUMgr@@QEAAAEBQEAXXZ
?Instance@DUMgr@@SAPEAV1@XZ
?IsCancelled@DUMgr@@AEAAHXZ
?SetModuleId@DUMgr@@QEAAXPEAX@Z
?SetPhase@DUMgr@@AEAAXW4DUPhase@@@Z
FreeResourceHandle
GetCleanInstallCheckpointSequence
GetSpaceNeededForWinPE
InstallCopyCodeUpdate
InstallSetupUpdates
InstallWindows
Module_Init_BootPrepare
Module_Init_Bootstrap
Module_Init_CBS
Module_Init_Cleanup
Module_Init_Compliance
Module_Init_ComputerName
Module_Init_ConfigOfflineImage
Module_Init_ConfigSet
Module_Init_CopyImages
Module_Init_CopyPrivates
Module_Init_CopySetupFiles
Module_Init_DU
Module_Init_DeployImages
Module_Init_DiskConfiguration
Module_Init_DiskSpace
Module_Init_Ems
Module_Init_Engine
Module_Init_ErrorHandler
Module_Init_ExternalDrivers
Module_Init_Finalize_Image
Module_Init_FixBBPaths
Module_Init_GatherDiskInfo
Module_Init_ImageInstall
Module_Init_ImageTransfer
Module_Init_Internal
Module_Init_LanguagePack
Module_Init_License
Module_Init_Locale
Module_Init_ModuleLoader
Module_Init_MountedDevices
Module_Init_MungeBootEntries
Module_Init_OnlineSettings
Module_Init_PageFile
Module_Init_ParseCmdLine
Module_Init_PickTempDrive
Module_Init_PrepareInstallDrive
Module_Init_Productkey
Module_Init_QFE
Module_Init_RestartSetup
Module_Init_Rollback
Module_Init_ScenarioDetect
Module_Init_SourceMedia
Module_Init_Sysprep
Module_Init_SystemRestore
Module_Init_Unattend
PublishDiskInfoOnBlackboard
SetFileCopyErrorResult
SetFileCopyErrorResultFromStruct
SetResourceHandle
Sysprep_Specialize_Offline_Pnp_Compat
Sysprep_Specialize_Pnp_Compat
UnattendErrorFromResults
g_hwCompatParams
g_pUnattendCtxIBS

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab8e1e9eb2026051e03c52024771ef37

Headers

File Characteristics

Imports

libgcc_s_dw2-1

advapi32

kernel32

mingwm10

msvcrt

ole32

user32

ws2_32

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.data Size: 23KB - Virtual size: 23KB

.rdata Size: 822KB - Virtual size: 821KB

.bss Size: - Virtual size: 6KB

.edata Size: 185KB - Virtual size: 185KB

.idata Size: 8KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 840B

.reloc Size: 58KB - Virtual size: 58KB

Headers

File Characteristics

Sections

.text Size: 512B - Virtual size: 4KB

.bss Size: - Virtual size: 4KB

.rsrc Size: 26KB - Virtual size: 28KB

.idata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size:

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 148KB

UPX1 Size: 45KB - Virtual size: 48KB

.rsrc Size: 11KB - Virtual size: 12KB

22de106f971ff0449d33ea6ca7f9dcba

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 30KB - Virtual size: 30KB

.data Size: 512B - Virtual size: 40B

.rdata Size: 4KB - Virtual size: 4KB

.bss Size: - Virtual size: 264B

.edata Size: 2KB - Virtual size: 2KB

.idata Size: 1024B - Virtual size: 852B

.reloc Size: 2KB - Virtual size: 1KB

03e7672c8b423d2d726a1731f8c39711

Headers

File Characteristics

Imports

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 4B

.bss Size: - Virtual size: 132B

.edata Size: 512B - Virtual size: 120B

.idata Size: 512B - Virtual size: 456B

.reloc Size: 512B - Virtual size: 120B

22de106f971ff0449d33ea6ca7f9dcba

Headers

File Characteristics

Imports

kernel32

.text
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 23KB - Virtual size: 23KB

.rdata
Size: 822KB - Virtual size: 821KB

.bss
Size: - Virtual size: 6KB

.edata
Size: 185KB - Virtual size: 185KB

.idata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 840B

.reloc
Size: 58KB - Virtual size: 58KB

.text
Size: 512B - Virtual size: 4KB

.bss
Size: - Virtual size: 4KB

.rsrc
Size: 26KB - Virtual size: 28KB

.idata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size:

UPX0
Size: - Virtual size: 148KB

UPX1
Size: 45KB - Virtual size: 48KB

.rsrc
Size: 11KB - Virtual size: 12KB

.text
Size: 30KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 40B

.rdata
Size: 4KB - Virtual size: 4KB

.bss
Size: - Virtual size: 264B

.edata
Size: 2KB - Virtual size: 2KB

.idata
Size: 1024B - Virtual size: 852B

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4B

.bss
Size: - Virtual size: 132B

.edata
Size: 512B - Virtual size: 120B

.idata
Size: 512B - Virtual size: 456B

.reloc
Size: 512B - Virtual size: 120B

.text
Size: 30KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 40B

.rdata
Size: 4KB - Virtual size: 4KB

.bss
Size: - Virtual size: 264B

.edata
Size: 2KB - Virtual size: 2KB

.idata
Size: 1024B - Virtual size: 852B

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 44KB - Virtual size: 44KB

.data
Size: 512B - Virtual size: 112B

.rdata
Size: 17KB - Virtual size: 16KB

.bss
Size: - Virtual size: 208B

.edata
Size: 1KB - Virtual size: 1KB

.idata
Size: 1024B - Virtual size: 840B

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 780B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

1f:73:4d:11:1b:4b:5c:87:9b:bd:5a:8c:49:ab:2a:90
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

ad:d4:63:d6:92:1b:29:7a:59:f9:a4:d5:57:98:96:29:15:da:8c:7f:01:bd:2f:8d:79:3b:16:f4:36:e3:8a:5c
Signer

09/03/2023, 18:59
Valid: true

.text
Size: 31KB - Virtual size: 30KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 1024B - Virtual size: 7KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 577KB - Virtual size: 577KB