bd5ce51a9d3de9c327bd49055462e864e8f9b96e9050cec78ed31ea0c5ec7241

Sharing

Copy URL Twitter E-mail

General

Target

bd5ce51a9d3de9c327bd49055462e864e8f9b96e9050cec78ed31ea0c5ec7241
Size

4.2MB
MD5

16a5f60da902baa08772a89c78c036ed
SHA1

0ad838d963b947e030fcf05af5a7908d262db0de
SHA256

bd5ce51a9d3de9c327bd49055462e864e8f9b96e9050cec78ed31ea0c5ec7241
SHA512

9c9758a4eee5273ae83c222cb2a2f73744add25be549565ac4b90369aac303217dae49595798d96dfaccd3bf8b29e25dea471d162b5a77a50443bde9ef547295
SSDEEP

98304:/eeWZOXyLhZPiOugo1BtIHWXNpOwCreavtHRit6HJnY/:/eeWoCLhxRoO2XNfzCtsci/

Score

3^/10

pdf link

Malware Config

Signatures

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CICD问题反馈及跟进/__MACOSX/.__MACOS__/.__MACOS__/sqlite3.dll

Files

bd5ce51a9d3de9c327bd49055462e864e8f9b96e9050cec78ed31ea0c5ec7241
.zip
CICD问题反馈及跟进/CICD问题反馈及跟进.pdf.lnk
.lnk
CICD问题反馈及跟进/__MACOSX/.__MACOS__/.__MACOS__/1.pdf
.pdf
- https://sre.wps.cn/kae/app-center/app-instance?app_id=28090&team_id=102&folder_id=1550
- https://sre.wps.cn/kcicd/pipeline/detail?name=encs-cicd-bgd-1-cgehl0if16l0b9be101g&projectId=22&page=1&from-tag=%E8%93%9D%E7%BB%BF%E5%8F%91%E5%B8%83
- https://sre.wps.cn/kae/app-center/app-instance?app_id=27558&team_id=102&folder_id=1753
- https://sre.wps.cn/kae/app-center/app-instance?team_id=38&id=4892&page=1&app_id=29620
- https://sre.wps.cn/kae/app/buildconfig?app_id=32427
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cheqaqqf16lesuktqqs0&projectId=16
- https://sre.wps.cn/kae/app-center/app-instance?team_id=7&id=222&page=1&app_id=20328
- https://sre.wps.cn/kcicd/pipeline/detail-edit?name=kae-proxysql-pay-c71c0luvpmmvmdjvk39g&projectId=14&page=1&from-tag=%E6%9C%AA%E5%88%86%E7%BB%84
- https://woa.wps.cn/invite/qiru43Z463V?channel=stable
- https://woa.wps.cn/invite/6Vru4YH44lp?channel=stable
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cigjijb3pi217hjo5ol0&projectId=5462971&page=1&from-tag=test
- https://sre.wps.cn/kae/app-center/app-instance?team_id=98&id=6263&page=1&app_id=34580
- https://sre.wps.cn/kae/app/buildconfig?app_id=360&from=kae
- https://sre.wps.cn/kae/app/buildconfig?app_id=9420&team_id=39&from=kae
- https://sre.wps.cn/kae/app-center/app-instance?team_id=14&id=166&app_id=32327
- https://sre.wps.cn/kcicd/secret/
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-ci9busr3pi217hjnta1g&projectId=155&page=1&from-tag=%E6%9C%AA%E5%88%86%E7%BB%84
- https://sre.wps.cn/kae/app-center/app-instance?team_id=119&id=882&page=1&app_id=17122
- https://sre.wps.cn/kae/app/buildconfig?app_id=6886
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cggm9g2f16l0b9be2l7g&projectId=25&page=1&from-tag=%E5%8C%97%E4%BA%AC%E7%A0%94%E5%8F%91%E7%BB%84
- https://sre.wps.cn/kae/app-center/app-instance?team_id=43&id=3761&page=1&app_id=26324
- https://sre.wps.cn/kcicd/pipeline/detail?name=smart-font-api.docer.wps.cn-ci4jfij3pi217hjnmrpg&projectId=8553454&page=1&from-tag=%E5%85%A8%E9%83%A8%E6%B5%81%E6%B0%B4%E7%BA%BF
- https://sre.wps.cn/kae/app-center/app-instance?team_id=21&id=2000&page=1&app_id=21890
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-ci3emaj3pi217hjnl4bg&projectId=8553454&page=1&from-tag=%E6%9C%AA%E5%88%86%E7%BB%84
- https://sre.wps.cn/kcicd/pipeline/detail?name=ovs-shopwindow-server-prod-c8bjd71in6qihn4vnm5g&projectId=119&page=1&from-tag=%E6%9C%AA%E5%88%86%E7%BB%84
- https://sre.wps.cn/kae/app/buildconfig?app_id=16075&team_id=154&from=kae
- https://sre.wps.cn/kae/app-center/app-instance?team_id=43&id=3761&page=1&app_id=28305
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cgbslpaf16letp8cljb0&projectId=16&page=1&from-tag=indep-project
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-chskrmb3pi217hjncvn0
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cgl90tif16lbj81cr1lg&projectId=4537870&page=1&from-tag=%E5%AD%A6%E5%A0%82
- https://sre.wps.cn/kae/app-center/app-instance?app_id=27625&team_id=102&folder_id=1753
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-chmtipaf16lesuku55d0&projectId=2020545&page=1&from-tag=%E6%9C%AA%E5%88%86%E7%BB%84
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cheqauaf16lesuktqqug&projectId=16
- https://sre.wps.cn/kcicd/pipeline/detail-edit?name=p-chi8ivif16lesuktv170&projectId=39
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-ch13gbqf16lesukt9elg&projectId=42&page=1&from-tag=%E6%9C%AA%E5%88%86%E7%BB%84
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cfl119qf16letp8c0o40&projectId=110&page=1&from-tag=KNET
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-ch20haaf16lesuktaadg&projectId=25&page=1&from-tag=%E6%AD%A6%E6%B1%89%E7%A0%94%E5%8F%91%E7%BB%84
- https://sre.wps.cn/kcicd/pipeline/detail?name=vas-admin-c9lkh19in6qlpgfraa40&projectId=44&page=1&from-tag=%E6%A8%A1%E6%9D%BF%E5%BA%94%E7%94%A8%E5%89%8D%E7%AB%AF-%E6%B5%8B%E8%AF%95
- https://sre.wps.cn/kae/app-center/app-instance?team_id=4537870&id=5281&page=1&app_id=31874
- https://sre.wps.cn/kae/app-center/app-instance?team_id=119&id=711&page=1&app_id=30766
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cdd3jqmj5i3vih7t659g&projectId=43&page=1&from-tag=vas-vip
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-chiv07af16lesuku07kg&projectId=4537870&page=1&from-tag=vas-basic
- https://sre.wps.cn/kcicd/pipeline/detail?name=wpsgit-c8k6c0mj5i3qqs4eip10-caonbquj5i3slq35fmvg&projectId=44&page=1&from-tag=%E6%A8%A1%E6%9D%BF%E5%BA%94%E7%94%A8%E5%89%8D%E7%AB%AF-%E6%B5%8B%E8%AF%95
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-c9jplu9in6qlpgfra2c0&projectId=44&page=1&from-tag=%E6%A8%A1%E6%9D%BF%E5%BA%94%E7%94%A8%E5%89%8D%E7%AB%AF-%E6%B5%8B%E8%AF%95
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cge3vdqf16l0b9be0ku0&projectId=16&page=1&from-tag=indep-project
- https://sre.wps.cn/kae/app/buildconfig?app_id=28992&team_id=95&from=kae
- https://sre.wps.cn/kae/app/buildconfig?app_id=31279&team_id=50&from=kae
- https://sre.wps.cn/kae/app/buildconfig?app_id=17843&team_id=39&from=kae
- https://sre.wps.cn/kcicd/pipeline/detail-edit?name=p-cgj401af16l0b9be5kug&projectId=52
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-chca0nif16lesuktmks0&projectId=155&page=1&from-tag=%E6%9C%AA%E5%88%86%E7%BB%84
- https://sre.wps.cn/kae/app-center/app-instance?team_id=9877522&id=2886&page=1&app_id=23923
- https://sre.wps.cn/kae/app-center/app-instance?team_id=155&id=812&page=1&app_id=18909
- https://sre.wps.cn/kae/app-center/app-instance?team_id=2020545&id=3989&page=1&app_id=27039
- https://sre.wps.cn/kcicd/pipeline/detail-edit?name=p-ch13gbqf16lesukt9elg&projectId=42&page=1&from-tag=%E6%9C%AA%E5%88%86%E7%BB%84
- https://sre.wps.cn/kae/integration/pipeline_detail?id=5519&team_id=21&name=encs-node-builder&from_page=1
- https://sre.wps.cn/kae/app-center/app-instance?team_id=92&id=4309&page=1&app_id=29104
- https://sre.wps.cn/kcicd/pipeline/detail-edit?name=p-cgcljuif16letp8cmlb0&projectId=42&page=1&from-tag=%E7%BE%8E%E5%8C%96%E5%89%8D%E7%AB%AF
- https://sre.wps.cn/kcicd/pipeline/detail?name=123-cgsb282f16la5jmg9esg&projectId=42&page=1&from-tag=%E7%BE%8E%E5%8C%96%E5%89%8D%E7%AB%AF
- https://sre.wps.cn/kae/app/buildconfig?app_id=12332&from=kae
- https://sre.wps.cn/kcicd/pipeline/detail-edit?name=p-cgnrsdif16lbj81ctkv0&projectId=39&page=1&from-tag=%E3%80%90%E5%89%8D%E7%AB%AF%E3%80%91%E7%BE%8E%E5%8C%96%E4%B8%9A%E5%8A%A1
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cgqh9nif16l7917uppo0&projectId=4537870&page=1&from-tag=%E5%AD%A6%E5%A0%82
- https://sre.wps.cn/kae/app-center/app-instance?app_id=31076&team_id=95&folder_id=2109
- https://sre.wps.cn/kae/app-center/app-instance?app_id=31050&team_id=95&folder_id=2109
- https://sre.wps.cn/kae/app-center/app-instance?team_id=9877522&id=3424&page=2&app_id=25571
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cgn66q2f16lbj81csk3g&projectId=21&page=1&from-tag=beta%E5%BA%94%E7%94%A8%E6%B5%81%E6%B0%B4%E7%BA%BF
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cgiomb2f16l0b9be5feg&projectId=95
- https://sre.wps.cn/kcicd/pipeline/detail-edit?name=p-cg98dm2f16letp8cjht0&projectId=39
- https://sre.wps.cn/kae/app-center/app-instance?team_id=43&id=4780&page=1&app_id=29276
- https://sre.wps.cn/kcicd/pipeline/detail-edit?name=p-cgcq5a2f16letp8cn33g&projectId=3226917&page=1&from-tag=nuclio
- https://sre.wps.cn/kae/app-center/app-instance?team_id=16&id=5062&page=1&app_id=30457
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cgdailaf16letp8cnikg&projectId=43&page=1&from-tag=%E5%85%A8%E9%83%A8%E6%B5%81%E6%B0%B4%E7%BA%BF
- https://sre.wps.cn/kae/app-center/app-instance?team_id=31&id=4321&page=1&app_id=28250
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cg9dh32f16letp8cjtv0&projectId=38
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cga1p9af16letp8cklq0&projectId=25&page=1&from-tag=%E5%8C%97%E4%BA%AC%E7%A0%94%E5%8F%91%E7%BB%84
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cga1fdqf16letp8ckl00&projectId=25&page=1&from-tag=%E5%8C%97%E4%BA%AC%E7%A0%94%E5%8F%91%E7%BB%84
- https://sre.wps.cn/kae/app/kube?app_id=9124&team_id=39&from=kae
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cg9gfhif16letp8ck4h0
- https://sre.wps.cn/kae/app-center/app-instance?team_id=7&id=202&page=1&app_id=20310
- https://sre.wps.cn/kcicd/pipeline/detail-edit?name=p-cg0qtv2f16letp8cc450&projectId=92
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cg0qqe2f16letp8cc3rg&projectId=155&page=1&from-tag=%E6%9C%AA%E5%88%86%E7%BB%84
- https://sre.wps.cn/kcicd/pipeline/detail?name=auto-8aba9df6-c04a-11ec-a-c9fm819in6qmsgqnsllg&projectId=1605689&page=1&from-tag=%E4%B8%AA%E4%BA%BA%E7%89%88-%E6%B5%8B%E8%AF%95%E7%8E%AF%E5%A2%83
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-chm8cvif16lesuku4030&projectId=9850522&page=1&from-tag=kot
- https://sre.wps.cn/kae/app-center/app-instance?team_id=38&id=5280&page=1&app_id=31395
- https://sre.wps.cn/kae/app-center/app-instance?team_id=1605689&id=1820&page=1&app_id=20106
- https://sre.wps.cn/kae/app/buildconfig?app_id=10418
- https://sre.wps.cn/kae/app/kube?app_id=20939
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cfvgagif16letp8cajd0&projectId=44&page=1
- https://sre.wps.cn/kcicd/pipeline/detail?name=p-cfvhapqf16letp8camdg&projectId=98&page=1&from-tag=%E6%9C%AA%E5%88%86%E7%BB%84
- https://sre.wps.cn/kcicd/pipeline/detail?name=openevent-chs49h33pi217hjncag0&projectId=11&page=1&from-tag=%E5%85%A8%E9%83%A8%E6%B5%81%E6%B0%B4%E7%BA%BF
- Show all
CICD问题反馈及跟进/__MACOSX/.__MACOS__/.__MACOS__/Tencent.exe
.exe windows x86

6d8cb76638b176a238e38fd5b9741e89

Code Sign

07
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:93:8e:06:3f:2c:05:9f:fc:f5:54:22:39:a4:83:65
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/03/2020, 00:00

Not After

22/03/2023, 12:00

Subject

CN=Sangfor Technologies Inc.,OU=research and development department,O=Sangfor Technologies Inc.,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:e6:3a:c9:92:ef:67:ba
Certificate

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

09/09/2020, 07:00

Not After

09/09/2025, 07:00

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:37:b3:4f:a0:45:c0:00:bc:cd:99:99:6e:1e:eb:29
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/03/2020, 00:00

Not After

22/03/2023, 12:00

Subject

CN=Sangfor Technologies Inc.,OU=research and development department,O=Sangfor Technologies Inc.,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:ee:c6:4c:97:a6:57:e8:7c:96:9b:a7:0e:89:7f:fe:7d:34:47:fe:80:45:54:48:73:c1:fb:e8:7d:25:83:47
Signer

Actual PE Digest

c6:ee:c6:4c:97:a6:57:e8:7c:96:9b:a7:0e:89:7f:fe:7d:34:47:fe:80:45:54:48:73:c1:fb:e8:7d:25:83:47

Digest Algorithm

sha256

PE Digest Matches

true

22:68:70:97:21:68:a6:e1:43:ef:a4:59:4d:b9:4a:f8:31:09:bb:22
Signer

Actual PE Digest

22:68:70:97:21:68:a6:e1:43:ef:a4:59:4d:b9:4a:f8:31:09:bb:22

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AllocateAndInitializeSid
FreeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
RegSetValueExW
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
LookupAccountNameA
GetUserNameA
RegEnumValueA
RegOpenKeyA
RegOpenKeyW
RegQueryValueExA
CryptDestroyHash
CryptHashData
CryptGetHashParam
CryptCreateHash
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptImportKey
DeregisterEventSource
RegCreateKeyExW
ReportEventA
RegisterEventSourceA

ws2_32

sendto
ntohl
htonl
gethostname
ioctlsocket
listen
accept
htons
getsockopt
getpeername
closesocket
WSACleanup
WSAStartup
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
recv
send
WSAIoctl
setsockopt
getsockname
ntohs
recvfrom
socket
getaddrinfo
freeaddrinfo
connect
bind

wldap32

ord32
ord200
ord30
ord35
ord50
ord60
ord143
ord211
ord79
ord33
ord301
ord27
ord41
ord46
ord26
ord22

imm32

ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmAssociateContext

kernel32

GetConsoleMode
ExitProcess
SetConsoleCtrlHandler
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
ReadConsoleInputA
LoadLibraryExW
InterlockedPushEntrySList
RtlUnwind
CreateWaitableTimerA
GetConsoleCP
GetDateFormatW
ResumeThread
SetWaitableTimer
SetConsoleMode
HeapReAlloc
GetACP
FindFirstFileExW
ReadConsoleW
VerSetConditionMask
FreeLibrary
GetProcAddress
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
lstrlenW
LoadLibraryW
GetModuleHandleW
ExpandEnvironmentStringsW
VerifyVersionInfoW
MultiByteToWideChar
WideCharToMultiByte
GetSystemDefaultLangID
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedCompareExchange
LocalFree
GetProcessTimes
GetCurrentProcessId
SwitchToThread
GetLastError
SetLastError
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
Sleep
GetFileSizeEx
WriteFile
SetEndOfFile
SetFilePointerEx
CloseHandle
DuplicateHandle
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
FormatMessageA
UnmapViewOfFile
WaitForSingleObjectEx
GetTimeFormatW
CreateEventA
CreateSemaphoreA
CreateFileMappingA
GetModuleHandleA
ExpandEnvironmentStringsA
CreateFileA
MapViewOfFileEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetVersionExW
SetThreadLocale
CreateEventW
GetCurrentThreadId
OpenMutexA
OpenProcess
TerminateProcess
MapViewOfFile
OpenMutexW
OpenEventW
OpenFileMappingW
CreateProcessA
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetModuleFileNameA
GetModuleFileNameW
GetCurrentDirectoryW
CreateMutexW
GetCommandLineW
SetUnhandledExceptionFilter
GetLocalTime
GetCommandLineA
SetCurrentDirectoryW
DeleteFileA
LoadLibraryA
VerifyVersionInfoA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SleepEx
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
GlobalMemoryStatus
FlushConsoleInputBuffer
OpenEventA
WaitForMultipleObjectsEx
AreFileApisANSI
DeviceIoControl
RemoveDirectoryW
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
GetStartupInfoW
IsDebuggerPresent
IsValidLocale
IsProcessorFeaturePresent
UnhandledExceptionFilter
InitializeSListHead
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetCPInfo
DecodePointer
EncodePointer
LoadLibraryExA
VirtualQuery
VirtualProtect
RaiseException
FatalAppExitW
CreateThread
lstrcmpiW
AllocConsole
SetConsoleTitleW
GetTempPathW
CreateDirectoryW
CreateFileW
lstrlenA
OutputDebugStringW
CopyFileW
SetFilePointer
GetProfileIntW
DebugBreak
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
SetStdHandle
GetTimeZoneInformation
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
HeapSize
CreateMutexA

user32

GetUserObjectInformationW
GetProcessWindowStation
LoadImageA
DestroyIcon
MessageBoxA
PostMessageW
SendMessageTimeoutW
GetForegroundWindow
FindWindowW
LoadStringA
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MoveWindow
RegisterWindowMessageW
GetSystemMetrics
GetMonitorInfoA
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
RegisterClassExW
CreateWindowExW
ShowWindow
TranslateAcceleratorW
UpdateWindow
DestroyWindow
keybd_event
AllowSetForegroundWindow
GetWindowRect
SystemParametersInfoW
GetPropW
SetPropW
KillTimer
SetTimer
IsWindow
RegisterClassW
GetClassNameW
SystemParametersInfoA
LoadIconW
LoadCursorW
SetWindowLongW
GetWindowLongW
PtInRect
OffsetRect
CopyRect
ScreenToClient
SetCursor
GetClientRect
ReleaseDC
GetWindowDC
GetDC
ReleaseCapture
SetCapture
SetFocus
IsIconic
IsWindowVisible
SetWindowPos
UpdateLayeredWindow
UnregisterClassW
SendMessageW
TrackMouseEvent
LoadStringW
GetCursorPos
MessageBoxW
PostQuitMessage
SetForegroundWindow

gdi32

GetStockObject
CreateDIBSection
SelectObject
GetDeviceCaps
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC

comdlg32

GetSaveFileNameA
GetOpenFileNameA

shell32

CommandLineToArgvW
ShellExecuteExW
Shell_NotifyIconW
SHBrowseForFolderA
SHAppBarMessage
SHGetPathFromIDListA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

shlwapi

StrStrIW
StrStrIA
PathFileExistsW

dbghelp

MiniDumpWriteDump
MakeSureDirectoryPathExists

sqlite3

sqlite3_backup_finish
sqlite3_backup_step
sqlite3_backup_init
sqlite3_finalize
sqlite3_column_text
sqlite3_step
sqlite3_prepare_v2
sqlite3_errcode
sqlite3_open
sqlite3_free
sqlite3_exec
sqlite3_close

psapi

GetModuleFileNameExW
GetModuleFileNameExA

Exports

Exports

??0?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_oarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_oarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vtext_oarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtMsgBackString@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtMsgJsAction@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtMsgJsCallback@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtMsgOpenBrowser@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtMsgReadConfig@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtMsgWriteConfig@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtMsgBackString@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtMsgJsAction@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtMsgJsCallback@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtMsgOpenBrowser@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtMsgReadConfig@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtMsgWriteConfig@@@serialization@boost@@@serialization@boost@@QAE@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtMsgBackString@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtMsgBackString@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtMsgJsAction@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtMsgJsAction@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtMsgJsCallback@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtMsgJsCallback@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtMsgOpenBrowser@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtMsgOpenBrowser@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtMsgReadConfig@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtMsgReadConfig@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtMsgWriteConfig@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtMsgWriteConfig@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgBackString@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgBackString@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgBackString@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgBackString@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@boost@@@serialization@boost@@SAABV?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@3@XZ
?get_lock@singleton_module@serialization@boost@@CAAA_NXZ
?get_mutable_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgBackString@@@detail@archive@boost@@@serialization@boost@@SAAAV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgBackString@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@@serialization@boost@@SAAAV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@boost@@@serialization@boost@@SAAAV?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@@serialization@boost@@SAAAV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@boost@@@serialization@boost@@SAAAV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@boost@@@serialization@boost@@SAAAV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@boost@@@serialization@boost@@SAAAV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@boost@@@serialization@boost@@SAAAV?$oserializer@Vtext_oarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@3@XZ
?is_destroyed@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_locked@singleton_module@serialization@boost@@SA_NXZ
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@UtMsgBackString@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_ptr@?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgBackString@@@detail@archive@boost@@EBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_ptr@?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@EBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_ptr@?$pointer_iserializer@Vtext_iarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@boost@@EBEXAAVbasic_iarchive@234@PAXI@Z
?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@SAXXZ
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_ptr@?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgJsAction@@@detail@archive@boost@@EBEXAAVbasic_oarchive@234@PBX@Z
?save_object_ptr@?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgJsCallback@@@detail@archive@boost@@EBEXAAVbasic_oarchive@234@PBX@Z
?save_object_ptr@?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgOpenBrowser@@@detail@archive@boost@@EBEXAAVbasic_oarchive@234@PBX@Z
?save_object_ptr@?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgReadConfig@@@detail@archive@boost@@EBEXAAVbasic_oarchive@234@PBX@Z
?save_object_ptr@?$pointer_oserializer@Vtext_oarchive@archive@boost@@UtMsgWriteConfig@@@detail@archive@boost@@EBEXAAVbasic_oarchive@234@PBX@Z
?unlock@singleton_module@serialization@boost@@SAXXZ

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 430KB - Virtual size: 429KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CICD问题反馈及跟进/__MACOSX/.__MACOS__/.__MACOS__/output.bmp
CICD问题反馈及跟进/__MACOSX/.__MACOS__/.__MACOS__/sqlite3.dll
.dll windows x86

66c5a1ce1609a58f3ef4df9e38aa2356

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetThreadContext
ResumeThread
CloseHandle
GetThreadContext
VirtualAllocEx
WriteProcessMemory
GetModuleFileNameA
VirtualAlloc
CreateProcessA
DisableThreadLibraryCalls
Sleep
GetFileAttributesA
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LocalFree

user32

EnumWindowStationsW
MessageBoxA

shell32

SHGetFolderPathA

ole32

CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoCreateInstance

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

msvcp140

??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Xout_of_range@std@@YAXPBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ

vcruntime140

__std_exception_destroy
__std_exception_copy
_except_handler4_common
memset
_CxxThrowException
__std_type_info_destroy_list
__std_terminate
__CxxFrameHandler3
memcpy
memmove

api-ms-win-crt-stdio-l1-1-0

fwrite
_fseeki64
fsetpos
setvbuf
fflush
__stdio_common_vsprintf
_get_stream_buffer_pointers
fgetc
fputc
ungetc
fread
fclose
ftell
fseek
fopen
fgetpos

api-ms-win-crt-runtime-l1-1-0

_initterm
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_seh_filter_dll
_initterm_e

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file

Exports

Exports

sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_step
sqlite3_close
sqlite3_column_text
sqlite3_errcode
sqlite3_exec
sqlite3_finalize
sqlite3_free
sqlite3_open
sqlite3_prepare_v2
sqlite3_step

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d8cb76638b176a238e38fd5b9741e89

Code Sign

07Certificate

Key Usages

08:93:8e:06:3f:2c:05:9f:fc:f5:54:22:39:a4:83:65Certificate

Extended Key Usages

Key Usages

0b:e6:3a:c9:92:ef:67:baCertificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

03:37:b3:4f:a0:45:c0:00:bc:cd:99:99:6e:1e:eb:29Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

c6:ee:c6:4c:97:a6:57:e8:7c:96:9b:a7:0e:89:7f:fe:7d:34:47:fe:80:45:54:48:73:c1:fb:e8:7d:25:83:47Signer

22:68:70:97:21:68:a6:e1:43:ef:a4:59:4d:b9:4a:f8:31:09:bb:22Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ws2_32

wldap32

imm32

kernel32

user32

gdi32

comdlg32

shell32

version

shlwapi

dbghelp

sqlite3

psapi

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 430KB - Virtual size: 429KB

.data Size: 40KB - Virtual size: 55KB

.gfids Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 105KB - Virtual size: 105KB

.reloc Size: 82KB - Virtual size: 82KB

66c5a1ce1609a58f3ef4df9e38aa2356

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 18KB - Virtual size: 17KB

07
Certificate

08:93:8e:06:3f:2c:05:9f:fc:f5:54:22:39:a4:83:65
Certificate

0b:e6:3a:c9:92:ef:67:ba
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

03:37:b3:4f:a0:45:c0:00:bc:cd:99:99:6e:1e:eb:29
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

c6:ee:c6:4c:97:a6:57:e8:7c:96:9b:a7:0e:89:7f:fe:7d:34:47:fe:80:45:54:48:73:c1:fb:e8:7d:25:83:47
Signer

22:68:70:97:21:68:a6:e1:43:ef:a4:59:4d:b9:4a:f8:31:09:bb:22
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 430KB - Virtual size: 429KB

.data
Size: 40KB - Virtual size: 55KB

.gfids
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 105KB - Virtual size: 105KB

.reloc
Size: 82KB - Virtual size: 82KB

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 1KB - Virtual size: 1KB