bdc05f708428c905f9983ff1db15ca87277afb0ceb664d4470c37799b0a971e4[.]zip[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

bdc05f708428c905f9983ff1db15ca87277afb0ceb664d4470c37799b0a971e4.zip.zip
Size

3.3MB
MD5

2c85b8bf922385e910b9ae7d5df6239f
SHA1

9c83fa1d9d8542c3a6e0a7d166250423e4843e21
SHA256

e95c04dc437adf3f517767a4723c8368a21a8ac65501e0fbb1f6d70266d5485f
SHA512

2f3037c364b0e40b2413eda28954200a74f1adac1928cc5c726adfa457be8be4c9d9ccc2b80e516351f05d30d374b6a4ed0a23cfea52cc6924cf726180bf8892
SSDEEP

98304:QfW5PQPlby5fU42yQECvIuans3EXPnVhsthhBCH:O2PsByu42HECvIaEXfjsri

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/bin/7z.exe	upx

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack002/bin/7z.exe
unpack003/out.upx
unpack002/bin/ispmgr.exe
unpack002/bin/libmgr.dll
unpack002/bin/md5sum.exe
unpack002/bin/mgrctl.exe
unpack002/bin/openssl.exe
unpack002/bin/xmlcache.exe
unpack002/bin/xmlinstall.exe
unpack002/cgi/iismgr.exe
unpack002/var/addon/filemgr.exe

Files

bdc05f708428c905f9983ff1db15ca87277afb0ceb664d4470c37799b0a971e4.zip.zip
.zip

Password: infected
bdc05f708428c905f9983ff1db15ca87277afb0ceb664d4470c37799b0a971e4.zip
.zip
bin/!inst.bat
bin/!inst_upd.bat
bin/7z.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 328KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 229KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 438KB - Virtual size: 437KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bin/fciv.exe
.exe windows:4 windows x86

27d678ab7f59de9d3b9c7dc6b25d4f62

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:0e:7d:a7:00:00:00:00:00:48
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/10/2003, 05:59

Not After

25/01/2005, 06:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ed:ee:70:88:a6:13:ca:0b:b5:fd:24:9d:c4:a9:f8:ec:02:56:b4:12
Signer

Actual PE Digest

ed:ee:70:88:a6:13:ca:0b:b5:fd:24:9d:c4:a9:f8:ec:02:56:b4:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileSize
FindClose
FindNextFileA
lstrcmpiA
FindFirstFileA
GetFileAttributesA
GetModuleFileNameA
GetModuleHandleA
GetLocalTime
FormatMessageA
CreateFileMappingA
lstrlenA
SetFilePointer
GetACP
GetLocaleInfoA
GetVersionExA
GetSystemInfo
VirtualProtect
MapViewOfFile
UnmapViewOfFile
ReadFile
GetLastError
GetCurrentDirectoryA
InterlockedDecrement
InterlockedIncrement
LocalAlloc
CreateFileA
WriteFile
CloseHandle
WideCharToMultiByte
LocalFree
SetStdHandle
LCMapStringW
LCMapStringA
FlushFileBuffers
VirtualQuery
GetCPInfo
GetOEMCP
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
MultiByteToWideChar
ExitProcess
RtlUnwind
RaiseException
GetCommandLineA
HeapFree
HeapAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
HeapReAlloc
GetProcAddress
TerminateProcess
GetCurrentProcess
HeapSize
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr

user32

wsprintfA

advapi32

ReportEventA
DeregisterEventSource
RegCreateKeyA
RegSetValueExA
RegCloseKey
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextA
RegisterEventSourceA

ole32

CoUninitialize
OleRun
CoCreateInstance
CoInitialize

oleaut32

SysStringLen
VariantClear
VariantInit
VariantCopy
SysFreeString
SysStringByteLen
GetErrorInfo
SysAllocString
SysAllocStringByteLen

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bin/ispmgr.exe
.exe windows:4 windows x86

5ca132ded18f9790aa42ead4ea958d39

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

LogonUserW
CloseServiceHandle
SetNamedSecurityInfoW
OpenSCManagerW
OpenServiceW
ChangeServiceConfigW
GetNamedSecurityInfoW
SetEntriesInAclW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetAclInformation
GetAce
SetServiceStatus
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
RegCloseKey
RegConnectRegistryW
RegOpenKeyExW
RegQueryValueExW
IsValidSid
ConvertSidToStringSidW
LookupAccountSidW
LookupAccountNameW
GetLengthSid
CopySid
AllocateAndInitializeSid
FreeSid
ConvertStringSidToSidW
CreateWellKnownSid
GetTokenInformation
QueryServiceConfig2W
QueryServiceStatusEx
ControlService
QueryServiceConfigW
DeleteService
StartServiceW
CreateServiceW
ChangeServiceConfig2W
EnumServicesStatusW
CredWriteW
CredDeleteW
CredReadW
CredProtectW
CredUnprotectW
LsaOpenPolicy
LsaNtStatusToWinError
LsaAddAccountRights
LsaClose
LsaRemoveAccountRights
CryptAcquireContextW
CryptGenKey
CryptDestroyKey
CryptReleaseContext
IsValidSecurityDescriptor
GetSecurityDescriptorControl
GetSecurityDescriptorLength
MakeSelfRelativeSD
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
MakeAbsoluteSD
InitializeSecurityDescriptor
SetSecurityInfo
GetSecurityInfo
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
InitializeAcl
AddAccessAllowedAce
IsValidAcl
SetSecurityDescriptorDacl
AddAccessDeniedAce
CreateProcessAsUserW
CreateProcessWithLogonW
ImpersonateLoggedOnUser
DeleteAce
IsTextUnicode
PrivilegeCheck
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeDisplayNameW
GetUserNameW

httpapi

HttpTerminate
HttpInitialize
HttpQueryServiceConfiguration
HttpSetServiceConfiguration
HttpDeleteServiceConfiguration

libmysql

mysql_close
mysql_data_seek
mysql_errno
mysql_error
mysql_fetch_fields
mysql_fetch_row
mysql_field_count
mysql_free_result
mysql_init
mysql_insert_id
mysql_list_dbs
mysql_num_fields
mysql_query
mysql_real_connect
mysql_real_escape_string
mysql_select_db
mysql_store_result
mysql_use_result

zlib1

gzclose
gzdopen
gzwrite

libxslt

xsltApplyStylesheet
xsltFreeStylesheet
xsltParseStylesheetFile
xsltRegisterExtModuleFunction
xsltSaveResultToString

libxml2

valuePop
valuePush
xmlAddChild
xmlCheckUTF8
xmlCopyDoc
xmlCopyNode
xmlDocDumpFormatMemory
xmlDocDumpMemory
xmlDocGetRootElement
xmlDocSetRootElement
xmlFree
xmlFreeDoc
xmlFreeNode
xmlGetLastError
xmlGetProp
xmlGetUTF8Char
xmlHasProp
xmlNewChild
xmlNewDoc
xmlNewNode
xmlNewText
xmlNodeGetContent
xmlNodeSetContent
xmlNodeSetName
xmlParseDoc
xmlParseFile
xmlParseMemory
xmlSaveFile
xmlSchemaFree
xmlSchemaFreeParserCtxt
xmlSchemaFreeValidCtxt
xmlSchemaNewMemParserCtxt
xmlSchemaNewParserCtxt
xmlSchemaNewValidCtxt
xmlSchemaParse
xmlSchemaSetParserStructuredErrors
xmlSchemaSetValidStructuredErrors
xmlSchemaValidateDoc
xmlSetProp
xmlUnlinkNode
xmlXPathEvalExpression
xmlXPathFreeContext
xmlXPathFreeObject
xmlXPathNewCString
xmlXPathNewContext
xmlXPathNewFloat
xmlXPathPopString
xmlXPathRegisterNs
xmlXPatherror

crypt32

CertAddCertificateContextToStore
CertAddEnhancedKeyUsageIdentifier
CertCloseStore
CertCreateSelfSignCertificate
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetNameStringW
CertOpenStore
CertSetCertificateContextProperty
CertStrToNameW
CryptBinaryToStringA
CryptBinaryToStringW
CryptStringToBinaryA
CryptStringToBinaryW
PFXExportCertStoreEx
PFXImportCertStore
PFXIsPFXBlob

kernel32

AssignProcessToJobObject
CloseHandle
CompareStringW
CopyFileW
CreateEventW
CreateFileA
CreateFileMappingW
CreateFileW
CreateJobObjectW
CreateMutexW
CreatePipe
CreateProcessA
CreateProcessW
CreateSemaphoreA
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FormatMessageW
FreeLibrary
GetComputerNameExW
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesW
GetFileSizeEx
GetFileTime
GetLastError
GetLogicalDriveStringsW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameW
GetTickCount
GetTimeZoneInformation
GetVersionExW
GetVolumeInformationW
GetVolumePathNamesForVolumeNameW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
LockFile
MapViewOfFile
MoveFileExW
MultiByteToWideChar
PeekNamedPipe
QueryDosDeviceW
QueryPerformanceCounter
ReadFile
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryW
ResumeThread
SetConsoleTextAttribute
SetCurrentDirectoryW
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetHandleInformation
SetInformationJobObject
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
lstrcpynW
lstrlenW

msvcrt

_close
_dup2
_fdopen
_fileno
_getpid
_mkdir
_open
_read
_rmdir
_strdup
_unlink
_write
___lc_codepage_func
__argv
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_atoi64
_cexit
_chsize
_environ
_errno
_exit
_filelengthi64
_fileno
_findclose
_findfirst
_findnext
_fmode
_fstat
_fstat64
_fullpath
_i64toa
_i64tow
_initterm
_iob
_itow
_lock
_lseeki64
_onexit
_setmode
_snwprintf
_stat
_stricmp
_strnicmp
_unlock
_vsnprintf
_vsnwprintf
_write
_wtof
_wtoi
_wtol
abort
atof
atoi
calloc
ctime
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwrite
getc
getenv
getwc
isalnum
isalpha
isspace
iswctype
iswdigit
localeconv
localtime
malloc
memchr
memcmp
memcpy
memmove
memset
mktime
printf
putc
puts
putwc
qsort
raise
rand
realloc
remove
rename
setlocale
setvbuf
signal
sprintf
srand
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strncmp
strncpy
strrchr
strtod
strtok
strtol
strtoul
strxfrm
time
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
vprintf
wcschr
wcscoll
wcscpy
wcsftime
wcslen
wcsncat
wcsncmp
wcsncpy
wcsrchr
wcsstr
wcstoul
wcsxfrm

netapi32

NetApiBufferFree
NetLocalGroupAdd
NetLocalGroupAddMembers
NetLocalGroupDel
NetLocalGroupDelMembers
NetLocalGroupEnum
NetLocalGroupGetInfo
NetLocalGroupGetMembers
NetLocalGroupSetInfo
NetUserAdd
NetUserDel
NetUserEnum
NetUserGetInfo
NetUserGetLocalGroups
NetUserSetInfo

odbc32

SQLAllocHandle
SQLCloseCursor
SQLConnectW
SQLDescribeColW
SQLDisconnect
SQLDriverConnectW
SQLDriversW
SQLExecDirectW
SQLFetch
SQLFreeHandle
SQLGetData
SQLGetDiagRecW
SQLGetInfoW
SQLNumResultCols
SQLRowCount
SQLSetConnectAttrW
SQLSetEnvAttr
SQLSetStmtAttrW
SQLTablesW

ole32

CoCreateGuid
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoTaskMemFree
CoUninitialize
StringFromGUID2

oleaut32

SysAllocString
SysFreeString
VariantChangeType
VariantClear
VariantInit

psapi

GetMappedFileNameW

shell32

SHCreateDirectoryExW
SHFileOperationW
SHGetSpecialFolderPathW

shlwapi

PathCanonicalizeW
PathIsDirectoryEmptyW
PathUnExpandEnvStringsW

user32

CharLowerW
CharUpperW
MessageBoxA

wininet

HttpOpenRequestA
HttpQueryInfoW
HttpSendRequestW
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetQueryOptionW
InternetReadFile
InternetSetOptionW

wsock32

WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
gethostname
htonl
htons
inet_addr
inet_ntoa
listen
ntohs
recv
select
send
setsockopt
shutdown
socket

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bin/libmgr.dll
.dll windows:4 windows x86

5fc4272b9a429b69676387c4136df710

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

CreateProcessAsUserW
CreateProcessWithLogonW
LogonUserW
ImpersonateLoggedOnUser

libxml2

xmlAddChild
xmlCheckUTF8
xmlCopyDoc
xmlCopyNode
xmlDocDumpFormatMemory
xmlDocGetRootElement
xmlDocSetRootElement
xmlFree
xmlFreeDoc
xmlFreeNode
xmlGetLastError
xmlGetProp
xmlGetUTF8Char
xmlNewChild
xmlNewDoc
xmlNewNode
xmlNodeGetContent
xmlNodeSetContent
xmlParseFile
xmlParseMemory
xmlSaveFile
xmlSchemaFree
xmlSchemaFreeParserCtxt
xmlSchemaFreeValidCtxt
xmlSchemaNewMemParserCtxt
xmlSchemaNewParserCtxt
xmlSchemaNewValidCtxt
xmlSchemaParse
xmlSchemaSetParserStructuredErrors
xmlSchemaSetValidStructuredErrors
xmlSchemaValidateDoc
xmlSetProp
xmlUnlinkNode
xmlXPathEvalExpression
xmlXPathFreeContext
xmlXPathFreeObject
xmlXPathNewContext
xmlXPathRegisterNs

kernel32

AssignProcessToJobObject
CloseHandle
CreateFileA
CreateFileMappingW
CreateFileW
CreateJobObjectW
CreatePipe
CreateProcessA
CreateProcessW
CreateSemaphoreA
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsW
FormatMessageW
FreeLibrary
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesW
GetFileSizeEx
GetLastError
GetLogicalDriveStringsW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStdHandle
GetSystemTimeAsFileTime
GetTempFileNameW
GetTickCount
GetTimeZoneInformation
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
LockFile
MapViewOfFile
MoveFileExW
MultiByteToWideChar
PeekNamedPipe
QueryDosDeviceW
QueryPerformanceCounter
ReadFile
ReleaseSemaphore
RemoveDirectoryW
ResumeThread
SetCurrentDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
SetHandleInformation
SetInformationJobObject
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

_close
_fdopen
_fileno
_getpid
_mkdir
_open
_read
_rmdir
_strdup
_unlink
_write
___lc_codepage_func
__dllonexit
__doserrno
__mb_cur_max
__pioinfo
_amsg_exit
_errno
_filelengthi64
_fileno
_findclose
_findfirst
_findnext
_fstat
_fstat64
_fullpath
_i64tow
_initterm
_iob
_lock
_lseeki64
_onexit
_setmode
_snwprintf
_stat
_strnicmp
_unlock
_vsnprintf
_write
abort
atoi
calloc
ctime
exit
fclose
fflush
fgetpos
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
isspace
iswctype
localeconv
localtime
malloc
memchr
memcpy
memmove
memset
mktime
putc
puts
putwc
rand
realloc
rename
setlocale
setvbuf
sprintf
srand
strcmp
strcoll
strcpy
strerror
strftime
strlen
strrchr
strtod
strtoul
strxfrm
time
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
wcschr
wcscoll
wcsftime
wcslen
wcsncat
wcsncpy
wcsrchr
wcsstr
wcsxfrm

psapi

GetMappedFileNameW

shell32

SHCreateDirectoryExW
SHFileOperationW
SHGetSpecialFolderPathW

shlwapi

PathCanonicalizeW
PathIsDirectoryEmptyW
PathUnExpandEnvStringsW

ws2_32

WSACleanup
WSAStartup
connect
htons
inet_addr
recv
send
socket

Exports

Exports

DebugFile
ErrorCallBack
IsCentos
IsFedora11
IsUbuntu
LogLevel
METHOD
MemDebugFlag
MgrAuthId
Way
_Z10ConcatPathRKSsS0_b
_Z10CopyFolderRKSsS0_
_Z10FileCreatePKwS0_PKc
_Z10FileExistsRKSs
_Z10GetSubNodeP8_xmlNodePKc
_Z10GetWorkDirv
_Z10IsPathUnixPKw
_Z10IsPathUnixRK7AutoUTF
_Z10SetWorkDirSsi
_Z10create_dirPKwP20_SECURITY_ATTRIBUTES
_Z10delete_dirPKw
_Z10mgrExecStrPKcRKSs
_Z10mgrExecXmlPKcz
_Z10mgrGetPathRKSs
_Z11ExtractFilePKww
_Z11ExtractFileRK7AutoUTFw
_Z11ExtractPathPKww
_Z11ExtractPathRK7AutoUTFw
_Z11FileModTimeRKSs
_Z11GetFullPathRKSs
_Z11GetInputXmlv
_Z11GetMemUsageRjS_PKc
_Z11GetNodePropP8_xmlNodePKc
_Z11SetLogColorb
_Z11SystemInOutRKSsS0_RSs
_Z11delete_filePKw
_Z11file_existsPKw
_Z11mgrExecListPKcS0_St4listISsSaISsEE
_Z11mgrExecTextPKcz
_Z12BeginLogLinejPKci
_Z12CanonicalizePKw
_Z12CheckRunningRKSs
_Z12ConfGetValueRKSsS0_
_Z12ConfSetValueRKSsS0_S0_
_Z12EscapeDBNameSs
_Z12MakeGoodPathRSs
_Z12RemoveStringRKSsS0_
_Z12XPathPrepareRSs
_Z12convertToDecPKc
_Z12dir_is_emptyPKw
_Z12is_path_maskPKw
_Z13ConfDropValueRKSsS0_
_Z13CopyNotExistsRKSsS0_
_Z13EscapeCommandSs
_Z13InitMgrClientRKSsS0_
_Z13SendOutputXmlR3xml
_Z13getquotedwordRSsRKSs
_Z13processExistsPKc
_Z14CompileCommandPKcbz
_Z14GetNodeContentP8_xmlNode
_Z14GetSpecialPathib
_Z14RemoveBadCharsRKSsSs
_Z14UnescapeDBNameSs
_Z14delete_recyclePKw
_Z16GetWorkDirectoryv
_Z16ReadSimpleConfigRKSsRSt3mapISsSsSt4lessISsESaISt4pairIS_SsEEESs
_Z16SetWorkDirectoryPKw
_Z16ensure_dir_existPKw
_Z17CommandExecutableSs
_Z17GetSubNodeContentP8_xmlNodePKc
_Z17WriteSimpleConfigRKSsRSt3mapISsSsSt4lessISsESaISt4pairIS_SsEEE
_Z17XPathItemValidateRKSs
_Z18ensure_path_prefixRK7AutoUTFPKw
_Z18get_path_from_maskRK7AutoUTF
_Z18remove_path_prefixRK7AutoUTFPKw
_Z18toHumanReadableFmtl
_Z19AddStringInPositionRKSsS0_S0_b
_Z3Strdi
_Z3Strx
_Z4CopyRKSsS0_
_Z4Lockib
_Z4to64Pcli
_Z5CryptSsPKc
_Z5chownPKcii
_Z5cryptPKcS0_
_Z5mkdirPKct
_Z5pwgenv
_Z6DoubleRKSs
_Z6ExpandPKw
_Z6SecurePKw
_Z6SecureRK7AutoUTF
_Z6SystemRKSs
_Z6UnLocki
_Z6fchmodii
_Z6fchowniii
_Z6is_dirPKw
_Z7AllTrimRSs
_Z7CompareRKSsS0_
_Z7DirnameRKSs
_Z7InitLogPKcb
_Z7InitWayv
_Z7LogLinePKcz
_Z7MgrEditRKSsS0_
_Z7MgrExecRKSs
_Z7MgrExecRKSsb
_Z7PathWinPKw
_Z7PathWinRK7AutoUTF
_Z7ReplaceRKSsS0_Ss
_Z7ReplaceRSt3mapISsSsSt4lessISsESaISt4pairIKSsSsEEESs
_Z7TryLockRKSs
_Z7getwordRSsRKSs
_Z7getwordRSsc
_Z7is_filePKw
_Z7mgrEditPKcS0_z
_Z7mgrExecPKcS0_z
_Z7mgrExitv
_Z7mgrtimev
_Z8BasenameRKSs
_Z8CloseLogv
_Z8FileWipePKw
_Z8GetErrorv
_Z8LeftTrimRSs
_Z8LeftTrimRSsc
_Z8PathUnixPKw
_Z8PathUnixRK7AutoUTF
_Z8QueryXmlRKSs
_Z8ReadFileRKSs
_Z8ReadLinkRKSs
_Z8RealPathRKSs
_Z8SetToStrRKSt3setISsSt4lessISsESaISsEESs
_Z8SlashDelPKw
_Z8SlashDelRK7AutoUTF
_Z8StrToSetRKSsRSt3setISsSt4lessISsESaISsEESs
_Z8SystemExRKSsS0_RSsbiiS0_
_Z8SystemInRKSsS0_
_Z8UnExpandPKw
_Z8UnExpandRK7AutoUTF
_Z8ValidatePKw
_Z8ValidateRK7AutoUTF
_Z8getAsDecPc
_Z8mgrExecvPKcS0_Pc
_Z8rgetwordRSsRKSs
_Z8rgetwordRSsc
_Z8sysSleepi
_Z9CreateDirRKSsiii
_Z9DecodeURLRKSs
_Z9EscapeURLRKSs
_Z9FileWritePKwPKvjb
_Z9GetDrivesv
_Z9ListToStrRKSt4listISsSaISsEESs
_Z9RemoveDirRKSs
_Z9RightTrimRSs
_Z9RightTrimRSsc
_Z9StrToListRKSsRSt4listISsSaISsEESs
_Z9SystemOutRKSsRSs
_Z9WriteFileRKSsS0_
_Z9XMLEscapeRSs
_Z9delete_shPKw
_Z9interruptb
_Z9read_filePKwRSs
_ZGVZN8WSockLib4InitEvE4init
_ZN10BadElementC1EPKcSs
_ZN10BadElementC2EPKcSs
_ZN10LimitErrorC1EPKc
_ZN10LimitErrorC2EPKc
_ZN10MoneyErrorC1Ev
_ZN10MoneyErrorC2Ev
_ZN10ValueErrorC1EPKc
_ZN10ValueErrorC2EPKc
_ZN10WSockErrorD0Ev
_ZN10WSockErrorD1Ev
_ZN10auto_closeIPvE5closeEv
_ZN10mgrRequest11ParseStringERKSs
_ZN10mgrRequest2OkEv
_ZN10mgrRequest3HasEPKc
_ZN10mgrRequest4AuthEv
_ZN10mgrRequest5ParamEPKc
_ZN10mgrRequestC1EP7_xmlDoc
_ZN10mgrRequestC1EPKcz
_ZN10mgrRequestC1Ev
_ZN10mgrRequestC2EP7_xmlDoc
_ZN10mgrRequestC2EPKcz
_ZN10mgrRequestC2Ev
_ZN10mgrRequestD1Ev
_ZN10mgrRequestD2Ev
_ZN10mgrRequestclEPKc
_ZN11AccessErrorC1ERKSs
_ZN11AccessErrorC1Ev
_ZN11AccessErrorC2ERKSs
_ZN11AccessErrorC2Ev
_ZN12RuntimeErrorD0Ev
_ZN12RuntimeErrorD1Ev
_ZN12xmlSchemaStrC1ERKSs
_ZN12xmlSchemaStrC2ERKSs
_ZN12xmlSchemaStrD0Ev
_ZN12xmlSchemaStrD1Ev
_ZN13ElementExistsC1ERKSs
_ZN13ElementExistsC2ERKSs
_ZN13InternalErrorC1ESs
_ZN13InternalErrorC2ESs
_ZN13InternalErrorD1Ev
_ZN13MgrConnection4ExecESs
_ZN13MgrConnection5LogonERKSsS1_
_ZN13MgrConnectionC1Ev
_ZN13MgrConnectionC2Ev
_ZN13xmlSchemaFileC1ERKSs
_ZN13xmlSchemaFileC2ERKSs
_ZN13xmlSchemaFileD0Ev
_ZN13xmlSchemaFileD1Ev
_ZN14mgrRequestList3EofEv
_ZN14mgrRequestList4LastEv
_ZN14mgrRequestList4NameEv
_ZN14mgrRequestList4NextEv
_ZN14mgrRequestList5FirstEv
_ZN14mgrRequestList5ValueEPKc
_ZN14mgrRequestList5ValueEv
_ZN14mgrRequestListC1EP7_xmlDoc
_ZN14mgrRequestListC1EP8_xmlNode
_ZN14mgrRequestListC1EPKcz
_ZN14mgrRequestListC1ERKSs
_ZN14mgrRequestListC2EP7_xmlDoc
_ZN14mgrRequestListC2EP8_xmlNode
_ZN14mgrRequestListC2EPKcz
_ZN14mgrRequestListC2ERKSs
_ZN3Dir10ForEachEntEPFbRS_E
_ZN3Dir10ReadAnyDirEv
_ZN3Dir11IsRegOrLinkEv
_ZN3Dir4ReadEv
_ZN3Dir4SizeEv
_ZN3Dir5IsDirEv
_ZN3Dir5IsRegEv
_ZN3Dir7ReadAnyEv
_ZN3Dir7ReadDirEv
_ZN3Dir8ReadFileEv
_ZN3DirC1ERKSs
_ZN3DirC1ERKSsb
_ZN3DirC2ERKSs
_ZN3DirC2ERKSsb
_ZN3DirD1Ev
_ZN3DirD2Ev
_ZN3xml10GoBookmarkEv
_ZN3xml10ReplaceXMLEP7_xmlDoc
_ZN3xml10ReplaceXMLERKS_
_ZN3xml10ReplaceXMLERKSs
_ZN3xml11AddChildTagEPKcSs
_ZN3xml11NewChildTagEPKcSs
_ZN3xml11RemoveNodesERKSs
_ZN3xml11SetBookmarkEv
_ZN3xml18ReplaceNodeContentERKSsS1_S1_
_ZN3xml4LoadERKSs
_ZN3xml4SeekERKSs
_ZN3xml4TellERKSs
_ZN3xml5ClearEv
_ZN3xml6NewTagEPKcSs
_ZN3xml6escapeERSs
_ZN3xml7CopyTagEP8_xmlNodeS1_
_ZN3xml7NewNodeEP8_xmlNodePKcSs
_ZN3xml7TagPropEP8_xmlNodePKcRKSs
_ZN3xml7TagPropEPKcRKSs
_ZN3xmlC1EP7_xmlDoc
_ZN3xmlC1ERKS_
_ZN3xmlC1ERKSs
_ZN3xmlC1ERKSsRKb
_ZN3xmlC1Ev
_ZN3xmlC2EP7_xmlDoc
_ZN3xmlC2ERKS_
_ZN3xmlC2ERKSs
_ZN3xmlC2ERKSsRKb
_ZN3xmlC2Ev
_ZN3xmlD0Ev
_ZN3xmlD1Ev
_ZN3xmlD2Ev
_ZN3xmlaSERKS_
_ZN4Date13SetFromTime_tEl
_ZN4Date6AddDayEi
_ZN4Date8AddMonthEi
_ZN4DateC1ESs
_ZN4DateC1Ev
_ZN4DateC2ESs
_ZN4DateC2Ev
_ZN4Exec10TIMEOUT_DXE
_ZN4Exec11ImpersonateEPv
_ZN4Exec11ImpersonateERK7AutoUTFS2_mS2_
_ZN4Exec3RunERK7AutoUTF
_ZN4Exec3RunERK7AutoUTFRSs
_ZN4Exec3RunERK7AutoUTFRSsRKSs
_ZN4Exec5LogonERK7AutoUTFS2_mS2_
_ZN4Exec7RunWaitERK7AutoUTFm
_ZN4Exec7TIMEOUTE
_ZN4Exec9RunAsUserERK7AutoUTFPv
_ZN4Exec9RunAsUserERK7AutoUTFRSsRKSsS2_S2_
_ZN4Exec9RunAsUserERK7AutoUTFS2_S2_
_ZN4TimeC1ESs
_ZN4TimeC1Ev
_ZN4TimeC2ESs
_ZN4TimeC2Ev
_ZN5Error3LogERKSs
_ZN5ErrorC1ENS_6errorsE
_ZN5ErrorC1ENS_6errorsERKSsS2_
_ZN5ErrorC1ERKS_
_ZN5ErrorC2ENS_6errorsE
_ZN5ErrorC2ENS_6errorsERKSsS2_
_ZN5ErrorD1Ev
_ZN5ErrorD2Ev
_ZN5Win6410WowDisableERPv
_ZN5Win647IsWOW64Ev
_ZN5Win649WowEnableERPv
_ZN5xpath4InitEP7_xmlDocSsRKSt3mapISsSsSt4lessISsESaISt4pairIKSsSsEEE
_ZN5xpath5ArrayEv
_ZN5xpath6DeleteEi
_ZN5xpathC1EP7_xmlDocSs
_ZN5xpathC1EP7_xmlDocSsSsSs
_ZN5xpathC2EP7_xmlDocSs
_ZN5xpathC2EP7_xmlDocSsSsSs
_ZN5xpathD1Ev
_ZN5xpathD2Ev
_ZN5xpathixEi
_ZN6SysApp6appcmdEv
_ZN6SysApp6dnscmdEv
_ZN6Thread5GetIdEv
_ZN6Thread6CreateEPFmPvES0_
_ZN6WinJob10AddProcessEPv
_ZN6WinJob10SetUiLimitEv
_ZN6WinJob10TIMEOUT_DXE
_ZN6WinJob12SetTimeLimitEj
_ZN6WinJob9RunAsUserERK7AutoUTFPv
_ZN6WinJob9RunAsUserERK7AutoUTFRSsRKSsPv
_ZN6WinJobC1ERK7AutoUTF
_ZN6WinJobC1Ev
_ZN6WinJobC2ERK7AutoUTF
_ZN6WinJobC2Ev
_ZN6WinJobD1Ev
_ZN6WinJobD2Ev
_ZN7CPErrorC1ERKSsS1_S1_S1_
_ZN7CPErrorC2ERKSsS1_S1_S1_
_ZN7Feature3AddEPKc
_ZN7Feature3HasEPKc
_ZN7Feature8AsStringEv
_ZN7FeatureC1Ev
_ZN7FeatureC2Ev
_ZN7SysPath3DnsEv
_ZN7SysPath4TempEv
_ZN7SysPath5Sys32Ev
_ZN7SysPath5UsersEv
_ZN7SysPath5WinntEv
_ZN7SysPath7InetSrvEv
_ZN7SysPath9SysNativeEv
_ZN7SysUser5existERKSs
_ZN7SysUserC1ERKSs
_ZN7SysUserC1ESs
_ZN7SysUserC2ERKSs
_ZN7SysUserC2ESs
_ZN8ApiErrorD0Ev
_ZN8ApiErrorD1Ev
_ZN8LicErrorC1Ev
_ZN8LicErrorC2Ev
_ZN8MgrErrorC1ERKSs
_ZN8MgrErrorC2ERKSs
_ZN8MgrErrorD1Ev
_ZN8MgrQuery3EofEv
_ZN8MgrQuery3HasEPKc
_ZN8MgrQuery4NameEv
_ZN8MgrQuery4NextEv
_ZN8MgrQuery5FirstEv
_ZN8MgrQuery6GetIndEPKcRlS2_
_ZN8MgrQuery8AsStringEv
_ZN8MgrQueryC1EP13MgrConnectionSs
_ZN8MgrQueryC1ERKSs
_ZN8MgrQueryC2EP13MgrConnectionSs
_ZN8MgrQueryC2ERKSs
_ZN8MgrQueryD1Ev
_ZN8MgrQueryD2Ev
_ZN8MgrQueryixEPKc
_ZN8MgrQueryixERKSs
_ZN8MsgErrorC1EPKc
_ZN8MsgErrorC1EPKcRKSs
_ZN8MsgErrorC2EPKc
_ZN8MsgErrorC2EPKcRKSs
_ZN8SysGroupC1ERKSs
_ZN8SysGroupC1ESs
_ZN8SysGroupC2ERKSs
_ZN8SysGroupC2ESs
_ZN8WinErrorD0Ev
_ZN8WinErrorD1Ev
_ZN9xmlschemaC1EP20_xmlSchemaParserCtxt
_ZN9xmlschemaC2EP20_xmlSchemaParserCtxt
_ZN9xmlschemaD0Ev
_ZN9xmlschemaD1Ev
_ZN9xmlschemaD2Ev
_ZNK3Dir5IsExtERKSs
_ZNK3xml4SaveERKSs
_ZNK3xml8AsStringEv
_ZNK4Date3DayEv
_ZNK4Date4AsTmEv
_ZNK4Date4YearEv
_ZNK4Date5MonthEv
_ZNK4Date6IsNullEv
_ZNK4Date7DayDiffERKS_
_ZNK4Date8AsStringEv
_ZNK4Date8AsTime_tEv
_ZNK4Date9MonthDaysEv
_ZNK4Date9MonthDiffERKS_
_ZNK4Time3MinEv
_ZNK4Time3SecEv
_ZNK4Time4HourEv
_ZNK4Time8AsStringEv
_ZNK4TimeltERKS_
_ZNK7WinFile4PathEPwj
_ZNK8WinError3msgEv
_ZNK9xmlschema21SetParseErrorCallBackEPFvPvP9_xmlErrorES0_
_ZNK9xmlschema24SetValidateErrorCallBackEPFvPvP9_xmlErrorES0_
_ZNK9xmlschema8ValidateERK3xml
_ZNK9xmlschema8ValidateERKP7_xmlDoc
_ZNSt10_List_baseISsSaISsEE8_M_clearEv
_ZNSt12_Destroy_auxILb0EE9__destroyIPSsEEvT_S3_
_ZNSt4pairIKSsSsED1Ev
_ZNSt6vectorISsSaISsEE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPSsS1_EERKSs
_ZNSt6vectorISsSaISsEED1Ev
_ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEE10_M_insert_EPKSt18_Rb_tree_node_baseS8_RKSs
_ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEE16_M_insert_uniqueERKSs
_ZNSt8_Rb_treeISsSt4pairIKSsN3xml7PosInfoEESt10_Select1stIS4_ESt4lessISsESaIS4_EE10_M_insert_EPKSt18_Rb_tree_node_baseSD_RKS4_
_ZNSt8_Rb_treeISsSt4pairIKSsN3xml7PosInfoEESt10_Select1stIS4_ESt4lessISsESaIS4_EE16_M_insert_uniqueERKS4_
_ZNSt8_Rb_treeISsSt4pairIKSsN3xml7PosInfoEESt10_Select1stIS4_ESt4lessISsESaIS4_EE17_M_insert_unique_ESt23_Rb_tree_const_iteratorIS4_ERKS4_
_ZNSt8_Rb_treeISsSt4pairIKSsN3xml7PosInfoEESt10_Select1stIS4_ESt4lessISsESaIS4_EE8_M_eraseEPSt13_Rb_tree_nodeIS4_E
_ZNSt8_Rb_treeISsSt4pairIKSsN3xml7PosInfoEESt10_Select1stIS4_ESt4lessISsESaIS4_EED1Ev
_ZNSt8_Rb_treeISsSt4pairIKSsSsESt10_Select1stIS2_ESt4lessISsESaIS2_EE10_M_insert_EPKSt18_Rb_tree_node_baseSB_RKS2_
_ZNSt8_Rb_treeISsSt4pairIKSsSsESt10_Select1stIS2_ESt4lessISsESaIS2_EE16_M_insert_uniqueERKS2_
_ZNSt8_Rb_treeISsSt4pairIKSsSsESt10_Select1stIS2_ESt4lessISsESaIS2_EE17_M_insert_unique_ESt23_Rb_tree_const_iteratorIS2_ERKS2_
_ZNSt8_Rb_treeISsSt4pairIKSsSsESt10_Select1stIS2_ESt4lessISsESaIS2_EE8_M_eraseEPSt13_Rb_tree_nodeIS2_E
_ZNSt8_Rb_treeISsSt4pairIKSsSsESt10_Select1stIS2_ESt4lessISsESaIS2_EED1Ev
_ZNSt8_Rb_treeIiiSt9_IdentityIiESt4lessIiESaIiEE16_M_insert_uniqueERKi
_ZNSt8_Rb_treeIiiSt9_IdentityIiESt4lessIiESaIiEE8_M_eraseEPSt13_Rb_tree_nodeIiE
_ZNSt8_Rb_treeIiiSt9_IdentityIiESt4lessIiESaIiEED1Ev
_ZSt9__find_ifISt16reverse_iteratorIPKwE6FindInIwEET_S6_S6_T0_St26random_access_iterator_tag
_ZTI10WSockError
_ZTI12RuntimeError
_ZTI12xmlSchemaStr
_ZTI13InternalError
_ZTI13xmlSchemaFile
_ZTI3xml
_ZTI5Error
_ZTI8ApiError
_ZTI8MgrError
_ZTI8WinError
_ZTI9xmlschema
_ZTS10WSockError
_ZTS12RuntimeError
_ZTS12xmlSchemaStr
_ZTS13InternalError
_ZTS13xmlSchemaFile
_ZTS3xml
_ZTS5Error
_ZTS8ApiError
_ZTS8MgrError
_ZTS8WinError
_ZTS9xmlschema
_ZTV10WSockError
_ZTV12RuntimeError
_ZTV12xmlSchemaStr
_ZTV13xmlSchemaFile
_ZTV3xml
_ZTV8ApiError
_ZTV8WinError
_ZTV9xmlschema
_ZZN8WSockLib4InitEvE4init
_nm__xmlFree
chmod
feature

Sections

.text
Size: 609KB - Virtual size: 609KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/md5sum.exe
.exe windows:4 windows x86

74dfe5058611c7bdd5067483cd452676

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
SetUnhandledExceptionFilter

msvcrt

_fstat
_getcwd
_isatty
_open
_read
_close
_strdup
_cexit
_errno
_fileno
_fmode
_fpreset
_iob
_setmode
__getmainargs
_stricmp
_strnicmp
_wcsicmp
atexit
bsearch
calloc
exit
fclose
feof
ferror
fflush
fgets
fopen
fprintf
fputs
fread
free
getc
getenv
isalnum
isalpha
isdigit
isspace
__p__environ
isxdigit
malloc
memcpy
printf
putc
putchar
puts
qsort
realloc
setlocale
signal
strchr
strcmp
strerror
strncmp
tolower
vfprintf
__set_app_type

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bin/mgrctl.exe
.exe windows:4 windows x86

9be1f17ecd4d8ff69280c90a4d60310c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
FormatMessageW
FreeLibrary
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalFree
QueryPerformanceCounter
ReleaseSemaphore
SetConsoleTextAttribute
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteConsoleA
WriteConsoleW
WriteFile

msvcrt

_close
_write
__argv
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_iob
_lock
_onexit
_stat
_unlock
_vsnprintf
_vsnwprintf
abort
calloc
exit
fprintf
fputc
fputs
free
fwrite
getenv
malloc
memchr
memcpy
memmove
memset
realloc
signal
sprintf
strchr
strcmp
strcpy
strerror
strlen
strncmp
vfprintf
vprintf
wcslen

wsock32

WSAStartup
connect
htons
inet_addr
recv
send
socket

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bin/openssl.cnf
bin/openssl.exe
.exe windows:4 windows x86

7fc1375b391c7d9a69bcd321bb881060

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ssleay32

ord171
ord290
ord291
ord45
ord180
ord150
ord49
ord6
ord130
ord127
ord65
ord61
ord120
ord154
ord157
ord35
ord162
ord33
ord129
ord55
ord108
ord79
ord122
ord52
ord2
ord32
ord98
ord38
ord40
ord28
ord22
ord30
ord24
ord5
ord43
ord110
ord113
ord116
ord172
ord268
ord293
ord119
ord90
ord31
ord86
ord59
ord96
ord60
ord56
ord272
ord274
ord271
ord292
ord112
ord115
ord118
ord74
ord275
ord183
ord12
ord264
ord145
ord286
ord141
ord142
ord177
ord15
ord21
ord231
ord73
ord16
ord8
ord243
ord42
ord164
ord77
ord125
ord94
ord72
ord166
ord78
ord48
ord249
ord121
ord75
ord244
ord189
ord83
ord82
ord63
ord267
ord58

libeay32

ord912
ord1654
ord378
ord82
ord86
ord2411
ord222
ord680
ord585
ord657
ord909
ord626
ord3527
ord2105
ord2011
ord1915
ord2067
ord558
ord555
ord625
ord556
ord3676
ord52
ord78
ord93
ord246
ord629
ord21
ord168
ord827
ord2281
ord3488
ord2280
ord2276
ord2279
ord355
ord167
ord67
ord2427
ord109
ord916
ord723
ord1653
ord89
ord87
ord57
ord169
ord997
ord577
ord606
ord2217
ord576
ord1912
ord1914
ord3241
ord3243
ord2209
ord2704
ord2292
ord366
ord605
ord607
ord2286
ord421
ord877
ord423
ord2250
ord872
ord154
ord3237
ord2544
ord2117
ord610
ord608
ord2627
ord674
ord670
ord601
ord672
ord658
ord667
ord656
ord671
ord673
ord664
ord602
ord3724
ord313
ord403
ord769
ord248
ord419
ord3550
ord210
ord484
ord129
ord279
ord3686
ord161
ord150
ord486
ord283
ord1960
ord2832
ord2695
ord1508
ord316
ord1509
ord3570
ord3575
ord2877
ord3512
ord209
ord181
ord2111
ord600
ord3729
ord3422
ord3408
ord3663
ord151
ord281
ord31
ord835
ord732
ord654
ord401
ord397
ord304
ord333
ord76
ord2784
ord965
ord289
ord290
ord2572
ord2747
ord3245
ord363
ord3883
ord285
ord83
ord3820
ord3903
ord54
ord60
ord323
ord188
ord202
ord415
ord33
ord830
ord120
ord200
ord207
ord395
ord28
ord205
ord727
ord3713
ord1871
ord3687
ord213
ord2202
ord2203
ord3019
ord2915
ord4059
ord59
ord3836
ord255
ord2206
ord3823
ord330
ord361
ord3877
ord2743
ord315
ord2821
ord2936
ord269
ord3109
ord2630
ord2249
ord2291
ord896
ord899
ord894
ord230
ord665
ord24
ord513
ord1988
ord2060
ord1160
ord11
ord1167
ord88
ord816
ord1908
ord2126
ord1080
ord170
ord514
ord280
ord282
ord25
ord541
ord8
ord2131
ord164
ord119
ord573
ord579
ord565
ord571
ord14
ord580
ord362
ord575
ord584
ord13
ord23
ord364
ord567
ord566
ord578
ord349
ord352
ord1900
ord562
ord1901
ord171
ord173
ord175
ord9
ord1954
ord2027
ord3087
ord1205
ord2052
ord2608
ord3516
ord603
ord677
ord678
ord529
ord422
ord536
ord2823
ord2834
ord3031
ord2607
ord3004
ord2543
ord117
ord619
ord2798
ord2837
ord1973
ord2742
ord535
ord116
ord516
ord636
ord642
ord418
ord849
ord1229
ord444
ord398
ord746
ord438
ord445
ord402
ord760
ord622
ord863
ord3837
ord2391
ord1161
ord583
ord815
ord2009
ord537
ord588
ord627
ord1961
ord420
ord910
ord1985
ord854
ord227
ord253
ord1869
ord488
ord2034
ord55
ord490
ord493
ord491
ord492
ord497
ord3212
ord1968
ord416
ord2014
ord832
ord214
ord1935
ord417
ord220
ord3481
ord3424
ord3456
ord3585
ord3452
ord3473
ord3742
ord3400
ord3443
ord3714
ord3519
ord3556
ord3707
ord2683
ord2701
ord3379
ord3405
ord2693
ord2985
ord3528
ord2568
ord3555
ord3607
ord3494
ord3475
ord3617
ord3749
ord365
ord3711
ord3447
ord638
ord652
ord1020
ord1017
ord1015
ord1016
ord284
ord2051
ord1997
ord820
ord634
ord2066
ord2446
ord2405
ord3920
ord2404
ord2790
ord639
ord869
ord866
ord857
ord662
ord676
ord2074
ord653
ord2082
ord2140
ord2184
ord1928
ord1933
ord357
ord630
ord4054
ord2254
ord2996
ord3155
ord2927
ord318
ord299
ord118
ord2749
ord2682
ord2710
ord3113
ord2966
ord3034
ord3173
ord2827
ord2726
ord2902
ord370
ord107
ord3866
ord915
ord84
ord53
ord108
ord58
ord3330
ord3353
ord96
ord1010
ord2426
ord3020
ord85
ord368
ord2502
ord2493
ord501
ord45
ord884
ord3074
ord799
ord478
ord338
ord153
ord2
ord3644
ord3480
ord3666
ord3719
ord3374
ord465
ord219
ord216
ord469
ord498
ord495
ord256
ord2660
ord276
ord2656
ord266
ord2894
ord3067
ord961
ord992
ord40
ord471
ord879
ord3829
ord3171
ord785
ord796
ord477
ord1252
ord3669
ord3654
ord964
ord2438
ord3165
ord322
ord784
ord988
ord46
ord476
ord479
ord886
ord3024
ord2147
ord750
ord494
ord483
ord91
ord193
ord2979
ord2947
ord3013
ord3016
ord2916
ord2783
ord2723
ord2946
ord3045
ord2558
ord3102
ord3174
ord3140
ord3144
ord2857
ord2892
ord2913
ord3064
ord3126
ord2580
ord2585
ord2893
ord81
ord1291
ord1304
ord1279
ord1308
ord4
ord1959
ord714
ord774
ord2063
ord2408

wsock32

closesocket
shutdown
__WSAFDIsSet
select
WSAGetLastError
getsockname
WSACleanup
WSACancelBlockingCall
WSAStartup
connect
setsockopt
socket
htonl
accept
gethostbyaddr
gethostbyname
getservbyname
ntohs
bind
listen
htons

kernel32

GetNumberOfConsoleInputEvents
PeekConsoleInputA
GetFileAttributesA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
InitializeCriticalSection
LoadLibraryA
LCMapStringW
LCMapStringA
GetCurrentDirectoryA
GetFullPathNameA
LoadLibraryW
RtlUnwind
FlushFileBuffers
SetEndOfFile
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsDebuggerPresent
GetCurrentProcess
TerminateProcess
DeleteCriticalSection
GetStartupInfoA
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
Sleep
FindNextFileA
GetProcessHeap
GetVersionExA
GetCommandLineA
HeapFree
HeapReAlloc
HeapAlloc
SetConsoleCtrlHandler
DeleteFileA
MoveFileA
GetTimeZoneInformation
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleA
GetProcAddress
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
GetModuleFileNameW
GetStdHandle
WriteConsoleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateFileA
GetFileType
EnterCriticalSection
LeaveCriticalSection
GetLastError
CloseHandle
SetFilePointer
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
ReadFile
GetModuleFileNameA

Exports

Exports

OPENSSL_Applink

Sections

.text
Size: 284KB - Virtual size: 283KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bin/sitemgr.js
.js
bin/update.cmd
.cmd .vbs
bin/xmlcache.exe
.exe windows:4 windows x86

5446b2e9bdeb227d979dd84e87a7e1a7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

libmgr

_Z10FileExistsRKSs
_Z10SetWorkDirSsi
_Z11GetNodePropP8_xmlNodePKc
_Z17WriteSimpleConfigRKSsRSt3mapISsSsSt4lessISsESaISt4pairIS_SsEEE
_Z3Strx
_Z7ReplaceRKSsS0_Ss
_Z9CreateDirRKSsiii
_ZN3Dir8ReadFileEv
_ZN3DirC1ERKSs
_ZN3DirD1Ev
_ZN5xpathC1EP7_xmlDocSs
_ZN5xpathD1Ev
_ZN5xpathixEi

libxml2

xmlAddChild
xmlCopyNode
xmlDocCopyNode
xmlDocGetRootElement
xmlDocSetRootElement
xmlFree
xmlFreeDoc
xmlGetLastError
xmlGetProp
xmlNewDoc
xmlNewNode
xmlParseFile
xmlSaveFile
xmlSetProp
xmlUnlinkNode

kernel32

CloseHandle
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

_strdup
_write
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_iob
_lock
_onexit
_stat
_unlock
abort
calloc
exit
fprintf
fputc
fputs
free
fwrite
malloc
memchr
memcpy
memmove
memset
printf
realloc
signal
sprintf
strcmp
strcpy
strerror
strlen
vfprintf

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bin/xmlinstall.exe
.exe windows:4 windows x86

5a6eadc086ad43b266ad7c21ca44f06c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

libxml2

xmlAddChild
xmlAddPrevSibling
xmlDocCopyNode
xmlDocGetRootElement
xmlDocSetRootElement
xmlFreeDoc
xmlGetLastError
xmlGetProp
xmlNewDoc
xmlNewDocText
xmlNewNode
xmlNodeSetContent
xmlParseFile
xmlSaveFormatFile
xmlUnlinkNode
xmlUnsetProp

kernel32

CloseHandle
CreateSemaphoreA
ExitProcess
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

_stat
_strdup
_unlink
_write
__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_iob
_onexit
_setmode
abort
atexit
atoi
exit
fprintf
fputc
fputs
free
fwrite
getenv
malloc
memchr
memcpy
memmove
memset
printf
puts
realloc
signal
sprintf
strcmp
strcpy
strerror
strlen

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 168B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cgi/iismgr.exe
.exe windows:4 windows x86

38969a5160ff3bdda1040b1aa7ab2306

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
StartServiceW

kernel32

CloseHandle
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

_read
_write
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_environ
_exit
_fmode
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
abort
atoi
calloc
exit
fprintf
fputc
fputs
free
fwrite
getenv
malloc
memchr
memcpy
memmove
memset
printf
puts
raise
realloc
signal
sprintf
strcmp
strcpy
strerror
strlen
vfprintf
wcslen

user32

MessageBoxA

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
WSAStringToAddressW
__WSAFDIsSet
closesocket
connect
htons
recv
select
send
socket

Sections

.text
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cgi/web.config
.xml
etc/ispmgr.xml
.xml .js
etc/ispmgr_eula_en.xml
etc/ispmgr_eula_fr.xml
etc/ispmgr_eula_ru.xml
etc/ispmgr_lic.txt
etc/ispmgr_msg_bg.xml
.xml
etc/ispmgr_msg_de.xml
.xml
etc/ispmgr_msg_en.xml
.xml
etc/ispmgr_msg_es.xml
.xml
etc/ispmgr_msg_fr.xml
.xml
etc/ispmgr_msg_nl.xml
.xml
etc/ispmgr_msg_pl.xml
.xml
etc/ispmgr_msg_ru.xml
.xml
etc/ispmgr_msg_ua.xml
.xml
skins/data.xml
skins/graph.swf
skins/graph2.swf
skins/mobile/back.gif
.gif
skins/mobile/banner1-icon.png
.png
skins/mobile/banner1.gif
.gif
skins/mobile/banner2-icon.png
.png
skins/mobile/banner2.gif
.gif
skins/mobile/banner3-icon.png
.png
skins/mobile/banner3.gif
.gif
skins/mobile/bullet.gif
.gif
skins/mobile/desktop.xsl
.xml .js
skins/mobile/down.gif
.gif
skins/mobile/e-bg.gif
.gif
skins/mobile/e.gif
.gif
skins/mobile/eula.xsl
.xml .js
skins/mobile/ff-calendar-a.gif
.gif
skins/mobile/ff-calendar.gif
.gif
skins/mobile/ff-genpwd-a.gif
.gif
skins/mobile/ff-genpwd.gif
.gif
skins/mobile/ff-openurl-a.gif
.gif
skins/mobile/ff-openurl.gif
.gif
skins/mobile/ff-unlimit-a.gif
.gif
skins/mobile/ff-unlimit.gif
.gif
skins/mobile/ff-unzoom-a.gif
.gif
skins/mobile/ff-unzoom.gif
.gif
skins/mobile/ff-zoom-a.gif
.gif
skins/mobile/ff-zoom.gif
.gif
skins/mobile/fi-close.gif
.gif
skins/mobile/fi-help.gif
.gif
skins/mobile/fi-max.gif
.gif
skins/mobile/fi-min.gif
.gif
skins/mobile/form.js
.js
skins/mobile/fsh-bottom.gif
.gif
skins/mobile/fsh-bottom.png
.png
skins/mobile/fsh-left.gif
.gif
skins/mobile/fsh-left.png
.png
skins/mobile/fsh-left2.gif
.gif
skins/mobile/fsh-left2.png
.png
skins/mobile/ft-center.png
.png
skins/mobile/ft-left.png
.png
skins/mobile/ft-right.png
.png
skins/mobile/h-m-bg.gif
.gif
skins/mobile/h-m-bgf.gif
.gif
skins/mobile/h-m-bul.gif
.gif
skins/mobile/h-m-bull.gif
.gif
skins/mobile/help-back1.gif
.gif
skins/mobile/help-back2.gif
.gif
skins/mobile/help-forward1.gif
.gif
skins/mobile/help-forward2.gif
.gif
skins/mobile/help.xsl
.xml .js
skins/mobile/login-bg.gif
.gif
skins/mobile/login-logo-billmgr.png
.png
skins/mobile/login-logo-dnsmgr.png
.png
skins/mobile/login-logo-dsmgr.png
.png
skins/mobile/login-logo-ipmgr.png
.png
skins/mobile/login-logo-ispmgr.png
.png
skins/mobile/login-logo-vdsmgr.png
.png
skins/mobile/login.xsl
.xml .js
skins/mobile/logo-billmgr.png
.png
skins/mobile/logo-dnsmgr.png
.png
skins/mobile/logo-dsmgr.png
.png
skins/mobile/logo-ipmgr.png
.png
skins/mobile/logo-ispmgr.png
.png
skins/mobile/logo-vdsmgr.png
.png
skins/mobile/lv-10.png
.png
skins/mobile/lv-11.png
.png
skins/mobile/lv-12.png
.png
skins/mobile/lv-2.png
.png
skins/mobile/lv-3.png
.png
skins/mobile/lv-4.png
.png
skins/mobile/lv-5.png
.png
skins/mobile/lv-6.png
.png
skins/mobile/lv-7.png
.png
skins/mobile/lv-8.png
.png
skins/mobile/lv-server.png
.png
skins/mobile/m-account.png
.png
skins/mobile/m-antispam.png
.png
skins/mobile/m-clustersettings.png
.png
skins/mobile/m-customer.png
.png
skins/mobile/m-directory.png
.png
skins/mobile/m-domains.png
.png
skins/mobile/m-equipment.png
.png
skins/mobile/m-ext.png
.png
skins/mobile/m-finance.png
.png
skins/mobile/m-integration.png
.png
skins/mobile/m-mail.png
.png
skins/mobile/m-main.png
.png
skins/mobile/m-maintain.png
.png
skins/mobile/m-mgrhelp.png
.png
skins/mobile/m-productnode.png
.png
skins/mobile/m-provider.png
.png
skins/mobile/m-service.png
.png
skins/mobile/m-set.png
.png
skins/mobile/m-set2.png
.png
skins/mobile/m-srvset.png
.png
skins/mobile/m-stat.png
.png
skins/mobile/m-support.png
.png
skins/mobile/m-tool.png
.png
skins/mobile/m-www.png
.png
skins/mobile/main.css
skins/mobile/main.js
.js
skins/mobile/mb-account.png
.png
skins/mobile/mb-antispam.png
.png
skins/mobile/mb-clustersettings.png
.png
skins/mobile/mb-cron.png
.png
skins/mobile/mb-customer.png
.png
skins/mobile/mb-db.png
.png
skins/mobile/mb-directory.png
.png
skins/mobile/mb-domains.png
.png
skins/mobile/mb-equipment.png
.png
skins/mobile/mb-file.png
.png
skins/mobile/mb-finance.png
.png
skins/mobile/mb-integration.png
.png
skins/mobile/mb-mail.png
.png
skins/mobile/mb-main.png
.png
skins/mobile/mb-maintain.png
.png
skins/mobile/mb-mgrhelp.png
.png
skins/mobile/mb-productnode.png
.png
skins/mobile/mb-provider.png
.png
skins/mobile/mb-service.png
.png
skins/mobile/mb-set.png
.png
skins/mobile/mb-set2.png
.png
skins/mobile/mb-srvset.png
.png
skins/mobile/mb-stat.png
.png
skins/mobile/mb-support.png
.png
skins/mobile/mb-tool.png
.png
skins/mobile/mb-www.png
.png
skins/mobile/menu-1.gif
.gif
skins/mobile/menu-2.gif
.gif
skins/mobile/menu-3.gif
.gif
skins/mobile/menu-bg.gif
.gif
skins/mobile/menu-bul-last.gif
.gif
skins/mobile/menu-bul.gif
.gif
skins/mobile/modules.xsl
.xml .js
skins/mobile/p-admdown.png
.png
skins/mobile/p-attr.png
.png
skins/mobile/p-auto.png
.png
skins/mobile/p-bpftp.png
.png
skins/mobile/p-bplocal.png
.png
skins/mobile/p-bprar.png
.png
skins/mobile/p-bptar.png
.png
skins/mobile/p-bptbz2.png
.png
skins/mobile/p-bptgz.png
.png
skins/mobile/p-bpzip.png
.png
skins/mobile/p-camera.png
.png
skins/mobile/p-cgi.png
.png
skins/mobile/p-dbak.png
.png
skins/mobile/p-email.png
.png
skins/mobile/p-error.png
.png
skins/mobile/p-file-0.png
.png
skins/mobile/p-file-1.png
.png
skins/mobile/p-file-10.png
.png
skins/mobile/p-file-100.png
.png
skins/mobile/p-file-101.png
.png
skins/mobile/p-file-11.png
.png
skins/mobile/p-file-110.png
.png
skins/mobile/p-file-2.png
.png
skins/mobile/p-file-202.png
.png
skins/mobile/p-file-203.png
.png
skins/mobile/p-file-204.png
.png
skins/mobile/p-file-205.png
.png
skins/mobile/p-file-3.png
.png
skins/mobile/p-file-4.png
.png
skins/mobile/p-file-5.png
.png
skins/mobile/p-file-6.png
.png
skins/mobile/p-file-99.png
.png
skins/mobile/p-frp.png
.png
skins/mobile/p-ftp.png
.png
skins/mobile/p-inetoff.png
.png
skins/mobile/p-ineton.png
.png
skins/mobile/p-install.gif
.gif
skins/mobile/p-ipmi.png
.png
skins/mobile/p-kvm.png
.png
skins/mobile/p-lock.png
.png
skins/mobile/p-mail-ar.png
.png
skins/mobile/p-manage.png
.png
skins/mobile/p-mbak.png
.png
skins/mobile/p-mon.png
.png
skins/mobile/p-newmsg.png
.png
skins/mobile/p-nobak.png
.png
skins/mobile/p-note.png
.png
skins/mobile/p-off.png
.png
skins/mobile/p-on.png
.png
skins/mobile/p-onoff.png
.png
skins/mobile/p-php.png
.png
skins/mobile/p-pr1.png
.png
skins/mobile/p-pr2.png
.png
skins/mobile/p-pr3.png
.png
skins/mobile/p-procin.gif
.gif
skins/mobile/p-procout.gif
.gif
skins/mobile/p-read.png
.png
skins/mobile/p-redirect.png
.png
skins/mobile/p-repair.gif
.gif
skins/mobile/p-resell.png
.png
skins/mobile/p-root.png
.png
skins/mobile/p-ror.png
.png
skins/mobile/p-sadmin.png
.png
skins/mobile/p-shell.png
.png
skins/mobile/p-ssi.png
.png
skins/mobile/p-ssl.png
.png
skins/mobile/p-wbak.png
.png
skins/mobile/p-write.png
.png
skins/mobile/pc-a-l.png
.png
skins/mobile/pc-a-r.png
.png
skins/mobile/pc-i-c.png
.png
skins/mobile/pc-i-l.png
.png
skins/mobile/pc-i-r.png
.png
skins/mobile/report.xsl
.xml
skins/mobile/sb-help.gif
.gif
skins/mobile/sb-logout.gif
.gif
skins/mobile/sb-menu.png
.png
skins/mobile/sb-set.gif
.gif
skins/mobile/sb-table.png
.png
skins/mobile/t-addon.png
.png
skins/mobile/t-aid.png
.png
skins/mobile/t-archive.png
.png
skins/mobile/t-attr.png
.png
skins/mobile/t-back.png
.png
skins/mobile/t-brules.png
.png
skins/mobile/t-company.png
.png
skins/mobile/t-contract.png
.png
skins/mobile/t-copy.png
.png
skins/mobile/t-crate.png
.png
skins/mobile/t-credit.png
.png
skins/mobile/t-cut.png
.png
skins/mobile/t-delete.png
.png
skins/mobile/t-discount.png
.png
skins/mobile/t-download.png
.png
skins/mobile/t-edit.png
.png
skins/mobile/t-editlist.png
.png
skins/mobile/t-errpage.png
.png
skins/mobile/t-expense.png
.png
skins/mobile/t-filter.png
.png
skins/mobile/t-filterchange.png
.png
skins/mobile/t-filterhappy.png
.png
skins/mobile/t-filternoprofit.png
.png
skins/mobile/t-fromarchive.png
.png
skins/mobile/t-go.png
.png
skins/mobile/t-goisp.png
.png
skins/mobile/t-group.png
.png
skins/mobile/t-install.png
.png
skins/mobile/t-invoice.png
.png
skins/mobile/t-iplist.png
.png
skins/mobile/t-item.png
.png
skins/mobile/t-mail-ar.png
.png
skins/mobile/t-mail-box.png
.png
skins/mobile/t-mail-clear.png
.png
skins/mobile/t-mail-fwd.png
.png
skins/mobile/t-mail-grp.png
.png
skins/mobile/t-new.png
.png
skins/mobile/t-nofilter.png
.png
skins/mobile/t-off.png
.png
skins/mobile/t-on.png
.png
skins/mobile/t-outlook.png
.png
skins/mobile/t-paste.png
.png
skins/mobile/t-paymethod.png
.png
skins/mobile/t-payorder.png
.png
skins/mobile/t-period.png
.png
skins/mobile/t-print.png
.png
skins/mobile/t-printd.png
.png
skins/mobile/t-project.png
.png
skins/mobile/t-prolong.png
.png
skins/mobile/t-redirect.png
.png
skins/mobile/t-remcfg.png
.png
skins/mobile/t-restart.png
.png
skins/mobile/t-rights.png
.png
skins/mobile/t-rotate.png
.png
skins/mobile/t-sender.png
.png
skins/mobile/t-sendmsg.png
.png
skins/mobile/t-setpaid.png
.png
skins/mobile/t-sign.png
.png
skins/mobile/t-sslview.png
.png
skins/mobile/t-start.png
.png
skins/mobile/t-stat.png
.png
skins/mobile/t-stop.png
.png
skins/mobile/t-subscriber.png
.png
skins/mobile/t-toarchive.png
.png
skins/mobile/t-upload.png
.png
skins/mobile/t-users.png
.png
skins/mobile/t-video.png
.png
skins/mobile/table.js
.js
skins/mobile/table.png
.png
skins/mobile/tb-user.gif
.gif
skins/mobile/toolbtn.gif
.gif
skins/mobile/up.gif
.gif
skins/mobile/waiting.gif
.gif
skins/mobile/welcome-left.gif
.gif
skins/sirius/admin_tickets.js
skins/sirius/admin_tickets_edit.js
.js
skins/sirius/ajax.js
.js
skins/sirius/back.gif
.gif
skins/sirius/banner1-icon.png
.png
skins/sirius/banner1.gif
.gif
skins/sirius/banner2-icon.png
.png
skins/sirius/banner2.gif
.gif
skins/sirius/banner3-icon.png
.png
skins/sirius/banner3.gif
.gif
skins/sirius/billmgr.ico
skins/sirius/bullet.gif
.gif
skins/sirius/calendar.js
.js
skins/sirius/desktop.xsl
.xml .js
skins/sirius/dnsmgr.ico
skins/sirius/down.gif
.gif
skins/sirius/dsmgr.ico
skins/sirius/e-bg.gif
.gif
skins/sirius/e.gif
.gif
skins/sirius/eula.xsl
.xml .js
skins/sirius/excel.png
.png
skins/sirius/ff-calendar-a.gif
.gif
skins/sirius/ff-calendar.gif
.gif
skins/sirius/ff-genpwd-a.gif
.gif
skins/sirius/ff-genpwd.gif
.gif
skins/sirius/ff-minus-a.gif
.gif
skins/sirius/ff-minus.gif
.gif
skins/sirius/ff-openurl-a.gif
.gif
skins/sirius/ff-openurl.gif
.gif
skins/sirius/ff-plus-a.gif
.gif
skins/sirius/ff-plus.gif
.gif
skins/sirius/ff-unlimit-a.gif
.gif
skins/sirius/ff-unlimit.gif
.gif
skins/sirius/ff-unzoom-a.gif
.gif
skins/sirius/ff-unzoom.gif
.gif
skins/sirius/ff-zoom-a.gif
.gif
skins/sirius/ff-zoom.gif
.gif
skins/sirius/fi-close.png
.png
skins/sirius/fi-help.png
.png
skins/sirius/fi-max.png
.png
skins/sirius/fi-min.png
.png
skins/sirius/form.js
.js
skins/sirius/fsh-bottom.gif
.gif
skins/sirius/fsh-bottom.png
.png
skins/sirius/fsh-left.gif
.gif
skins/sirius/fsh-left.png
.png
skins/sirius/fsh-left2.gif
.gif
skins/sirius/fsh-left2.png
.png
skins/sirius/ft-center.png
.png
skins/sirius/ft-left.png
.png
skins/sirius/ft-right.png
.png
skins/sirius/grayscale.js
.js
skins/sirius/h-m-bg.gif
.gif
skins/sirius/h-m-bgf.gif
.gif
skins/sirius/h-m-bul.gif
.gif
skins/sirius/h-m-bull.gif
.gif
skins/sirius/help-back1.gif
.gif
skins/sirius/help-back2.gif
.gif
skins/sirius/help-forward1.gif
.gif
skins/sirius/help-forward2.gif
.gif
skins/sirius/help.js
.js
skins/sirius/help.xsl
.xml .js
skins/sirius/hotkeys.js
.js
skins/sirius/hue-ibg.gif
.gif
skins/sirius/ipmgr.ico
skins/sirius/ispmgr.ico
skins/sirius/login-bg.gif
.gif
skins/sirius/login-logo-billmgr.png
.png
skins/sirius/login-logo-dnsmgr.png
.png
skins/sirius/login-logo-dsmgr.png
.png
skins/sirius/login-logo-ipmgr.png
.png
skins/sirius/login-logo-ispmgr.png
.png
skins/sirius/login-logo-vdsmgr.png
.png
skins/sirius/login.xsl
.xml .js
skins/sirius/logo-billmgr.png
.png
skins/sirius/logo-dnsmgr.png
.png
skins/sirius/logo-dsmgr.png
.png
skins/sirius/logo-ipmgr.png
.png
skins/sirius/logo-ispmgr.png
.png
skins/sirius/logo-vdsmgr.png
.png
skins/sirius/lv-10.png
.png
skins/sirius/lv-11.png
.png
skins/sirius/lv-12.png
.png
skins/sirius/lv-2.png
.png
skins/sirius/lv-3.png
.png
skins/sirius/lv-4.png
.png
skins/sirius/lv-5.png
.png
skins/sirius/lv-6.png
.png
skins/sirius/lv-7.png
.png
skins/sirius/lv-8.png
.png
skins/sirius/lv-server.png
.png
skins/sirius/m-account.png
.png
skins/sirius/m-antispam.png
.png
skins/sirius/m-clustersettings.png
.png
skins/sirius/m-customer.png
.png
skins/sirius/m-directory.png
.png
skins/sirius/m-domains.png
.png
skins/sirius/m-equipment.png
.png
skins/sirius/m-ext.png
.png
skins/sirius/m-finance.png
.png
skins/sirius/m-integration.png
.png
skins/sirius/m-mail.png
.png
skins/sirius/m-main.png
.png
skins/sirius/m-maintain.png
.png
skins/sirius/m-marketing.png
.png
skins/sirius/m-mgrhelp.png
.png
skins/sirius/m-productnode.png
.png
skins/sirius/m-provider.png
.png
skins/sirius/m-service.png
.png
skins/sirius/m-set.png
.png
skins/sirius/m-set2.png
.png
skins/sirius/m-srvset.png
.png
skins/sirius/m-stat.png
.png
skins/sirius/m-support.png
.png
skins/sirius/m-tool.png
.png
skins/sirius/m-www.png
.png
skins/sirius/main.css
skins/sirius/main.js
.js
skins/sirius/mb-account.png
.png
skins/sirius/mb-antispam.png
.png
skins/sirius/mb-clustersettings.png
.png
skins/sirius/mb-cron.png
.png
skins/sirius/mb-customer.png
.png
skins/sirius/mb-db.png
.png
skins/sirius/mb-directory.png
.png
skins/sirius/mb-domains.png
.png
skins/sirius/mb-equipment.png
.png
skins/sirius/mb-file.png
.png
skins/sirius/mb-finance.png
.png
skins/sirius/mb-integration.png
.png
skins/sirius/mb-mail.png
.png
skins/sirius/mb-main.png
.png
skins/sirius/mb-maintain.png
.png
skins/sirius/mb-marketing.png
.png
skins/sirius/mb-mgrhelp.png
.png
skins/sirius/mb-productnode.png
.png
skins/sirius/mb-provider.png
.png
skins/sirius/mb-service.png
.png
skins/sirius/mb-set.png
.png
skins/sirius/mb-set2.png
.png
skins/sirius/mb-srvset.png
.png
skins/sirius/mb-stat.png
.png
skins/sirius/mb-support.png
.png
skins/sirius/mb-tool.png
.png
skins/sirius/mb-www.png
.png
skins/sirius/mbar-all.png
.png
skins/sirius/mbar-favorite.png
.png
skins/sirius/mbar-hideall.png
.png
skins/sirius/mbar-popular.png
.png
skins/sirius/mbar-showall.png
.png
skins/sirius/menu-1.gif
.gif
skins/sirius/menu-2.gif
.gif
skins/sirius/menu-3.gif
.gif
skins/sirius/menu-bg.gif
.gif
skins/sirius/menu-bul-last.gif
.gif
skins/sirius/menu-bul.gif
.gif
skins/sirius/menubar-bg.gif
.gif
skins/sirius/menubar-onbg.gif
.gif
skins/sirius/modules.xsl
.xml .js
skins/sirius/p-admdown.png
.png
skins/sirius/p-attach.png
.png
skins/sirius/p-attr.png
.png
skins/sirius/p-auto.png
.png
skins/sirius/p-bpftp.png
.png
skins/sirius/p-bplocal.png
.png
skins/sirius/p-bprar.png
.png
skins/sirius/p-bptar.png
.png
skins/sirius/p-bptbz2.png
.png
skins/sirius/p-bptgz.png
.png
skins/sirius/p-bpzip.png
.png
skins/sirius/p-camera.png
.png
skins/sirius/p-cgi.png
.png
skins/sirius/p-dbak.png
.png
skins/sirius/p-deprecated.png
.png
skins/sirius/p-email.png
.png
skins/sirius/p-error.png
.png
skins/sirius/p-file-0.png
.png
skins/sirius/p-file-1.png
.png
skins/sirius/p-file-10.png
.png
skins/sirius/p-file-100.png
.png
skins/sirius/p-file-101.png
.png
skins/sirius/p-file-11.png
.png
skins/sirius/p-file-110.png
.png
skins/sirius/p-file-2.png
.png
skins/sirius/p-file-202.png
.png
skins/sirius/p-file-203.png
.png
skins/sirius/p-file-204.png
.png
skins/sirius/p-file-205.png
.png
skins/sirius/p-file-3.png
.png
skins/sirius/p-file-300.png
.png
skins/sirius/p-file-4.png
.png
skins/sirius/p-file-5.png
.png
skins/sirius/p-file-6.png
.png
skins/sirius/p-file-99.png
.png
skins/sirius/p-frp.png
.png
skins/sirius/p-ftp.png
.png
skins/sirius/p-inetoff.png
.png
skins/sirius/p-ineton.png
.png
skins/sirius/p-inetonoff.png
.png
skins/sirius/p-install.gif
.gif
skins/sirius/p-ipmi.png
.png
skins/sirius/p-kvm.png
.png
skins/sirius/p-lock.png
.png
skins/sirius/p-love1.png
.png
skins/sirius/p-love2.png
.png
skins/sirius/p-mail-ar.png
.png
skins/sirius/p-manage.png
.png
skins/sirius/p-mbak.png
.png
skins/sirius/p-mon.png
.png
skins/sirius/p-newmsg.png
.png
skins/sirius/p-nobak.png
.png
skins/sirius/p-note.png
.png
skins/sirius/p-off.png
.png
skins/sirius/p-on.png
.png
skins/sirius/p-onoff.png
.png
skins/sirius/p-php.png
.png
skins/sirius/p-popular.png
.png
skins/sirius/p-pr1.png
.png
skins/sirius/p-pr2.png
.png
skins/sirius/p-pr3.png
.png
skins/sirius/p-procin.gif
.gif
skins/sirius/p-procout.gif
.gif
skins/sirius/p-read.png
.png
skins/sirius/p-redirect.png
.png
skins/sirius/p-repair.gif
.gif
skins/sirius/p-resell.png
.png
skins/sirius/p-root.png
.png
skins/sirius/p-ror.png
.png
skins/sirius/p-sadmin.png
.png
skins/sirius/p-shell.png
.png
skins/sirius/p-ssi.png
.png
skins/sirius/p-ssl.png
.png
skins/sirius/p-wbak.png
.png
skins/sirius/p-write.png
.png
skins/sirius/pc-a-l.png
.png
skins/sirius/pc-a-r.png
.png
skins/sirius/pc-i-c.png
.png
skins/sirius/pc-i-l.png
.png
skins/sirius/pc-i-r.png
.png
skins/sirius/report.xsl
.xml .js
skins/sirius/sb-help.gif
.gif
skins/sirius/sb-logout.gif
.gif
skins/sirius/sb-set.gif
.gif
skins/sirius/slider-bg.gif
.gif
skins/sirius/slider.gif
.gif
skins/sirius/slider.js
.js
skins/sirius/swfobject.js
.js
skins/sirius/t-addon.png
.png
skins/sirius/t-aid.png
.png
skins/sirius/t-archive.png
.png
skins/sirius/t-attr.png
.png
skins/sirius/t-autocredit.png
.png
skins/sirius/t-back.png
.png
skins/sirius/t-brules.png
.png
skins/sirius/t-company.png
.png
skins/sirius/t-contract.png
.png
skins/sirius/t-copy.png
.png
skins/sirius/t-crate.png
.png
skins/sirius/t-credit.png
.png
skins/sirius/t-cut.png
.png
skins/sirius/t-delete.png
.png
skins/sirius/t-discount.png
.png
skins/sirius/t-download.png
.png
skins/sirius/t-edit.png
.png
skins/sirius/t-editlist.png
.png
skins/sirius/t-errpage.png
.png
skins/sirius/t-expense.png
.png
skins/sirius/t-filter.png
.png
skins/sirius/t-filterchange.png
.png
skins/sirius/t-filterhappy.png
.png
skins/sirius/t-filternoprofit.png
.png
skins/sirius/t-fromarchive.png
.png
skins/sirius/t-go.png
.png
skins/sirius/t-goisp.png
.png
skins/sirius/t-gosrv.png
.png
skins/sirius/t-group.png
.png
skins/sirius/t-install.png
.png
skins/sirius/t-invoice.png
.png
skins/sirius/t-iplist.png
.png
skins/sirius/t-item.png
.png
skins/sirius/t-mail-ar.png
.png
skins/sirius/t-mail-box.png
.png
skins/sirius/t-mail-clear.png
.png
skins/sirius/t-mail-fwd.png
.png
skins/sirius/t-mail-grp.png
.png
skins/sirius/t-new.png
.png
skins/sirius/t-nofilter.png
.png
skins/sirius/t-off.png
.png
skins/sirius/t-on.png
.png
skins/sirius/t-outlook.png
.png
skins/sirius/t-paste.png
.png
skins/sirius/t-paymethod.png
.png
skins/sirius/t-payorder.png
.png
skins/sirius/t-period.png
.png
skins/sirius/t-print.png
.png
skins/sirius/t-printd.png
.png
skins/sirius/t-printenvelope.png
.png
skins/sirius/t-project.png
.png
skins/sirius/t-prolong.png
.png
skins/sirius/t-redirect.png
.png
skins/sirius/t-remcfg.png
.png
skins/sirius/t-restart.png
.png
skins/sirius/t-retry.png
.png
skins/sirius/t-rights.png
.png
skins/sirius/t-rotate.png
.png
skins/sirius/t-sender.png
.png
skins/sirius/t-sendmsg.png
.png
skins/sirius/t-setpaid.png
.png
skins/sirius/t-sign.png
.png
skins/sirius/t-spam.png
.png
skins/sirius/t-sslview.png
.png
skins/sirius/t-start.png
.png
skins/sirius/t-stat.png
.png
skins/sirius/t-stop.png
.png
skins/sirius/t-subscriber.png
.png
skins/sirius/t-timetable.png
.png
skins/sirius/t-toarchive.png
.png
skins/sirius/t-trules.png
.png
skins/sirius/t-unlock.png
.png
skins/sirius/t-upload.png
.png
skins/sirius/t-users.png
.png
skins/sirius/t-video.png
.png
skins/sirius/table.js
.js
skins/sirius/table.png
.png
skins/sirius/tb-user.gif
.gif
skins/sirius/tickets_quote.js
.js
skins/sirius/toolbtn.gif
.gif
skins/sirius/up.gif
.gif
skins/sirius/vdsmgr.ico
skins/sirius/waiting.gif
.gif
skins/sirius/welcome-left.gif
.gif
var/addon/filemgr.exe
.exe windows:4 windows x86

8badeb1669f9b3e1f8eea467969d0867

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

7-zip32

ord1
ord200
ord22
ord12
ord23
ord24
ord21

advapi32

GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetAclInformation
GetAce
CreateProcessAsUserW
CreateProcessWithLogonW
LogonUserW
ImpersonateLoggedOnUser
IsValidSecurityDescriptor
GetSecurityDescriptorControl
GetSecurityDescriptorLength
MakeSelfRelativeSD
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
MakeAbsoluteSD
InitializeSecurityDescriptor
SetSecurityInfo
GetSecurityInfo
CopySid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
InitializeAcl
AddAccessAllowedAce
IsValidAcl
SetSecurityDescriptorDacl
AddAccessDeniedAce
IsValidSid
ConvertSidToStringSidW
LookupAccountSidW
LookupAccountNameW
GetLengthSid
AllocateAndInitializeSid
FreeSid
ConvertStringSidToSidW
CreateWellKnownSid
GetTokenInformation
DeleteAce
PrivilegeCheck
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeDisplayNameW
GetUserNameW
IsTextUnicode

zlib1

gzclose
gzopen
gzread

iconv

libiconv
libiconv_close
libiconv_open

libxml2

xmlAddChild
xmlCheckUTF8
xmlCopyDoc
xmlCopyNode
xmlDocDump
xmlDocDumpFormatMemory
xmlDocGetRootElement
xmlDocSetRootElement
xmlFree
xmlFreeDoc
xmlFreeNode
xmlGetLastError
xmlGetProp
xmlGetUTF8Char
xmlNewChild
xmlNewDoc
xmlNewNode
xmlNodeGetContent
xmlNodeSetContent
xmlParseFile
xmlParseMemory
xmlSaveFile
xmlSchemaFree
xmlSchemaFreeParserCtxt
xmlSchemaFreeValidCtxt
xmlSchemaNewMemParserCtxt
xmlSchemaNewParserCtxt
xmlSchemaNewValidCtxt
xmlSchemaParse
xmlSchemaSetParserStructuredErrors
xmlSchemaSetValidStructuredErrors
xmlSchemaValidateDoc
xmlSetProp
xmlUnlinkNode
xmlXPathEvalExpression
xmlXPathFreeContext
xmlXPathFreeObject
xmlXPathNewContext
xmlXPathRegisterNs

kernel32

AssignProcessToJobObject
CloseHandle
CompareStringW
CopyFileW
CreateFileA
CreateFileMappingW
CreateFileW
CreateJobObjectW
CreatePipe
CreateProcessA
CreateProcessW
CreateSemaphoreA
DeleteCriticalSection
DeleteFileW
DeviceIoControl
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FormatMessageW
FreeLibrary
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExW
GetDriveTypeW
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSizeEx
GetFileTime
GetLastError
GetLogicalDriveStringsW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemTimeAsFileTime
GetTempFileNameW
GetTickCount
GetTimeZoneInformation
GetVersionExW
GetVolumePathNamesForVolumeNameW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalAlloc
LocalFree
LockFile
MapViewOfFile
MoveFileExW
MultiByteToWideChar
PeekNamedPipe
QueryDosDeviceW
QueryPerformanceCounter
ReadFile
ReleaseSemaphore
RemoveDirectoryW
ResumeThread
SetCurrentDirectoryW
SetEndOfFile
SetErrorMode
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetHandleInformation
SetInformationJobObject
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

_close
_fdopen
_fileno
_getpid
_lseek
_mkdir
_open
_read
_rmdir
_strdup
_unlink
_write
___lc_codepage_func
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_errno
_filelengthi64
_fileno
_findclose
_findfirst
_findnext
_fmode
_fstat
_fstat64
_fullpath
_i64tow
_initterm
_iob
_lock
_lseeki64
_onexit
_setmode
_snwprintf
_stat
_strnicmp
_unlock
_vsnprintf
_write
abort
atoi
calloc
ctime
exit
fclose
fflush
fgetpos
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
isspace
iswctype
localeconv
localtime
malloc
memchr
memcmp
memcpy
memmove
memset
mktime
printf
putc
puts
putwc
rand
realloc
rename
setlocale
setvbuf
signal
sprintf
srand
strcmp
strcoll
strcpy
strerror
strftime
strlen
strrchr
strtod
strtol
strtoul
strxfrm
time
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
wcschr
wcscoll
wcscpy
wcsftime
wcslen
wcsncat
wcsncmp
wcsncpy
wcsrchr
wcsstr
wcsxfrm

netapi32

NetApiBufferFree
NetLocalGroupAdd
NetLocalGroupAddMembers
NetLocalGroupDel
NetLocalGroupDelMembers
NetLocalGroupEnum
NetLocalGroupGetInfo
NetLocalGroupGetMembers
NetLocalGroupSetInfo
NetUserAdd
NetUserDel
NetUserEnum
NetUserGetInfo
NetUserGetLocalGroups
NetUserSetInfo

psapi

GetMappedFileNameW

shell32

SHCreateDirectoryExW
SHFileOperationW
SHGetSpecialFolderPathW

shlwapi

PathCanonicalizeW
PathIsDirectoryEmptyW
PathUnExpandEnvStringsW

user32

CharLowerW
CharUpperW

wsock32

WSACleanup
WSAStartup
connect
htons
inet_addr
recv
send
socket

Sections

.text
Size: 964KB - Virtual size: 963KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 328KB

UPX1 Size: 229KB - Virtual size: 232KB

.rsrc Size: 1KB - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 438KB - Virtual size: 437KB

.rdata Size: 55KB - Virtual size: 55KB

.data Size: 27KB - Virtual size: 51KB

.rsrc Size: 1024B - Virtual size: 808B

27d678ab7f59de9d3b9c7dc6b25d4f62

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate

Extended Key Usages

Key Usages

61:0e:7d:a7:00:00:00:00:00:48Certificate

Extended Key Usages

Key Usages

ed:ee:70:88:a6:13:ca:0b:b5:fd:24:9d:c4:a9:f8:ec:02:56:b4:12Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

Sections

.text Size: 52KB - Virtual size: 49KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 4KB - Virtual size: 1KB

5ca132ded18f9790aa42ead4ea958d39

Headers

File Characteristics

Imports

advapi32

httpapi

libmysql

zlib1

libxslt

libxml2

crypt32

kernel32

msvcrt

netapi32

odbc32

ole32

oleaut32

psapi

shell32

shlwapi

user32

wininet

wsock32

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.data Size: 26KB - Virtual size: 26KB

.rdata Size: 166KB - Virtual size: 166KB

.bss Size: - Virtual size: 2KB

.idata Size: 16KB - Virtual size: 16KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 1024B - Virtual size: 700B

UPX0
Size: - Virtual size: 328KB

UPX1
Size: 229KB - Virtual size: 232KB

.rsrc
Size: 1KB - Virtual size: 4KB

.text
Size: 438KB - Virtual size: 437KB

.rdata
Size: 55KB - Virtual size: 55KB

.data
Size: 27KB - Virtual size: 51KB

.rsrc
Size: 1024B - Virtual size: 808B

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:0e:7d:a7:00:00:00:00:00:48
Certificate

ed:ee:70:88:a6:13:ca:0b:b5:fd:24:9d:c4:a9:f8:ec:02:56:b4:12
Signer

.text
Size: 52KB - Virtual size: 49KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 4KB - Virtual size: 1KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.data
Size: 26KB - Virtual size: 26KB

.rdata
Size: 166KB - Virtual size: 166KB

.bss
Size: - Virtual size: 2KB

.idata
Size: 16KB - Virtual size: 16KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 1024B - Virtual size: 700B

.text
Size: 609KB - Virtual size: 609KB

.data
Size: 25KB - Virtual size: 25KB

.rdata
Size: 33KB - Virtual size: 32KB

.bss
Size: - Virtual size: 1KB

.edata
Size: 16KB - Virtual size: 15KB

.idata
Size: 7KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 25KB - Virtual size: 24KB

.text
Size: 24KB - Virtual size: 23KB

.data
Size: 512B - Virtual size: 108B

.bss
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 1KB

.text
Size: 88KB - Virtual size: 88KB

.data
Size: 19KB - Virtual size: 18KB

.rdata
Size: 10KB - Virtual size: 10KB

.bss
Size: - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 32B

.text
Size: 284KB - Virtual size: 283KB

.rdata
Size: 88KB - Virtual size: 87KB

.data
Size: 16KB - Virtual size: 25KB