1090247d187b3325fd25472199eef0dc

Sharing

Copy URL Twitter E-mail

General

Target

1090247d187b3325fd25472199eef0dc
Size

1.9MB
MD5

1090247d187b3325fd25472199eef0dc
SHA1

f2a0a4f0c39b591d3304afd7daaafc77ed134a24
SHA256

e3916779613cb7fc9dadb56ab35e8273b979447a4c9b874360fb60d453a37dd6
SHA512

d11c7b53c5054c64bf6ff3316f32ffcb57d961e03f58ca9081d2e6d22bb8d27a0a2edaaca5428500f31266157eea5227d74820d0faec3a8a35bc69e573bf0afc
SSDEEP

49152:pGHbITE27eMR8hZ0OuXtnnsKy2ND8E9NZSk69F:pub9jMRw0btnnO2V8EI3F

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/R-Wipe&Clean/RWipe.dll	aspack_v212_v242

Unsigned PE 15 IoCs

Checks for missing Authenticode signature.

resource
unpack001/R-Wipe&Clean/RPrivSvc.exe
unpack001/R-Wipe&Clean/RWCClean.exe
unpack001/R-Wipe&Clean/RWKbdD.exe
unpack001/R-Wipe&Clean/RWKbdH.dll
unpack001/R-Wipe&Clean/RWipe.dll
unpack001/R-Wipe&Clean/RWipeSrv.exe
unpack001/R-Wipe&Clean/RwcLkRen.exe
unpack001/R-Wipe&Clean/RwcNtSrv.exe
unpack001/R-Wipe&Clean/RwcPub32.dll
unpack001/R-Wipe&Clean/RwcPub64.dll
unpack001/R-Wipe&Clean/RwcRun.exe
unpack001/R-Wipe&Clean/RwcSh32.dll
unpack001/R-Wipe&Clean/RwcSh64.dll
unpack001/R-Wipe&Clean/RwcTaskService.exe
unpack001/R-Wipe&Clean/rwiped.exe

Files

1090247d187b3325fd25472199eef0dc
.rar
R-Wipe&Clean/RPrivSvc.exe
.exe windows:4 windows x86 arch:x86

573446dfc64bf2c732e878dfa94ec898

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree

user32

SetActiveWindow
EndDialog
IsDlgButtonChecked
PostMessageA
IsIconic
SetForegroundWindow
KillTimer
GetActiveWindow
IsWindowEnabled
LoadIconA
SendDlgItemMessageA
SetTimer
EnableWindow
GetWindowRect
MessageBoxA
CreateDialogParamA
GetMessageA
PostQuitMessage
GetCursorPos
GetDlgItem
MapWindowPoints
LoadCursorA
SetCursor
GetWindowLongA
SendMessageA
IsWindow
SetWindowLongA
SystemParametersInfoA
GetParent
wvsprintfA
GetClientRect
GetWindow
DefWindowProcA
FindWindowA
SetWindowTextA
SetDlgItemTextA
IsWindowVisible
ShowWindow
SetWindowPos
UpdateWindow
PeekMessageA
TranslateMessage
DispatchMessageA
CreateWindowExA
RegisterClassA
LoadStringA
CharNextA
DestroyWindow

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetSpecialFolderPathA
Shell_NotifyIconA

shlwapi

StrRetToBufA

wininet

FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
GetUrlCacheEntryInfoA
DeleteUrlCacheEntry
CommitUrlCacheEntryA
FindCloseUrlCache

kernel32

GetModuleHandleW
GetModuleHandleA
SetLastError
lstrlenW
WideCharToMultiByte
InterlockedIncrement
GetProcAddress
MoveFileA
GetVersionExA
SetFileAttributesA
DebugBreak
GetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenA
InterlockedDecrement
GetVersion
LoadLibraryW
GetModuleFileNameW
GetFileAttributesA
FindClose
DeleteFileA
Sleep
RemoveDirectoryA
GetTickCount
FindFirstFileA
GetVolumeInformationA
GetDiskFreeSpaceA
GetDriveTypeA
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetStartupInfoA
OutputDebugStringA
GetFileAttributesW
lstrcpyA
FormatMessageA
LocalFree
VirtualAlloc
SetFilePointer
FlushFileBuffers
VirtualFree
InitializeCriticalSection
GetCommandLineA
CreateThread
WaitForSingleObject
ExitThread
GetFileSize
ReadFile
CreateDirectoryA
WriteFile
GetCurrentProcessId
CreateFileA
CloseHandle
GetCurrentProcess
FlushInstructionCache

advapi32

RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCloseKey

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime

comctl32

ord17
InitCommonControlsEx

msvcrt

memset
memcpy
??2@YAPAXI@Z
strftime
mktime
__CxxFrameHandler
_snprintf
wcslen
_ismbcdigit
atoi
_mbsrchr
memmove
_except_handler3
_mbscmp
strlen
_mbsstr
_mbsicmp
realloc
free
_mbschr
sprintf
_mbsnbicmp
_endthread
_mbsnbcpy
_mbsnbcmp
_mbslen
_beginthread
_close
_write
_filelength
_read
_open
remove
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
??3@YAXPAX@Z

Sections

.text
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
R-Wipe&Clean/RWCClean.exe
.exe windows:4 windows x86 arch:x86

1e374dde8edb204774bba6f413b3bd82

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteExA
SHChangeNotify

msvcrt

_except_handler3
__set_app_type
_controlfp
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_mbsrchr

kernel32

GetStartupInfoA
GetModuleHandleA
RemoveDirectoryA
GetModuleFileNameA
GetShortPathNameA
GetEnvironmentVariableA
lstrcpyA
lstrcatA
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
SetProcessPriorityBoost
DeleteFileA

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 902B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
R-Wipe&Clean/RWKbdD.exe
.exe windows:4 windows x86 arch:x86

b8176d815782ac67e4eca5e5c4c57b59

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TranslateMessage
GetWindowThreadProcessId
GetClassNameA
GetWindow
LoadCursorA
RegisterClassA
CreateWindowExA
SetWindowsHookExA
GetMessageA
PostMessageA
DispatchMessageA
UnhookWindowsHookEx
PostQuitMessage
DefWindowProcA
GetDesktopWindow

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

msvcrt

_adjust_fdiv
_beginthread
_controlfp
__set_app_type
__p__fmode
??3@YAXPAX@Z
memset
??2@YAPAXI@Z
sprintf
strlen
_mbsicmp
_mbscmp
_endthread
_mbsstr
__setusermatherr
_except_handler3
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__p__commode

kernel32

GetModuleHandleA
GetProcAddress
LoadLibraryA
GetVersionExA
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
GetStartupInfoA
FreeLibrary

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
R-Wipe&Clean/RWKbdH.dll
.dll windows:4 windows x86 arch:x86

830b17dfdc771b863716cdac74c88def

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

FindWindowA
PostMessageA
CallNextHookEx

msvcrt

_initterm
_adjust_fdiv
free
malloc

Exports

Exports

hpIntercepter

Sections

.text
Size: 4KB - Virtual size: 426B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 331B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 98B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R-Wipe&Clean/RWipe&Clean.chm
.chm
R-Wipe&Clean/RWipe.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CheckTime
fswLaunchTool
fswRWC_CancelAfterStart
fswRWC_SPEC3
fswRWC_Swap
rwcAbout

Sections

.text
Size: 687KB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 34KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 156KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 104KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

HTG.N
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
R-Wipe&Clean/RWipeInst.exe
.exe windows:4 windows x86 arch:x86

6210fc88e589260de4dee48eab13a973

Code Sign

01:00:00:00:00:01:11:76:56:e2:55
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

21/03/2007, 21:11

Not After

21/03/2009, 21:11

Subject

CN=R-tools technology Inc.,O=R-tools technology Inc.,C=CA,1.2.840.113549.1.9.1=#0c0f6f666669636540722d74742e636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 12:00

Not After

27/01/2014, 11:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:24:48
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 09:00

Not After

27/01/2014, 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

84:48:ac:cc:35:1c:05:42:a6:15:16:37:76:1f:11:c6:34:99:2a:be
Signer

Actual PE Digest

84:48:ac:cc:35:1c:05:42:a6:15:16:37:76:1f:11:c6:34:99:2a:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryA
InterlockedDecrement
DebugBreak
OutputDebugStringA
DeleteFileA
MoveFileA
CopyFileA
MoveFileExA
GetFileAttributesA
GetShortPathNameA
Sleep
lstrlenA
InterlockedIncrement
WaitForSingleObject
FindFirstFileA
FindClose
LoadLibraryA
GetProcAddress
FreeLibrary
CreateToolhelp32Snapshot
Process32First
Process32Next
GetVersionExA
GetModuleFileNameA
CreateProcessA
GetModuleHandleA
CloseHandle
GetStartupInfoA

gdi32

SelectObject
GetObjectA
CreateFontIndirectA
SetBkColor
SetTextColor
DeleteObject

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA

user32

MessageBoxA
KillTimer
DefWindowProcA
CallWindowProcA
GetWindowLongA
EndDialog
PostMessageA
DialogBoxParamA
ExitWindowsEx
wvsprintfA
CharNextA
LoadStringA
SendMessageA
SetDlgItemTextA
SetWindowTextA
GetDlgItem
ScreenToClient
SetWindowPos
SetWindowLongA
SystemParametersInfoA
GetCursor
LoadCursorA
SetTimer
GetCursorPos
GetWindowRect
DestroyCursor
SetCursor
InvalidateRect
BeginPaint
GetClientRect
GetWindowTextLengthA
GetWindowTextA
GetSysColor
GetSysColorBrush
FillRect
DrawTextA
EndPaint
FindWindowA
PtInRect

advapi32

RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
DeleteService
CloseServiceHandle
ControlService
OpenServiceA
OpenSCManagerA
StartServiceA
RegCreateKeyA
RegCloseKey

ole32

CoTaskMemFree

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_except_handler3
_ismbcdigit
wcslen
_mbsstr
memcpy
_snprintf
_mbslen
_mbsicmp
??2@YAPAXI@Z
atoi
memset
??3@YAXPAX@Z
__CxxFrameHandler
_mbsrchr
sprintf
strlen

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
R-Wipe&Clean/RWipeRun.exe
.exe windows:4 windows x86 arch:x86

485912bd0faae737e8b961018440bde8

Code Sign

01:00:00:00:00:01:11:76:56:e2:55
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

21/03/2007, 21:11

Not After

21/03/2009, 21:11

Subject

CN=R-tools technology Inc.,O=R-tools technology Inc.,C=CA,1.2.840.113549.1.9.1=#0c0f6f666669636540722d74742e636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 12:00

Not After

27/01/2014, 11:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:24:48
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 09:00

Not After

27/01/2014, 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:a1:4d:6f:f4:42:34:95:3e:80:56:ed:38:b1:46:13:98:d8:f2:1c
Signer

Actual PE Digest

05:a1:4d:6f:f4:42:34:95:3e:80:56:ed:38:b1:46:13:98:d8:f2:1c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WaitForSingleObject
CreateProcessA
FormatMessageA
GetLastError
LoadLibraryA
GetVersionExA
LocalFree
GetModuleHandleA
GetProcAddress
GetCommandLineA
GetStartupInfoA

user32

ShowWindow
IsWindowVisible
SendMessageA
FindWindowA
GetDesktopWindow
MessageBoxA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA

msvcrt

_controlfp
_except_handler3
__set_app_type
memset
_snprintf
strlen
_beginthread
__CxxFrameHandler
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
R-Wipe&Clean/RWipeSrv.exe
.exe windows:4 windows x86 arch:x86

ac63cd48cc17aff718cf6566eb6ffe5a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
CloseServiceHandle
DeleteService
OpenServiceA
OpenSCManagerA

msvcrt

_initterm
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??2@YAPAXI@Z
memset
__CxxFrameHandler
strcpy
??3@YAXPAX@Z
strlen
sprintf
_mbscmp
_mbschr
_mbsstr
rename
__setusermatherr

kernel32

GetStartupInfoA
GetModuleHandleA
CreateFileA
GetLocalTime
GetDateFormatA
GetTimeFormatA
GetFileSize
SetFilePointer
WriteFile
CloseHandle
GetVersionExA
FindFirstFileA
FindNextFileA
GetFileAttributesA
SetFileAttributesA
FindClose

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
R-Wipe&Clean/RwcLkRen.exe
.sys windows:5 windows x86 arch:x86

25eca153f88c90133c2e4cf2222dbdba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

wcslen
NtClose
NtSetInformationFile
NtCreateFile
RtlFreeHeap
RtlAllocateHeap
ZwWriteFile
ZwQueryInformationFile
swprintf
_alldiv
_allmul
wcsncpy
wcsstr
NtTerminateProcess
wcscpy
wcschr
NtReadFile
RtlCreateHeap
NtCurrentTeb
NtQueryVolumeInformationFile
NtOpenFile

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R-Wipe&Clean/RwcNtSrv.exe
.exe windows:4 windows x86 arch:x86

01bb941f72bc4c574d11329fd96164e6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime
GetDateFormatA
GetTimeFormatA
GetFileSize
SetFilePointer
WriteFile
CloseHandle
GetVersionExA
FindFirstFileA
FindNextFileA
GetFileAttributesA
SetFileAttributesA
CreateFileA
FindClose
GetStartupInfoA
GetModuleHandleA

advapi32

OpenServiceA
DeleteService
CloseServiceHandle
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA

msvcrt

_mbschr
_mbscmp
sprintf
strlen
??3@YAXPAX@Z
strcpy
__CxxFrameHandler
memset
??2@YAPAXI@Z
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_mbsstr
rename

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
R-Wipe&Clean/RwcPub32.dll
.dll regsvr32 windows:4 windows x86 arch:x86

b836b3873fd187b43fe73f1b25d5b4c2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shell32

SHGetSpecialFolderPathA

gdi32

CreateFontA
SetBkMode
DeleteObject
SetTextColor

winmm

PlaySoundA

shlwapi

SHAutoComplete

kernel32

lstrlenA
SetFilePointer
SetEndOfFile
WriteFile
MapViewOfFileEx
CreateFileMappingA
GetFileSize
GetLastError
OpenFileMappingA
UnmapViewOfFile
InterlockedDecrement
SetLastError
DisableThreadLibraryCalls
GetModuleFileNameA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
HeapDestroy
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleHandleA
CreateFileA
GetFileAttributesW
GetVersion
OutputDebugStringA
LoadLibraryW
CloseHandle
lstrcpyA
lstrcatA
GetShortPathNameA
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
CreateMutexA
FindClose
FindFirstFileA
Beep
ReleaseMutex
SystemTimeToFileTime
GetLocalTime
WaitForSingleObject
Sleep
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
lstrcmpA
DuplicateHandle
MultiByteToWideChar
FlushInstructionCache
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
GetVersionExA
lstrlenW
GetModuleFileNameW
WideCharToMultiByte
GetModuleHandleW
GetCurrentProcess

user32

LoadIconA
CharUpperA
CharLowerA
CharNextA
LoadStringA
MessageBeep
SetFocus
GetWindowLongA
GetParent
GetWindow
GetWindowRect
SystemParametersInfoA
GetClientRect
MapWindowPoints
SetWindowPos
IsWindow
IsWindowEnabled
GetSysColor
InvalidateRect
UpdateWindow
EndDialog
GetWindowTextLengthA
GetWindowTextA
IsDlgButtonChecked
SetWindowTextA
SendDlgItemMessageA
GetSystemMetrics
GetComboBoxInfo
DestroyIcon
SetDlgItemTextA
ShowWindow
GetDlgItem
EnableWindow
LoadMenuA
GetSubMenu
SetMenuItemInfoA
InsertMenuA
SetWindowLongA
TrackPopupMenu
DestroyMenu
SendMessageA
CheckMenuItem
CallWindowProcA
PeekMessageA
DispatchMessageA
DialogBoxParamA
GetActiveWindow
MessageBoxA

advapi32

RegCloseKey
RegSetValueExA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
RegEnumValueA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegDeleteKeyA

ole32

CoTaskMemRealloc
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
VarUI4FromStr
SysStringLen
LoadRegTypeLi
RegisterTypeLi
SafeArrayDestroy
SafeArrayUnlock
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayCopy
SafeArrayRedim
SafeArrayCreate
SysAllocStringLen
SysAllocString
LoadTypeLi
SysFreeString

msvcrt

_endthread
_mbscmp
atol
_mbscspn
_mbsspn
_mbsicmp
_mbsnbcpy
_snprintf
_mbsrchr
_wcsnicmp
strcpy
memmove
realloc
malloc
free
_mbsstr
_except_handler3
memcmp
_wcsicmp
_purecall
sprintf
memset
_mbschr
atoi
??2@YAPAXI@Z
memcpy
strlen
__CxxFrameHandler
wcscmp
??3@YAXPAX@Z
wcslen
_ismbcspace
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
_beginthread

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R-Wipe&Clean/RwcPub64.dll
.dll regsvr32 windows:4 windows x64 arch:x64

f4c7d2d2fd67d4c2855ce9984f994255

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

winmm

PlaySoundA

shlwapi

SHAutoComplete

kernel32

RaiseException
EnterCriticalSection
LeaveCriticalSection
__C_specific_handler
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiA
CreateMutexA
DisableThreadLibraryCalls
GetModuleFileNameA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
DuplicateHandle
GetCurrentProcess
FlushInstructionCache
GetProcAddress
Beep
GetModuleHandleW
ReleaseMutex
SystemTimeToFileTime
GetLocalTime
WaitForSingleObject
Sleep
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileA
lstrcpyA
GetCurrentProcessId
LoadLibraryA
lstrcmpA
SetLastError
GetVersionExA
lstrcpynA
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedPushEntrySList
HeapFree
HeapAlloc
GetProcessHeap
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
GetSystemTimeAsFileTime
QueryPerformanceCounter
lstrlenA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
lstrlenW
SetHandleCount
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
HeapSize
RtlVirtualUnwind
FlsAlloc
TlsSetValue
FlsFree
TlsFree
FlsGetValue
HeapDestroy
HeapCreate
HeapSetInformation
GetStdHandle
ExitProcess
GetCommandLineA
FlsSetValue
CreateThread
ResumeThread
ExitThread
RtlCaptureContext
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualProtect
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
UnmapViewOfFile
OpenFileMappingA
GetFileSize
CreateFileMappingA
MapViewOfFileEx
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
GetLastError
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleCP
GetConsoleMode
WriteFile
SetEndOfFile
SetFilePointer
GetFileType
CreateFileA
GetEnvironmentStringsW

user32

GetSystemMetrics
LoadIconA
DestroyIcon
GetComboBoxInfo
IsWindow
GetSysColor
MessageBeep
SetFocus
EndDialog
InvalidateRect
UnregisterClassA
ShowWindow
EnableWindow
GetParent
GetWindow
GetWindowRect
SystemParametersInfoA
GetClientRect
MapWindowPoints
SetWindowPos
GetDlgItem
SetDlgItemTextA
SendDlgItemMessageA
IsDlgButtonChecked
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetWindowLongA
GetActiveWindow
DialogBoxParamA
LoadMenuA
GetSubMenu
SetMenuItemInfoA
InsertMenuA
SetWindowLongPtrA
TrackPopupMenu
DestroyMenu
SendMessageA
PeekMessageA
DispatchMessageA
CheckMenuItem
CallWindowProcA
CharLowerA
LoadStringA
MessageBoxA
CharNextA
CharUpperBuffA
UpdateWindow
IsWindowEnabled

advapi32

RegQueryInfoKeyA
RegDeleteValueA
RegCloseKey
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA

ole32

CoInitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoUninitialize

shell32

SHGetSpecialFolderPathA

oleaut32

LoadRegTypeLi
VariantInit
VariantClear
SafeArrayUnlock
SafeArrayDestroy
SafeArrayGetVartype
SysAllocStringLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayLock
SafeArrayCreate
SysStringByteLen
SafeArrayRedim
SafeArrayCopy
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocStringByteLen
SysAllocString
VarBstrCmp
SysStringLen
SysFreeString

comctl32

ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon

gdi32

SetTextColor
DeleteObject
CreateFontA
SetBkMode

comdlg32

GetSaveFileNameA
GetOpenFileNameA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SHARED
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R-Wipe&Clean/RwcRun.exe
.exe windows:4 windows x86 arch:x86

515591421548c67d40072def7415734a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetProcAddress
GetModuleHandleA
LocalFree
FormatMessageA
GetCommandLineA
GetLastError
LoadLibraryA
GetStartupInfoA

user32

GetDesktopWindow
FindWindowA
SendMessageA
IsWindowVisible
ShowWindow
MessageBoxA

msvcrt

_acmdln
_controlfp
_except_handler3
memset
strlen
__set_app_type
__CxxFrameHandler
_exit
_XcptFilter
exit
_beginthread
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
R-Wipe&Clean/RwcSh32.dll
.dll regsvr32 windows:4 windows x86 arch:x86

031db354639e10c3df584148b40dfd54

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdi32

SetBkColor
SetTextColor
CreateFontIndirectA
GetStockObject
GetObjectA
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetDeviceCaps

shell32

SHChangeNotify
ShellExecuteA
Shell_NotifyIconA
SHGetMalloc
SHGetDesktopFolder
SHEmptyRecycleBinA
ShellExecuteExW
DragQueryFileA
SHGetSpecialFolderLocation
SHGetPathFromIDListA

shlwapi

StrRetToBufA

kernel32

GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
DebugBreak
FlushInstructionCache
GetCurrentProcess
FreeResource
GlobalFree
GlobalHandle
LockResource
LoadResource
FindResourceA
GlobalAlloc
lstrlenW
MultiByteToWideChar
GlobalUnlock
GlobalLock
lstrcmpA
GetLogicalDrives
GetLogicalDriveStringsA
GetVersionExA
SetCurrentDirectoryA
CloseHandle
WaitForSingleObject
CreateThread
GetTickCount
MoveFileA
WideCharToMultiByte
GetFileAttributesA
RemoveDirectoryA
FindClose
DeleteFileA
FindNextFileA
FindFirstFileA
GetVolumeInformationA
GetDriveTypeA
Sleep
SetFileAttributesA
GetDiskFreeSpaceA
DisableThreadLibraryCalls
lstrcpyA
SetFileTime
GetLastError
GetSystemTime
CreateFileA
GetFileTime
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
FreeLibrary
LoadLibraryA
lstrcatA
GetShortPathNameA
SizeofResource
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
IsBadWritePtr
CreateProcessA
WriteFile
SetFilePointer
ExitThread
CreateDirectoryA
ReadFile
GetFileSize
GetWindowsDirectoryA
GetCurrentProcessId
GetDateFormatA
WritePrivateProfileStringA
GetPrivateProfileIntA
FileTimeToSystemTime
VirtualFree
FlushFileBuffers
VirtualAlloc
LocalFree
FormatMessageA
GetTimeFormatA
GetLocalTime
GetModuleFileNameA
lstrlenA
SetLastError
SystemTimeToFileTime

user32

DispatchMessageA
TranslateMessage
PeekMessageA
DeleteMenu
GetSystemMenu
RegisterClassA
FindWindowA
CreateDialogIndirectParamA
PostMessageA
LoadBitmapA
SetMenuItemBitmaps
InsertMenuA
IsWindowEnabled
IsIconic
LoadIconA
PostQuitMessage
SetActiveWindow
GetMessageA
CreateDialogParamA
SetForegroundWindow
UpdateWindow
wsprintfA
CreateWindowExA
DestroyWindow
CreateAcceleratorTableA
GetDesktopWindow
GetClassNameA
RedrawWindow
IsWindow
BeginPaint
FillRect
EndPaint
GetDC
ReleaseDC
GetFocus
IsChild
SetFocus
GetSysColor
DefWindowProcA
GetClassInfoExA
CallWindowProcA
MessageBeep
GetCursor
SetTimer
GetCursorPos
PtInRect
SetCursor
GetSysColorBrush
DrawTextA
KillTimer
DestroyCursor
GetActiveWindow
IsDlgButtonChecked
EnableWindow
CheckDlgButton
IsWindowVisible
SendDlgItemMessageA
ScreenToClient
CharUpperA
MessageBoxA
EndDialog
SendMessageA
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
ShowWindow
GetDlgItem
RegisterClassExA
RegisterWindowMessageA
LoadCursorA
DialogBoxIndirectParamA
GetWindowLongA
GetParent
GetWindow
GetWindowRect
SystemParametersInfoA
GetClientRect
MapWindowPoints
SetWindowPos
LoadStringA
CharNextA
wvsprintfA
SetWindowLongA
DialogBoxParamA
GetWindowTextLengthA
GetWindowTextA
CharLowerA
SetDlgItemTextA
SetWindowTextA

olepro32

ord253

advapi32

RegCloseKey
RegGetKeySecurity
RegCreateKeyA
RegQueryValueA
RegOpenKeyA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA

ole32

ReleaseStgMedium
CoTaskMemRealloc
StringFromGUID2
OleLockRunning
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleInitialize
CreateStreamOnHGlobal
OleUninitialize

oleaut32

VariantClear
SysAllocStringLen
VarUI4FromStr
RegisterTypeLi
LoadTypeLi
SysFreeString
SysStringLen
LoadRegTypeLi
SysAllocString

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

msvcrt

strlen
_mbsrchr
_mbsicmp
realloc
free
_mbscmp
memcmp
memmove
atoi
_ismbcdigit
wcslen
_mbsstr
memcpy
_except_handler3
__CxxFrameHandler
??2@YAPAXI@Z
memset
sprintf
??3@YAXPAX@Z
malloc
strcpy
_mbschr
_mbclen
_ftol
_mbsnbcpy
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
_purecall

Exports

Exports

CheckTime
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 236KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R-Wipe&Clean/RwcSh64.dll
.dll regsvr32 windows:4 windows x64 arch:x64

031deff779666606ba76349dfeb21c15

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

gdi32

GetStockObject
CreateSolidBrush
BitBlt
CreateCompatibleDC
SetTextColor
SelectObject
DeleteObject
DeleteDC
GetDeviceCaps
GetObjectA
SetBkColor
CreateCompatibleBitmap
CreateFontIndirectA

shlwapi

StrRetToBufA

kernel32

GetModuleFileNameW
__C_specific_handler
GetModuleFileNameA
GetCurrentThreadId
lstrlenW
lstrcmpA
MulDiv
WideCharToMultiByte
GlobalUnlock
GlobalLock
GlobalFree
GlobalHandle
LockResource
LoadResource
GetVersionExA
GetLogicalDriveStringsA
GetLogicalDrives
SetCurrentDirectoryA
CloseHandle
WaitForSingleObject
CreateThread
GetTickCount
GetDiskFreeSpaceA
GetVolumeInformationA
GetDriveTypeA
MoveFileA
FindClose
FindNextFileA
DeleteFileA
Sleep
RemoveDirectoryA
FindFirstFileA
SetFileAttributesA
GetFileAttributesA
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiA
DisableThreadLibraryCalls
lstrcpyA
SetFileTime
SystemTimeToFileTime
GetSystemTime
CreateFileA
GetFileTime
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadLibraryExA
IsBadWritePtr
CreateProcessA
WriteFile
SetFilePointer
ExitThread
CreateDirectoryA
ReadFile
GetFileSize
GetWindowsDirectoryA
GetCurrentProcessId
GetDateFormatA
GetPrivateProfileIntA
SetLastError
FileTimeToSystemTime
LocalFree
FormatMessageA
VirtualFree
FlushFileBuffers
VirtualAlloc
GetTimeFormatA
GetLocalTime
LoadLibraryA
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedPushEntrySList
HeapFree
HeapAlloc
GetProcessHeap
InterlockedPopEntrySList
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
HeapSize
RtlVirtualUnwind
GetStringTypeW
GetStringTypeA
GetStdHandle
ExitProcess
RtlCaptureContext
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
FlsAlloc
TlsSetValue
FlsFree
TlsFree
FlsGetValue
IsValidCodePage
GetOEMCP
GetCPInfo
HeapDestroy
HeapCreate
HeapSetInformation
GetCommandLineA
FlsSetValue
GetSystemTimeAsFileTime
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualProtect
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
GetLastError
LoadLibraryW
OutputDebugStringA
DebugBreak
lstrlenA
FindResourceA
GlobalAlloc
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
RaiseException
MultiByteToWideChar
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
WriteConsoleW
WritePrivateProfileStringA

user32

DestroyCursor
KillTimer
SetTimer
EnableWindow
IsDlgButtonChecked
CheckDlgButton
IsWindowVisible
DrawTextA
GetSysColorBrush
SetCursor
GetWindowLongA
SetWindowTextA
SetDlgItemTextA
GetDlgItem
SetWindowPos
MapWindowPoints
GetClientRect
SystemParametersInfoA
GetWindowRect
GetWindow
GetParent
PtInRect
GetCursorPos
GetCursor
GetActiveWindow
UpdateWindow
MessageBeep
SetForegroundWindow
PeekMessageA
DispatchMessageA
UnregisterClassA
LoadIconA
CreateDialogParamA
GetMessageA
PostQuitMessage
IsIconic
IsWindowEnabled
InsertMenuA
SetMenuItemBitmaps
PostMessageA
LoadBitmapA
TranslateMessage
GetSystemMenu
DeleteMenu
FindWindowA
CreateDialogIndirectParamA
RegisterClassA
SetActiveWindow
SendDlgItemMessageA
CharUpperA
RegisterWindowMessageA
LoadStringA
CharLowerA
wvsprintfA
CharNextA
CreateAcceleratorTableA
LoadCursorA
IsWindow
SetFocus
GetFocus
DestroyAcceleratorTable
BeginPaint
EndPaint
GetWindowLongPtrA
CallWindowProcA
FillRect
ReleaseCapture
GetClassNameA
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
MoveWindow
SetWindowLongA
CreateWindowExA
DestroyWindow
MapDialogRect
SetWindowContextHelpId
MessageBoxA
EndDialog
GetSysColor
DefWindowProcA
GetWindowTextLengthA
GetWindowTextA
ShowWindow
DialogBoxIndirectParamA
DialogBoxParamA
GetClassInfoExA
RegisterClassExA
SetWindowLongPtrA
SendMessageA
GetDesktopWindow

advapi32

RegCloseKey
RegGetKeySecurity
RegCreateKeyA
RegQueryValueA
RegOpenKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA

ole32

ReleaseStgMedium
CoTaskMemFree
CoTaskMemRealloc
OleUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CoTaskMemAlloc
OleLockRunning
StringFromGUID2
OleInitialize

shell32

Shell_NotifyIconA
SHGetMalloc
SHGetDesktopFolder
ShellExecuteExW
SHEmptyRecycleBinA
DragQueryFileA
SHChangeNotify
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteA

oleaut32

LoadTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VariantClear
VariantInit
SysStringByteLen
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen

comctl32

CreatePropertySheetPageA
DestroyPropertySheetPage

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Exports

Exports

CheckTime
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
R-Wipe&Clean/RwcTaskService.exe
.exe windows:4 windows x86 arch:x86

e7d71eb383c7161badb03dc8e1f78b15

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteValueA
RegEnumKeyExA
CloseEventLog
ReadEventLogA
OpenEventLogA
ClearEventLogA
CloseServiceHandle
DeleteService
RegCreateKeyExA
OpenServiceA
CreateServiceA
OpenSCManagerA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA

shell32

SHGetSpecialFolderPathA

shlwapi

SHDeleteKeyA

kernel32

GetStartupInfoA
VirtualAlloc
FlushFileBuffers
GetLastError
MoveFileA
InterlockedDecrement
InterlockedIncrement
lstrlenA
GetTickCount
GetVolumeInformationA
GetDriveTypeA
GetDiskFreeSpaceA
DebugBreak
OutputDebugStringA
MoveFileExA
CreateDirectoryA
CopyFileA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
SetFileAttributesA
GetFileAttributesA
MultiByteToWideChar
CloseHandle
WriteFile
SetFilePointer
GetFileSize
CreateFileA
WideCharToMultiByte
lstrlenW
SetLastError
FindClose
FindNextFileA
FindFirstFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
GetCurrentProcessId
GetPrivateProfileStringA
GetWindowsDirectoryA
GetVersionExA
DeleteFileA
ReadFile
Sleep
RemoveDirectoryA
InitializeCriticalSection
VirtualFree

user32

LoadStringA
GetCursorPos
CharNextA
wvsprintfA

msvcrt

_mbslen
_filelength
_write
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
free
_mbsrchr
??3@YAXPAX@Z
__CxxFrameHandler
memmove
??2@YAPAXI@Z
wcslen
_ismbcdigit
atoi
sprintf
_snprintf
wcsstr
_open
wcschr
_snwprintf
atol
realloc
_mbsicmp
_mbsstr
_mbschr
_mbscmp
_wcsnicmp
_mbsnbicmp
_mbsnbcpy
wcscpy
swprintf
_chsize
wcsncpy
_close
_read
_beginthread
__dllonexit
_onexit
_except_handler3
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
R-Wipe&Clean/Rwcswred.exe
R-Wipe&Clean/_rwipeinst.exe
.exe windows:4 windows x86 arch:x86

6210fc88e589260de4dee48eab13a973

Code Sign

01:00:00:00:00:01:11:76:56:e2:55
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

21/03/2007, 21:11

Not After

21/03/2009, 21:11

Subject

CN=R-tools technology Inc.,O=R-tools technology Inc.,C=CA,1.2.840.113549.1.9.1=#0c0f6f666669636540722d74742e636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 12:00

Not After

27/01/2014, 11:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:24:48
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 09:00

Not After

27/01/2014, 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

84:48:ac:cc:35:1c:05:42:a6:15:16:37:76:1f:11:c6:34:99:2a:be
Signer

Actual PE Digest

84:48:ac:cc:35:1c:05:42:a6:15:16:37:76:1f:11:c6:34:99:2a:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryA
InterlockedDecrement
DebugBreak
OutputDebugStringA
DeleteFileA
MoveFileA
CopyFileA
MoveFileExA
GetFileAttributesA
GetShortPathNameA
Sleep
lstrlenA
InterlockedIncrement
WaitForSingleObject
FindFirstFileA
FindClose
LoadLibraryA
GetProcAddress
FreeLibrary
CreateToolhelp32Snapshot
Process32First
Process32Next
GetVersionExA
GetModuleFileNameA
CreateProcessA
GetModuleHandleA
CloseHandle
GetStartupInfoA

gdi32

SelectObject
GetObjectA
CreateFontIndirectA
SetBkColor
SetTextColor
DeleteObject

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA

user32

MessageBoxA
KillTimer
DefWindowProcA
CallWindowProcA
GetWindowLongA
EndDialog
PostMessageA
DialogBoxParamA
ExitWindowsEx
wvsprintfA
CharNextA
LoadStringA
SendMessageA
SetDlgItemTextA
SetWindowTextA
GetDlgItem
ScreenToClient
SetWindowPos
SetWindowLongA
SystemParametersInfoA
GetCursor
LoadCursorA
SetTimer
GetCursorPos
GetWindowRect
DestroyCursor
SetCursor
InvalidateRect
BeginPaint
GetClientRect
GetWindowTextLengthA
GetWindowTextA
GetSysColor
GetSysColorBrush
FillRect
DrawTextA
EndPaint
FindWindowA
PtInRect

advapi32

RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
DeleteService
CloseServiceHandle
ControlService
OpenServiceA
OpenSCManagerA
StartServiceA
RegCreateKeyA
RegCloseKey

ole32

CoTaskMemFree

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_except_handler3
_ismbcdigit
wcslen
_mbsstr
memcpy
_snprintf
_mbslen
_mbsicmp
??2@YAPAXI@Z
atoi
memset
??3@YAXPAX@Z
__CxxFrameHandler
_mbsrchr
sprintf
strlen

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
R-Wipe&Clean/eula.txt
R-Wipe&Clean/loading.gif
.gif
R-Wipe&Clean/rwiped.exe
.exe windows:4 windows x86 arch:x86

503b4883663cf590148f7c54c9ab7abd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
strlen
_acmdln
exit
_XcptFilter
_exit
_except_handler3
memcpy
sprintf
??2@YAPAXI@Z
memset
??3@YAXPAX@Z
_beginthread
__CxxFrameHandler
_endthread
_mbsicmp

kernel32

GetStartupInfoA
SystemTimeToFileTime
FileTimeToSystemTime
GetModuleHandleA
GetVersionExA
GetCurrentProcess
GetLocalTime
CreateProcessA
LoadLibraryA
GetLastError
GetProcAddress
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle

user32

GetMessageA
SetTimer
CreateWindowExA
RegisterClassExA
KillTimer
FindWindowA
DispatchMessageA
PostQuitMessage
ExitWindowsEx
WaitForInputIdle
IsWindowVisible
IsIconic
GetDesktopWindow
GetWindow
GetClassNameA
GetWindowThreadProcessId
SendMessageA
DefWindowProcA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegCreateKeyA

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
R-Wipe&Clean/飞速绿色下载.url
.url

Sharing

General

Malware Config

Signatures

Files

573446dfc64bf2c732e878dfa94ec898

Headers

File Characteristics

Imports

ole32

user32

shell32

shlwapi

wininet

kernel32

advapi32

oleaut32

comctl32

msvcrt

Sections

.text Size: 48KB - Virtual size: 45KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 198KB

.rsrc Size: 20KB - Virtual size: 18KB

1e374dde8edb204774bba6f413b3bd82

Headers

File Characteristics

Imports

shell32

msvcrt

kernel32

Sections

.text Size: 4KB - Virtual size: 1KB

.rdata Size: 4KB - Virtual size: 902B

.data Size: 4KB - Virtual size: 92B

b8176d815782ac67e4eca5e5c4c57b59

Headers

File Characteristics

Imports

user32

advapi32

version

msvcrt

kernel32

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 4KB - Virtual size: 868B

830b17dfdc771b863716cdac74c88def

Headers

File Characteristics

Imports

user32

msvcrt

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 426B

.rdata Size: 4KB - Virtual size: 331B

.data Size: 4KB - Virtual size: 56B

.reloc Size: 4KB - Virtual size: 98B

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 687KB - Virtual size: 3.1MB

.rdata Size: 220KB - Virtual size: 220KB

.data Size: 34KB - Virtual size: 360KB

.rsrc Size: 156KB - Virtual size: 1.3MB

.reloc Size: 104KB - Virtual size: 192KB

HTG.N Size: 6KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

6210fc88e589260de4dee48eab13a973

Code Sign

01:00:00:00:00:01:11:76:56:e2:55Certificate

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

.text
Size: 48KB - Virtual size: 45KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 198KB

.rsrc
Size: 20KB - Virtual size: 18KB

.text
Size: 4KB - Virtual size: 1KB

.rdata
Size: 4KB - Virtual size: 902B

.data
Size: 4KB - Virtual size: 92B

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 868B

.text
Size: 4KB - Virtual size: 426B

.rdata
Size: 4KB - Virtual size: 331B

.data
Size: 4KB - Virtual size: 56B

.reloc
Size: 4KB - Virtual size: 98B

.text
Size: 687KB - Virtual size: 3.1MB

.rdata
Size: 220KB - Virtual size: 220KB

.data
Size: 34KB - Virtual size: 360KB

.rsrc
Size: 156KB - Virtual size: 1.3MB

.reloc
Size: 104KB - Virtual size: 192KB

HTG.N
Size: 6KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB

01:00:00:00:00:01:11:76:56:e2:55
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

04:00:00:00:00:01:08:d9:61:24:48
Certificate

84:48:ac:cc:35:1c:05:42:a6:15:16:37:76:1f:11:c6:34:99:2a:be
Signer

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 12KB - Virtual size: 9KB

01:00:00:00:00:01:11:76:56:e2:55
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

04:00:00:00:00:01:08:d9:61:24:48
Certificate

05:a1:4d:6f:f4:42:34:95:3e:80:56:ed:38:b1:46:13:98:d8:f2:1c
Signer

.text
Size: 4KB - Virtual size: 2KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 1008B

.rsrc
Size: 32KB - Virtual size: 28KB

.text
Size: 8KB - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 1KB

.text
Size: 4KB - Virtual size: 3KB

.data
Size: - Virtual size: 4B