muestra[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

muestra.zip
Size

17.8MB
MD5

50d4da528bebcd1d4cb569ac195f14ec
SHA1

8651432daab41ccf6a77768344cb7bc302ff8bac
SHA256

ed733bb9814413410ae20059e1ccdab65553dccdcd0fd9edfde327f326ee4c1e
SHA512

7da34447d6445a32d0cc4389c834dbe3edac5d57b0732b5896ff0bf0d5a91307ffada57e95b034cb56f98fe35146c9413a3c9585699a0b6e98f8d97d1e2ff0cf
SSDEEP

393216:R37gmTRJbcRs9JShyAEoObfH5jofkn2awD+uZqoatRBRU:V7gmTR8egh9ClofCY+GqoMRU

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SEDAGRO yvl/FLTLIB.DLL
unpack001/SEDAGRO yvl/libeay32.dll
unpack001/SEDAGRO yvl/ssleay32.dll
unpack001/SEDAGRO yvl/wersvc.dll
unpack001/SEDAGRO yvl/werui.dll
unpack001/SEDAGRO yvl/wevtfwd.dll
unpack001/SEDAGRO yvl/wevtsvc.dll

Files

muestra.zip
.zip

Password: infected
SEDAGRO yvl/Cursors/aero_link_il.cur
SEDAGRO yvl/Cursors/aero_link_im.cur
SEDAGRO yvl/Cursors/aero_move_xl.cur
SEDAGRO yvl/Cursors/aero_nesw.cur
SEDAGRO yvl/Cursors/aero_nesw_l.cur
SEDAGRO yvl/Cursors/aero_ns.cur
SEDAGRO yvl/FLTLIB.DLL
.dll windows:5 windows x86 arch:x86

Password: infected

a537db9e3ac79e5e57fd21566451cb10

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
GetErrorInfo
VariantInit
SysFreeString

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
InitializeSecurityDescriptor
AdjustTokenPrivileges

user32

CharNextW
LoadStringW
SetClassLongW
GetClassLongW
SetWindowLongW
GetWindowLongW
CreateWindowExW
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCaret
SetWindowRgn
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetCapture
SetActiveWindow
SendMessageA
SendMessageW
ScrollWindow
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OpenClipboard
NotifyWinEvent
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageA
IsDialogMessageW
IsClipboardFormatAvailable
IsChild
InvalidateRect
InsertMenuItemW
InsertMenuW
HideCaret
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetScrollBarInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageExtraInfo
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgCtrlID
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameW
GetClassInfoExW
GetClassInfoW
GetCapture
GetAsyncKeyState
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
EnumWindows
EnumThreadWindows
EnumClipboardFormats
EnumChildWindows
EndPaint
EndMenu
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextExW
DrawTextW
DrawStateW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
CreateAcceleratorTableW
CopyImage
CopyIcon
CloseClipboard
ClientToScreen
ChildWindowFromPoint
CheckMenuItem
CharUpperBuffW
CharUpperW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BeginPaint
AdjustWindowRectEx
ActivateKeyboardLayout
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow

kernel32

Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
lstrcmpW
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
VerSetConditionMask
VerifyVersionInfoW
UnmapViewOfFile
TryEnterCriticalSection
SwitchToThread
SuspendThread
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetLastError
SetFilePointer
SetFileAttributesW
SetEvent
SetErrorMode
SetEndOfFile
SetDllDirectoryW
ResumeThread
ResetEvent
RemoveDirectoryW
ReleaseMutex
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
QueryDosDeviceW
PeekNamedPipe
IsDebuggerPresent
OpenMutexW
OpenFileMappingW
OpenEventW
MultiByteToWideChar
MulDiv
MapViewOfFile
LockResource
LocalFree
LoadResource
LoadLibraryW
LeaveCriticalSection
LCMapStringW
IsValidLocale
IsBadReadPtr
InitializeCriticalSection
HeapSize
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GlobalUnlock
GlobalSize
GlobalHandle
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetWindowsDirectoryW
GetVolumeInformationW
GetVersionExW
GetVersion
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetTempPathW
GetSystemInfo
GetStdHandle
GetProcessHeap
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLogicalDrives
GetLogicalDriveStringsW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetExitCodeThread
GetEnvironmentVariableW
GetDriveTypeW
GetDllDirectoryW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCPInfoExW
GetCPInfo
GetACP
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumSystemLocalesW
EnumResourceNamesW
EnumCalendarInfoW
EnterCriticalSection
DisconnectNamedPipe
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreateNamedPipeW
CreateMutexW
CreateFileMappingW
CreateFileW
CreateEventW
CreateDirectoryW
CopyFileW
ConnectNamedPipe
CompareStringA
CompareStringW
CloseHandle
Sleep

gdi32

UnrealizeObject
StretchDIBits
StretchBlt
StartPage
StartDocW
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetRectRgn
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBits
SetDIBColorTable
SetDCPenColor
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SelectClipRgn
SaveDC
RoundRect
RestoreDC
ResizePalette
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyBezierTo
PolyBezier
PlayEnhMetaFile
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectW
GetNearestPaletteIndex
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
FrameRgn
ExtTextOutW
ExtFloodFill
ExcludeClipRect
EnumFontsW
EnumFontFamiliesExW
EndPage
EndDoc
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateICW
CreateHalftonePalette
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
Chord
BitBlt
ArcTo
Arc
AngleArc
AbortDoc

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

olepro32

OleLoadPicture

ole32

CreateStreamOnHGlobal
OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize
IsEqualGUID

comctl32

InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Copy
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_SetOverlayImage
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControls

shell32

Shell_NotifyIconW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

msvcrt

memset
memcpy

winspool.drv

OpenPrinterW
EnumPrintersW
DocumentPropertiesW
ClosePrinter
GetDefaultPrinterW

winmm

timeGetTime
sndPlaySoundW

gdiplus

GdipGetPenFillType
GdipGetImageGraphicsContext
GdipGetImageThumbnail
GdipGetImagePixelFormat
GdipSetLinePresetBlend
GdipSetLineGammaCorrection
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesNoOp
GdipSetImageAttributesGamma
GdipSetImageAttributesThreshold
GdipSetImageAttributesColorMatrix
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipDisposeImageAttributes
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipGetMatrixElements
GdipVectorTransformMatrixPointsI
GdipVectorTransformMatrixPoints
GdipTransformMatrixPointsI
GdipTransformMatrixPoints
GdipInvertMatrix
GdipShearMatrix
GdipRotateMatrix
GdipScaleMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipSetMatrixElements
GdipDeleteMatrix
GdipCloneMatrix
GdipCreateMatrix3I
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetTextureImage
GdipGetTextureWrapMode
GdipSetTextureWrapMode
GdipRotateTextureTransform
GdipScaleTextureTransform
GdipTranslateTextureTransform
GdipSetWorldTransform
GdipResetTextureTransform
GdipCreateTextureIAI
GdipCreateTexture2I
GdipCreateTextureIA
GdipCreateTexture2
GdipCreateTexture
GdipAddPathRectangleI
GdipAddPathRectangle
GdipAddPathBezier
GdipResetClip
GdipAddPathCurve2I
GdipAddPathCurve
GdipAddPathCurveI
GdipAddPathPolygonI
GdipAddPathPolygon
GdipAddPathLine2I
GdipSetPenEndCap
GdipImageRotateFlip
GdipGetCompositingQuality
GdipSetCompositingQuality
GdipCombineRegionRegion
GdipCombineRegionPath
GdipDeleteRegion
GdipCreateRegionPath
GdipCreateRegionRect
GdipSetClipPath
GdipSetClipRegion
GdipSetClipRect
GdipGetStringFormatHotkeyPrefix
GdipSetStringFormatHotkeyPrefix
GdipSetPenDashStyle
GdipGetPenDashStyle
GdipGetImageHeight
GdipGetImageWidth
GdipSaveAddImage
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipSaveImageToStream
GdipSaveImageToFile
GdipFillPath
GdipFillPolygonI
GdipFillPolygon
GdipCreateLineBrushI
GdipCreateLineBrush
GdipDrawBeziers
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipDrawRectangle
GdipSetPenBrushFill
GdipGetPenBrushFill
GdipDrawImageRectRect
GdipDrawImageRect
GdipDrawImageI
GdipGetImageRawFormat
GdipGetStringFormatTrimming
GdipSetStringFormatTrimming
GdipGetStringFormatLineAlign
GdipSetStringFormatLineAlign
GdipGetStringFormatFlags
GdipSetStringFormatFlags
GdipGetStringFormatAlign
GdipSetStringFormatAlign
GdipCloneStringFormat
GdipDeleteStringFormat
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFont
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipGraphicsClear
GdipFillRectangle
GdipDrawPath
GdipGetTextRenderingHint
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipMultiplyWorldTransform
GdipResetWorldTransform
GdipSetTextRenderingHint
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipReleaseDC
GdipGetDC
GdipDeleteGraphics
GdipCreateFromHDC
GdipFlush
GdipDeletePen
GdipDrawEllipseI
GdipDrawEllipse
GdipCreatePen2
GdipCreatePen1
GdipResetPath
GdipCreateLineBrushFromRectWithAngleI
GdipCreateLineBrushFromRectWithAngle
GdipCreateLineBrushFromRectI
GdipCreateLineBrushFromRect
GdipGetHatchBackgroundColor
GdipGetHatchForegroundColor
GdipGetHatchStyle
GdipCreateSolidFill
GdipCreateHatchBrush
GdipDeleteBrush
GdipAddPathString
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathArc
GdipGetPathPoints
GdipGetPointCount
GdipAddPathLine
GdipGetPathWorldBounds
GdipClosePathFigure
GdipDeletePath
GdipGetPathTypes
GdipCreatePath2
GdipCreatePath
GdipFillEllipseI
GdipFillEllipse
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc

winhttp

WinHttpWriteData
WinHttpSetOption
WinHttpSetCredentials
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpQueryOption
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpQueryAuthSchemes
WinHttpOpenRequest
WinHttpOpen
WinHttpCrackUrl
WinHttpConnect
WinHttpCloseHandle
WinHttpAddRequestHeaders

oleacc

LresultFromObject

Exports

Exports

FilterConnectCommunicationPort
FilterSendMessage
GetFileVersionInfoA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
GetMaxToGridRect
JLI_CmdToArgs
JLI_GetStdArgc
JLI_GetStdArgs
JLI_Launch
JLI_MemAlloc
NVUnHook
Netbios
NvSmartMaxNotifyAppHWND
NvSmartMaxShutdown
NvSmartMax_OnSetWorkArea
PlaySoundW
SmartMaxLookupProcessName
TMethodImplementationIntercept
VerQueryValueA
VerQueryValueW
WNetAddConnection2A
WNetEnumResourceA
WNetEnumResourceW
WNetGetUniversalName
WNetGetUniversalNameW
WNetOpenEnumW

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 25KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 567KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 13.0MB - Virtual size: 13.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SEDAGRO yvl/borlndmm.dll
.dll windows:5 windows x86 arch:x86

Password: infected

7c8614e26af160453644266cf4f67143

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

42:17:85:f6:b6:bc:98:c1:4a:5f:0b:89:76:96:f8:a8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11/07/2013, 00:00

Not After

09/08/2016, 23:59

Subject

CN=Embarcadero Technologies Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Embarcadero Technologies Inc.,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:63:73:58:08:3e:98:9a:d2:1b:a0:90:e0:32:8d:38:e0:e0:56:5d
Signer

Actual PE Digest

6f:63:73:58:08:3e:98:9a:d2:1b:a0:90:e0:32:8d:38:e0:e0:56:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

Sleep
VirtualFree
VirtualAlloc
VirtualQuery
GetSystemInfo
GetVersion
SetThreadLocale
WideCharToMultiByte
GetACP
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetCommandLineW
FreeLibrary
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
VirtualQuery
GetVersionExW
GetStdHandle
GetProcAddress
InterlockedIncrement
InterlockedDecrement
FreeLibrary
CloseHandle
WriteFile
Sleep
VirtualFree
VirtualAlloc

user32

MessageBoxA

Exports

Exports

@Borlndmm@HeapAddRef$qqrv
@Borlndmm@HeapRelease$qqrv
@Borlndmm@SysAllocMem$qqri
@Borlndmm@SysFreeMem$qqrpv
@Borlndmm@SysGetMem$qqri
@Borlndmm@SysReallocMem$qqrpvi
@Borlndmm@SysRegisterExpectedMemoryLeak$qqrpi
@Borlndmm@SysUnregisterExpectedMemoryLeak$qqrpi
DumpBlocks
FreeMemory
GetAllocMemCount
GetAllocMemSize
GetHeapStatus
GetMemory
ReallocMemory

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 19KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 553B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SEDAGRO yvl/cwf gz.cert
SEDAGRO yvl/cwf gz.exe
.exe windows:5 windows x86 arch:x86

Password: infected

dd146b8114dfb5cdb561950bfbd20252

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

30:5b:a2:dd:88:fe:39:8d:8c:f9:07:90:c9:d2:66:ba
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21/07/2015, 00:00

Not After

07/10/2017, 23:59

Subject

CN=GAS INFORMATICA LTDA,O=GAS INFORMATICA LTDA,L=Brasilia,ST=Distrito Federal,C=BR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a3:24:38:d5:cd:5b:d1:f0:ec:9f:d4:cc:7f:b5:fa:f1:62:ac:31:60
Signer

Actual PE Digest

a3:24:38:d5:cd:5b:d1:f0:ec:9f:d4:cc:7f:b5:fa:f1:62:ac:31:60

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
SuspendThread
OpenMutexA
CreateMutexA
ReleaseMutex
OpenEventA
IsBadReadPtr
CreateProcessA
FileTimeToDosDateTime
DosDateTimeToFileTime
SetFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
HeapAlloc
HeapFree
GetProcessHeap
GetSystemInfo
WriteProcessMemory
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
VirtualQuery
GetShortPathNameA
GetVolumeInformationA
GetFileInformationByHandle
WideCharToMultiByte
ReadProcessMemory
Module32First
CreateToolhelp32Snapshot
Module32Next
DuplicateHandle
FileTimeToSystemTime
GetSystemTime
FindFirstFileW
GetLongPathNameA
FindNextFileW
SetFilePointer
GetTempPathA
VirtualFree
VirtualAlloc
GetVersion
MultiByteToWideChar
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
ExitProcess
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
lstrlenW
lstrlenA
lstrcpyW
lstrcpyA
lstrcmpiA
lstrcmpA
LocalAlloc
VirtualQueryEx
VirtualProtectEx
VirtualProtect
SetLastError
ReleaseSemaphore
OpenMutexW
OpenFileMappingW
OpenFileMappingA
OpenEventW
LoadLibraryExA
GetWindowsDirectoryW
GetThreadContext
GetSystemDirectoryW
GetModuleFileNameW
GetFileAttributesW
GetExitCodeThread
GetCurrentThread
GetCurrentDirectoryW
GetCurrentDirectoryA
InterlockedIncrement
FormatMessageA
ExitThread
CreateSemaphoreA
CreateProcessW
CreatePipe
CreateMutexW
CreateFileMappingW
SystemTimeToFileTime
ExpandEnvironmentStringsA
GetVersionExA
AreFileApisANSI
SetErrorMode
DeleteFileW
RemoveDirectoryW
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetTimeZoneInformation
SetFileAttributesA
MoveFileExA
GetModuleHandleA
InterlockedExchange
InterlockedCompareExchange
GetComputerNameA
GetLogicalDriveStringsA
GetFileSize
TerminateProcess
VerifyVersionInfoA
GetFileAttributesA
LocalFree
WriteFile
ReadFile
GetOverlappedResult
SetNamedPipeHandleState
WaitNamedPipeA
ConnectNamedPipe
CreateNamedPipeA
CancelIo
DisconnectNamedPipe
LoadLibraryW
CreateFileW
GetVersionExW
GetModuleHandleW
GetProcAddress
CreateEventW
DeleteFileA
GetNativeSystemInfo
VerSetConditionMask
VerifyVersionInfoW
ProcessIdToSessionId
WaitForMultipleObjects
GetLastError
ResumeThread
SetThreadPriority
TerminateThread
GetModuleFileNameA
DeviceIoControl
GetSystemDirectoryA
QueryDosDeviceA
FindNextFileA
LoadLibraryA
FindClose
CopyFileA
FindFirstFileA
ResetEvent
GetCurrentProcess
QueryDosDeviceW
EnterCriticalSection
LeaveCriticalSection
CreateFileA
GetCurrentProcessId
Sleep
OpenProcess
GetTickCount
WaitForSingleObject
DeleteCriticalSection
SetEvent
CloseHandle
CreateEventA
InitializeCriticalSection
GetLocaleInfoW
SetStdHandle
GetConsoleOutputCP
GetEnvironmentVariableA
GetLocalTime
CreateDirectoryA
RemoveDirectoryA
GetFullPathNameA
WriteConsoleA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
CreateThread
lstrcatW
FreeLibrary
FlushInstructionCache
GetWindowsDirectoryA
GetFileTime
InterlockedDecrement
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapReAlloc
WriteConsoleW
GetFileType
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
HeapCreate
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTimeFormatA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperA
GetCursorPos
CloseDesktop
DispatchMessageA
GetThreadDesktop
GetUserObjectInformationA
MsgWaitForMultipleObjects
OpenInputDesktop
PeekMessageA
TranslateMessage
MessageBoxA
GetKeyboardType
CharLowerA
EnumWindows
PostMessageA
GetWindowThreadProcessId

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA
CloseServiceHandle
GetKernelObjectSecurity
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
GetUserNameA
RegQueryInfoKeyA
EqualSid
GetTokenInformation
GetNamedSecurityInfoA
GetLengthSid
SetFileSecurityA
FreeSid
IsValidSid
AddAccessAllowedAce
AllocateAndInitializeSid
InitializeAcl
SetEntriesInAclA
RegDeleteKeyA
ControlService
SetServiceStatus
QueryServiceStatus
StartServiceA
CreateServiceA
StartServiceCtrlDispatcherA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
OpenServiceA
SetNamedSecurityInfoA
GetSecurityDescriptorSacl
SetSecurityInfo
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegSetValueExW
AdjustTokenPrivileges
LookupPrivilegeValueA
CreateProcessAsUserW
OpenProcessToken
RegCloseKey
RegOpenKeyA
RegQueryValueExA
DeleteService
OpenSCManagerA
RegisterServiceCtrlHandlerExA

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoInitialize
CoInitializeEx
CoCreateInstance
CoUninitialize
CoTaskMemFree

oleaut32

SysAllocStringLen
SysReAllocStringLen
SysFreeString
VariantInit
VariantClear
SysStringLen

fltlib

FilterConnectCommunicationPort
FilterSendMessage

Sections

.text
Size: - Virtual size: 743KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

CODE
Size: - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 286KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gas0
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.gas1
Size: 605KB - Virtual size: 605KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SEDAGRO yvl/inpay20.dll
.dll windows:5 windows x86 arch:x86

Password: infected

ac02d5aab56bb029e9b2bf0229dda5d7

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

27/04/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

30/05/2020, 10:48

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5a:f9:41:12:00:0a:ce:4f:ab:9b:b4:ae:77:09:2e:8c
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

15/02/2023, 23:59

Subject

CN=/N SOFTWARE INC.,O=/N SOFTWARE INC.,POSTALCODE=27517,STREET=101 europa dr ste 110,L=Chapel Hill,ST=NC,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:6a:3c:54:97:8c:4f:2e:09:73:2c:cf:56:ec:17:28:56:fd:3b:d1:ae:ff:15:1f:d2:2e:92:b8:4a:16:70:bf
Signer

Actual PE Digest

5a:6a:3c:54:97:8c:4f:2e:09:73:2c:cf:56:ec:17:28:56:fd:3b:d1:ae:ff:15:1f:d2:2e:92:b8:4a:16:70:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
GetTimeZoneInformation
GetVersionExA
lstrcmpA
lstrcmpiA
GetProcAddress
LoadLibraryA
FreeLibrary
GetTickCount
SetFileTime
LocalFileTimeToFileTime
IsDBCSLeadByte
WriteFile
ReadFile
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
GetACP
CreateFileA
GetExitCodeThread
WaitForSingleObject
GlobalFree
GlobalUnlock
FormatMessageA
lstrcpynA
GetLocalTime
RemoveDirectoryW
FileTimeToLocalFileTime
GetFileAttributesW
SetFileAttributesW
GetFullPathNameW
SetEndOfFile
FindClose
FindNextFileW
FindFirstFileW
MoveFileW
MoveFileA
GetFileTime
GetFileAttributesExW
GlobalLock
GlobalAlloc
lstrcpyA
GetTempFileNameW
GetTempFileNameA
GetTempPathA
CreateDirectoryW
GetVersion
CreateThread
DeleteCriticalSection
InitializeCriticalSection
GetComputerNameA
LeaveCriticalSection
EnterCriticalSection
TzSpecificLocalTimeToSystemTime
GetProcessHeap
HeapFree
HeapReAlloc
FileTimeToSystemTime
DeleteFileA
DeleteFileW
CreateFileW
SetFilePointer
GetFileSize
GetLastError
CloseHandle
lstrlenA
RemoveDirectoryA
SetLastError
HeapAlloc

user32

wvsprintfA
DestroyWindow
MessageBoxA
MessageBeep
SetWindowLongA
PeekMessageA
PostQuitMessage
TranslateMessage
DispatchMessageA
IsWindow
MsgWaitForMultipleObjects
PostMessageA
RegisterClassA
SendMessageA
UnregisterClassA
CharUpperW
CharLowerBuffW
CharLowerBuffA
CharUpperBuffW
CharUpperBuffA
GetWindowLongA
DefWindowProcA
wsprintfA
CreateWindowExA
CharLowerW

advapi32

CryptGetUserKey
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptGetKeyParam
CryptGetProvParam
CryptImportKey
CryptDestroyKey

ole32

CoInitialize

ws2_32

WSAGetLastError
closesocket
ntohs
getsockname
setsockopt
htonl
htons
inet_addr
WSACancelAsyncRequest
WSAStartup
WSAIoctl
gethostname
gethostbyname
WSAIsBlocking
sendto
send
recvfrom
recv
WSAAsyncGetServByPort
WSAAsyncGetServByName
listen
bind
socket
WSASetLastError
WSAAsyncGetHostByAddr
WSAAsyncGetHostByName
connect
accept
__WSAFDIsSet
getpeername
getsockopt
WSAAsyncSelect
ioctlsocket
WSACancelBlockingCall
WSACleanup
select

Exports

Exports

InPay_CardValidator_CheckIndex
InPay_CardValidator_Create
InPay_CardValidator_Destroy
InPay_CardValidator_Do
InPay_CardValidator_Get
InPay_CardValidator_GetEventError
InPay_CardValidator_GetEventErrorCode
InPay_CardValidator_GetLastError
InPay_CardValidator_GetLastErrorCode
InPay_CardValidator_Set
InPay_CardValidator_SetEventErrorAndCode
InPay_CardValidator_SetLastErrorAndCode
InPay_CardValidator_StaticDestroy
InPay_CardValidator_StaticInit
InPay_Check21_CheckIndex
InPay_Check21_Create
InPay_Check21_Destroy
InPay_Check21_Do
InPay_Check21_Get
InPay_Check21_GetEventError
InPay_Check21_GetEventErrorCode
InPay_Check21_GetLastError
InPay_Check21_GetLastErrorCode
InPay_Check21_Set
InPay_Check21_SetEventErrorAndCode
InPay_Check21_SetLastErrorAndCode
InPay_Check21_StaticDestroy
InPay_Check21_StaticInit
InPay_DirectPayment_CheckIndex
InPay_DirectPayment_Create
InPay_DirectPayment_Destroy
InPay_DirectPayment_Do
InPay_DirectPayment_Get
InPay_DirectPayment_GetEventError
InPay_DirectPayment_GetEventErrorCode
InPay_DirectPayment_GetLastError
InPay_DirectPayment_GetLastErrorCode
InPay_DirectPayment_Set
InPay_DirectPayment_SetEventErrorAndCode
InPay_DirectPayment_SetLastErrorAndCode
InPay_DirectPayment_StaticDestroy
InPay_DirectPayment_StaticInit
InPay_ECheck_CheckIndex
InPay_ECheck_Create
InPay_ECheck_Destroy
InPay_ECheck_Do
InPay_ECheck_Get
InPay_ECheck_GetEventError
InPay_ECheck_GetEventErrorCode
InPay_ECheck_GetLastError
InPay_ECheck_GetLastErrorCode
InPay_ECheck_Set
InPay_ECheck_SetEventErrorAndCode
InPay_ECheck_SetLastErrorAndCode
InPay_ECheck_StaticDestroy
InPay_ECheck_StaticInit
InPay_EvtStr
InPay_ExpressCheckout_CheckIndex
InPay_ExpressCheckout_Create
InPay_ExpressCheckout_Destroy
InPay_ExpressCheckout_Do
InPay_ExpressCheckout_Get
InPay_ExpressCheckout_GetEventError
InPay_ExpressCheckout_GetEventErrorCode
InPay_ExpressCheckout_GetLastError
InPay_ExpressCheckout_GetLastErrorCode
InPay_ExpressCheckout_Set
InPay_ExpressCheckout_SetEventErrorAndCode
InPay_ExpressCheckout_SetLastErrorAndCode
InPay_ExpressCheckout_StaticDestroy
InPay_ExpressCheckout_StaticInit
InPay_ICharge_CheckIndex
InPay_ICharge_Create
InPay_ICharge_Destroy
InPay_ICharge_Do
InPay_ICharge_Get
InPay_ICharge_GetEventError
InPay_ICharge_GetEventErrorCode
InPay_ICharge_GetLastError
InPay_ICharge_GetLastErrorCode
InPay_ICharge_Set
InPay_ICharge_SetEventErrorAndCode
InPay_ICharge_SetLastErrorAndCode
InPay_ICharge_StaticDestroy
InPay_ICharge_StaticInit
InPay_Level2_CheckIndex
InPay_Level2_Create
InPay_Level2_Destroy
InPay_Level2_Do
InPay_Level2_Get
InPay_Level2_GetEventError
InPay_Level2_GetEventErrorCode
InPay_Level2_GetLastError
InPay_Level2_GetLastErrorCode
InPay_Level2_Set
InPay_Level2_SetEventErrorAndCode
InPay_Level2_SetLastErrorAndCode
InPay_Level2_StaticDestroy
InPay_Level2_StaticInit
InPay_Level3_CheckIndex
InPay_Level3_Create
InPay_Level3_Destroy
InPay_Level3_Do
InPay_Level3_Get
InPay_Level3_GetEventError
InPay_Level3_GetEventErrorCode
InPay_Level3_GetLastError
InPay_Level3_GetLastErrorCode
InPay_Level3_Set
InPay_Level3_SetEventErrorAndCode
InPay_Level3_SetLastErrorAndCode
InPay_Level3_StaticDestroy
InPay_Level3_StaticInit
InPay_OAuth_CheckIndex
InPay_OAuth_Create
InPay_OAuth_Destroy
InPay_OAuth_Do
InPay_OAuth_Get
InPay_OAuth_GetEventError
InPay_OAuth_GetEventErrorCode
InPay_OAuth_GetLastError
InPay_OAuth_GetLastErrorCode
InPay_OAuth_Set
InPay_OAuth_SetEventErrorAndCode
InPay_OAuth_SetLastErrorAndCode
InPay_OAuth_StaticDestroy
InPay_OAuth_StaticInit
InPay_RecurringBilling_CheckIndex
InPay_RecurringBilling_Create
InPay_RecurringBilling_Destroy
InPay_RecurringBilling_Do
InPay_RecurringBilling_Get
InPay_RecurringBilling_GetEventError
InPay_RecurringBilling_GetEventErrorCode
InPay_RecurringBilling_GetLastError
InPay_RecurringBilling_GetLastErrorCode
InPay_RecurringBilling_Set
InPay_RecurringBilling_SetEventErrorAndCode
InPay_RecurringBilling_SetLastErrorAndCode
InPay_RecurringBilling_StaticDestroy
InPay_RecurringBilling_StaticInit
InPay_Retail_CheckIndex
InPay_Retail_Create
InPay_Retail_Destroy
InPay_Retail_Do
InPay_Retail_Get
InPay_Retail_GetEventError
InPay_Retail_GetEventErrorCode
InPay_Retail_GetLastError
InPay_Retail_GetLastErrorCode
InPay_Retail_Set
InPay_Retail_SetEventErrorAndCode
InPay_Retail_SetLastErrorAndCode
InPay_Retail_StaticDestroy
InPay_Retail_StaticInit
InPay_Stream

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 381KB - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/ipworksedi20.dll
.dll windows:5 windows x86 arch:x86

Password: infected

c81951e1e0635a5d9bdd528c8c962799

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

27/04/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

30/05/2020, 10:48

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5a:f9:41:12:00:0a:ce:4f:ab:9b:b4:ae:77:09:2e:8c
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

15/02/2023, 23:59

Subject

CN=/N SOFTWARE INC.,O=/N SOFTWARE INC.,POSTALCODE=27517,STREET=101 europa dr ste 110,L=Chapel Hill,ST=NC,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c1:7a:09:34:73:b2:0e:17:d7:4a:da:5e:80:48:76:92:ec:51:a7:6a:5c:ca:41:a5:bc:98:2d:a9:d0:3c:85:03
Signer

Actual PE Digest

c1:7a:09:34:73:b2:0e:17:d7:4a:da:5e:80:48:76:92:ec:51:a7:6a:5c:ca:41:a5:bc:98:2d:a9:d0:3c:85:03

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpA
IsDBCSLeadByte
LoadLibraryA
GetProcAddress
FreeLibrary
GetTickCount
SetFileTime
WriteFile
ReadFile
lstrcpynA
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
GetACP
CreateFileA
GlobalFree
GlobalUnlock
GetExitCodeThread
WaitForSingleObject
lstrcpyA
FormatMessageA
GetLocalTime
RemoveDirectoryW
RemoveDirectoryA
GetFileAttributesW
SetFileAttributesW
GetFullPathNameW
SetEndOfFile
lstrcmpiA
FindNextFileW
FindFirstFileW
MoveFileW
GetFileTime
GetFileAttributesExW
GlobalLock
GlobalAlloc
GetTempFileNameW
GetTempFileNameA
GetTempPathA
CreateDirectoryW
GetVersion
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetCurrentThreadId
CreateThread
FindNextFileA
FindFirstFileA
DeleteCriticalSection
InitializeCriticalSection
GetComputerNameA
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapFree
HeapReAlloc
GetVersionExA
GetTimeZoneInformation
LocalFileTimeToFileTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
MoveFileA
DeleteFileA
DeleteFileW
CreateFileW
SetFilePointer
GetFileSize
GetLastError
CloseHandle
lstrlenA
FindClose
SetLastError
HeapAlloc

user32

MessageBeep
MessageBoxA
FindWindowA
DestroyWindow
wvsprintfA
CreateWindowExA
SetWindowLongA
IsWindow
MsgWaitForMultipleObjects
PeekMessageA
PostQuitMessage
TranslateMessage
DispatchMessageA
PostMessageA
RegisterClassA
UnregisterClassA
GetWindowLongA
CharUpperW
CharLowerBuffW
CharLowerBuffA
CharUpperBuffW
CharUpperBuffA
DefWindowProcA
SendMessageA
wsprintfA
CharLowerW

advapi32

CryptGetUserKey
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextA
CryptGetProvParam
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptSetKeyParam
CryptImportKey
CryptEncrypt
CryptDecrypt
CryptDestroyHash
CryptVerifySignatureA
CryptHashData
CryptCreateHash
CryptSignHashA
CryptDestroyKey

ole32

CoInitialize

ws2_32

getpeername
__WSAFDIsSet
select
WSAGetLastError
setsockopt
closesocket
ntohs
getsockname
WSACancelAsyncRequest
WSAStartup
WSAIoctl
gethostbyname
WSAIsBlocking
gethostname
sendto
send
recvfrom
recv
WSAAsyncGetServByPort
WSAAsyncGetServByName
listen
bind
socket
WSASetLastError
WSAAsyncGetHostByAddr
WSAAsyncGetHostByName
connect
accept
WSAAsyncSelect
ioctlsocket
WSACancelBlockingCall
WSACleanup
inet_addr
htons
htonl
getsockopt

Exports

Exports

IPWorksEDI_AS2ProfileMgr_CheckIndex
IPWorksEDI_AS2ProfileMgr_Create
IPWorksEDI_AS2ProfileMgr_Destroy
IPWorksEDI_AS2ProfileMgr_Do
IPWorksEDI_AS2ProfileMgr_Get
IPWorksEDI_AS2ProfileMgr_GetEventError
IPWorksEDI_AS2ProfileMgr_GetEventErrorCode
IPWorksEDI_AS2ProfileMgr_GetLastError
IPWorksEDI_AS2ProfileMgr_GetLastErrorCode
IPWorksEDI_AS2ProfileMgr_Set
IPWorksEDI_AS2ProfileMgr_SetEventErrorAndCode
IPWorksEDI_AS2ProfileMgr_SetLastErrorAndCode
IPWorksEDI_AS2ProfileMgr_StaticDestroy
IPWorksEDI_AS2ProfileMgr_StaticInit
IPWorksEDI_AS2Receiver_CheckIndex
IPWorksEDI_AS2Receiver_Create
IPWorksEDI_AS2Receiver_Destroy
IPWorksEDI_AS2Receiver_Do
IPWorksEDI_AS2Receiver_Get
IPWorksEDI_AS2Receiver_GetEventError
IPWorksEDI_AS2Receiver_GetEventErrorCode
IPWorksEDI_AS2Receiver_GetLastError
IPWorksEDI_AS2Receiver_GetLastErrorCode
IPWorksEDI_AS2Receiver_Set
IPWorksEDI_AS2Receiver_SetEventErrorAndCode
IPWorksEDI_AS2Receiver_SetLastErrorAndCode
IPWorksEDI_AS2Receiver_StaticDestroy
IPWorksEDI_AS2Receiver_StaticInit
IPWorksEDI_AS2Sender_CheckIndex
IPWorksEDI_AS2Sender_Create
IPWorksEDI_AS2Sender_Destroy
IPWorksEDI_AS2Sender_Do
IPWorksEDI_AS2Sender_Get
IPWorksEDI_AS2Sender_GetEventError
IPWorksEDI_AS2Sender_GetEventErrorCode
IPWorksEDI_AS2Sender_GetLastError
IPWorksEDI_AS2Sender_GetLastErrorCode
IPWorksEDI_AS2Sender_Set
IPWorksEDI_AS2Sender_SetEventErrorAndCode
IPWorksEDI_AS2Sender_SetLastErrorAndCode
IPWorksEDI_AS2Sender_StaticDestroy
IPWorksEDI_AS2Sender_StaticInit
IPWorksEDI_CertMgr_CheckIndex
IPWorksEDI_CertMgr_Create
IPWorksEDI_CertMgr_Destroy
IPWorksEDI_CertMgr_Do
IPWorksEDI_CertMgr_Get
IPWorksEDI_CertMgr_GetEventError
IPWorksEDI_CertMgr_GetEventErrorCode
IPWorksEDI_CertMgr_GetLastError
IPWorksEDI_CertMgr_GetLastErrorCode
IPWorksEDI_CertMgr_Set
IPWorksEDI_CertMgr_SetEventErrorAndCode
IPWorksEDI_CertMgr_SetLastErrorAndCode
IPWorksEDI_CertMgr_StaticDestroy
IPWorksEDI_CertMgr_StaticInit
IPWorksEDI_EDIFACTReader_CheckIndex
IPWorksEDI_EDIFACTReader_Create
IPWorksEDI_EDIFACTReader_Destroy
IPWorksEDI_EDIFACTReader_Do
IPWorksEDI_EDIFACTReader_Get
IPWorksEDI_EDIFACTReader_GetEventError
IPWorksEDI_EDIFACTReader_GetEventErrorCode
IPWorksEDI_EDIFACTReader_GetLastError
IPWorksEDI_EDIFACTReader_GetLastErrorCode
IPWorksEDI_EDIFACTReader_Set
IPWorksEDI_EDIFACTReader_SetEventErrorAndCode
IPWorksEDI_EDIFACTReader_SetLastErrorAndCode
IPWorksEDI_EDIFACTReader_StaticDestroy
IPWorksEDI_EDIFACTReader_StaticInit
IPWorksEDI_EDIFACTTranslator_CheckIndex
IPWorksEDI_EDIFACTTranslator_Create
IPWorksEDI_EDIFACTTranslator_Destroy
IPWorksEDI_EDIFACTTranslator_Do
IPWorksEDI_EDIFACTTranslator_Get
IPWorksEDI_EDIFACTTranslator_GetEventError
IPWorksEDI_EDIFACTTranslator_GetEventErrorCode
IPWorksEDI_EDIFACTTranslator_GetLastError
IPWorksEDI_EDIFACTTranslator_GetLastErrorCode
IPWorksEDI_EDIFACTTranslator_Set
IPWorksEDI_EDIFACTTranslator_SetEventErrorAndCode
IPWorksEDI_EDIFACTTranslator_SetLastErrorAndCode
IPWorksEDI_EDIFACTTranslator_StaticDestroy
IPWorksEDI_EDIFACTTranslator_StaticInit
IPWorksEDI_EDIFACTWriter_CheckIndex
IPWorksEDI_EDIFACTWriter_Create
IPWorksEDI_EDIFACTWriter_Destroy
IPWorksEDI_EDIFACTWriter_Do
IPWorksEDI_EDIFACTWriter_Get
IPWorksEDI_EDIFACTWriter_GetEventError
IPWorksEDI_EDIFACTWriter_GetEventErrorCode
IPWorksEDI_EDIFACTWriter_GetLastError
IPWorksEDI_EDIFACTWriter_GetLastErrorCode
IPWorksEDI_EDIFACTWriter_Set
IPWorksEDI_EDIFACTWriter_SetEventErrorAndCode
IPWorksEDI_EDIFACTWriter_SetLastErrorAndCode
IPWorksEDI_EDIFACTWriter_StaticDestroy
IPWorksEDI_EDIFACTWriter_StaticInit
IPWorksEDI_EvtStr
IPWorksEDI_FTP_CheckIndex
IPWorksEDI_FTP_Create
IPWorksEDI_FTP_Destroy
IPWorksEDI_FTP_Do
IPWorksEDI_FTP_Get
IPWorksEDI_FTP_GetEventError
IPWorksEDI_FTP_GetEventErrorCode
IPWorksEDI_FTP_GetLastError
IPWorksEDI_FTP_GetLastErrorCode
IPWorksEDI_FTP_Set
IPWorksEDI_FTP_SetEventErrorAndCode
IPWorksEDI_FTP_SetLastErrorAndCode
IPWorksEDI_FTP_StaticDestroy
IPWorksEDI_FTP_StaticInit
IPWorksEDI_HL7Reader_CheckIndex
IPWorksEDI_HL7Reader_Create
IPWorksEDI_HL7Reader_Destroy
IPWorksEDI_HL7Reader_Do
IPWorksEDI_HL7Reader_Get
IPWorksEDI_HL7Reader_GetEventError
IPWorksEDI_HL7Reader_GetEventErrorCode
IPWorksEDI_HL7Reader_GetLastError
IPWorksEDI_HL7Reader_GetLastErrorCode
IPWorksEDI_HL7Reader_Set
IPWorksEDI_HL7Reader_SetEventErrorAndCode
IPWorksEDI_HL7Reader_SetLastErrorAndCode
IPWorksEDI_HL7Reader_StaticDestroy
IPWorksEDI_HL7Reader_StaticInit
IPWorksEDI_HL7Translator_CheckIndex
IPWorksEDI_HL7Translator_Create
IPWorksEDI_HL7Translator_Destroy
IPWorksEDI_HL7Translator_Do
IPWorksEDI_HL7Translator_Get
IPWorksEDI_HL7Translator_GetEventError
IPWorksEDI_HL7Translator_GetEventErrorCode
IPWorksEDI_HL7Translator_GetLastError
IPWorksEDI_HL7Translator_GetLastErrorCode
IPWorksEDI_HL7Translator_Set
IPWorksEDI_HL7Translator_SetEventErrorAndCode
IPWorksEDI_HL7Translator_SetLastErrorAndCode
IPWorksEDI_HL7Translator_StaticDestroy
IPWorksEDI_HL7Translator_StaticInit
IPWorksEDI_HL7Writer_CheckIndex
IPWorksEDI_HL7Writer_Create
IPWorksEDI_HL7Writer_Destroy
IPWorksEDI_HL7Writer_Do
IPWorksEDI_HL7Writer_Get
IPWorksEDI_HL7Writer_GetEventError
IPWorksEDI_HL7Writer_GetEventErrorCode
IPWorksEDI_HL7Writer_GetLastError
IPWorksEDI_HL7Writer_GetLastErrorCode
IPWorksEDI_HL7Writer_Set
IPWorksEDI_HL7Writer_SetEventErrorAndCode
IPWorksEDI_HL7Writer_SetLastErrorAndCode
IPWorksEDI_HL7Writer_StaticDestroy
IPWorksEDI_HL7Writer_StaticInit
IPWorksEDI_HTMLMailer_CheckIndex
IPWorksEDI_HTMLMailer_Create
IPWorksEDI_HTMLMailer_Destroy
IPWorksEDI_HTMLMailer_Do
IPWorksEDI_HTMLMailer_Get
IPWorksEDI_HTMLMailer_GetEventError
IPWorksEDI_HTMLMailer_GetEventErrorCode
IPWorksEDI_HTMLMailer_GetLastError
IPWorksEDI_HTMLMailer_GetLastErrorCode
IPWorksEDI_HTMLMailer_Set
IPWorksEDI_HTMLMailer_SetEventErrorAndCode
IPWorksEDI_HTMLMailer_SetLastErrorAndCode
IPWorksEDI_HTMLMailer_StaticDestroy
IPWorksEDI_HTMLMailer_StaticInit
IPWorksEDI_IMAP_CheckIndex
IPWorksEDI_IMAP_Create
IPWorksEDI_IMAP_Destroy
IPWorksEDI_IMAP_Do
IPWorksEDI_IMAP_Get
IPWorksEDI_IMAP_GetEventError
IPWorksEDI_IMAP_GetEventErrorCode
IPWorksEDI_IMAP_GetLastError
IPWorksEDI_IMAP_GetLastErrorCode
IPWorksEDI_IMAP_Set
IPWorksEDI_IMAP_SetEventErrorAndCode
IPWorksEDI_IMAP_SetLastErrorAndCode
IPWorksEDI_IMAP_StaticDestroy
IPWorksEDI_IMAP_StaticInit
IPWorksEDI_MLLPClient_CheckIndex
IPWorksEDI_MLLPClient_Create
IPWorksEDI_MLLPClient_Destroy
IPWorksEDI_MLLPClient_Do
IPWorksEDI_MLLPClient_Get
IPWorksEDI_MLLPClient_GetEventError
IPWorksEDI_MLLPClient_GetEventErrorCode
IPWorksEDI_MLLPClient_GetLastError
IPWorksEDI_MLLPClient_GetLastErrorCode
IPWorksEDI_MLLPClient_Set
IPWorksEDI_MLLPClient_SetEventErrorAndCode
IPWorksEDI_MLLPClient_SetLastErrorAndCode
IPWorksEDI_MLLPClient_StaticDestroy
IPWorksEDI_MLLPClient_StaticInit
IPWorksEDI_MLLPServer_CheckIndex
IPWorksEDI_MLLPServer_Create
IPWorksEDI_MLLPServer_Destroy
IPWorksEDI_MLLPServer_Do
IPWorksEDI_MLLPServer_Get
IPWorksEDI_MLLPServer_GetEventError
IPWorksEDI_MLLPServer_GetEventErrorCode
IPWorksEDI_MLLPServer_GetLastError
IPWorksEDI_MLLPServer_GetLastErrorCode
IPWorksEDI_MLLPServer_Set
IPWorksEDI_MLLPServer_SetEventErrorAndCode
IPWorksEDI_MLLPServer_SetLastErrorAndCode
IPWorksEDI_MLLPServer_StaticDestroy
IPWorksEDI_MLLPServer_StaticInit
IPWorksEDI_POP_CheckIndex
IPWorksEDI_POP_Create
IPWorksEDI_POP_Destroy
IPWorksEDI_POP_Do
IPWorksEDI_POP_Get
IPWorksEDI_POP_GetEventError
IPWorksEDI_POP_GetEventErrorCode
IPWorksEDI_POP_GetLastError
IPWorksEDI_POP_GetLastErrorCode
IPWorksEDI_POP_Set
IPWorksEDI_POP_SetEventErrorAndCode
IPWorksEDI_POP_SetLastErrorAndCode
IPWorksEDI_POP_StaticDestroy
IPWorksEDI_POP_StaticInit
IPWorksEDI_SFTP_CheckIndex
IPWorksEDI_SFTP_Create
IPWorksEDI_SFTP_Destroy
IPWorksEDI_SFTP_Do
IPWorksEDI_SFTP_Get
IPWorksEDI_SFTP_GetEventError
IPWorksEDI_SFTP_GetEventErrorCode
IPWorksEDI_SFTP_GetLastError
IPWorksEDI_SFTP_GetLastErrorCode
IPWorksEDI_SFTP_Set
IPWorksEDI_SFTP_SetEventErrorAndCode
IPWorksEDI_SFTP_SetLastErrorAndCode
IPWorksEDI_SFTP_StaticDestroy
IPWorksEDI_SFTP_StaticInit
IPWorksEDI_SMTP_CheckIndex
IPWorksEDI_SMTP_Create
IPWorksEDI_SMTP_Destroy
IPWorksEDI_SMTP_Do
IPWorksEDI_SMTP_Get
IPWorksEDI_SMTP_GetEventError
IPWorksEDI_SMTP_GetEventErrorCode
IPWorksEDI_SMTP_GetLastError
IPWorksEDI_SMTP_GetLastErrorCode
IPWorksEDI_SMTP_Set
IPWorksEDI_SMTP_SetEventErrorAndCode
IPWorksEDI_SMTP_SetLastErrorAndCode
IPWorksEDI_SMTP_StaticDestroy
IPWorksEDI_SMTP_StaticInit
IPWorksEDI_Stream
IPWorksEDI_TRADACOMSReader_CheckIndex
IPWorksEDI_TRADACOMSReader_Create
IPWorksEDI_TRADACOMSReader_Destroy
IPWorksEDI_TRADACOMSReader_Do
IPWorksEDI_TRADACOMSReader_Get
IPWorksEDI_TRADACOMSReader_GetEventError
IPWorksEDI_TRADACOMSReader_GetEventErrorCode
IPWorksEDI_TRADACOMSReader_GetLastError
IPWorksEDI_TRADACOMSReader_GetLastErrorCode
IPWorksEDI_TRADACOMSReader_Set
IPWorksEDI_TRADACOMSReader_SetEventErrorAndCode
IPWorksEDI_TRADACOMSReader_SetLastErrorAndCode
IPWorksEDI_TRADACOMSReader_StaticDestroy
IPWorksEDI_TRADACOMSReader_StaticInit
IPWorksEDI_TRADACOMSTranslator_CheckIndex
IPWorksEDI_TRADACOMSTranslator_Create
IPWorksEDI_TRADACOMSTranslator_Destroy
IPWorksEDI_TRADACOMSTranslator_Do
IPWorksEDI_TRADACOMSTranslator_Get
IPWorksEDI_TRADACOMSTranslator_GetEventError
IPWorksEDI_TRADACOMSTranslator_GetEventErrorCode
IPWorksEDI_TRADACOMSTranslator_GetLastError
IPWorksEDI_TRADACOMSTranslator_GetLastErrorCode
IPWorksEDI_TRADACOMSTranslator_Set
IPWorksEDI_TRADACOMSTranslator_SetEventErrorAndCode
IPWorksEDI_TRADACOMSTranslator_SetLastErrorAndCode
IPWorksEDI_TRADACOMSTranslator_StaticDestroy
IPWorksEDI_TRADACOMSTranslator_StaticInit
IPWorksEDI_TRADACOMSWriter_CheckIndex
IPWorksEDI_TRADACOMSWriter_Create
IPWorksEDI_TRADACOMSWriter_Destroy
IPWorksEDI_TRADACOMSWriter_Do
IPWorksEDI_TRADACOMSWriter_Get
IPWorksEDI_TRADACOMSWriter_GetEventError
IPWorksEDI_TRADACOMSWriter_GetEventErrorCode
IPWorksEDI_TRADACOMSWriter_GetLastError
IPWorksEDI_TRADACOMSWriter_GetLastErrorCode
IPWorksEDI_TRADACOMSWriter_Set
IPWorksEDI_TRADACOMSWriter_SetEventErrorAndCode
IPWorksEDI_TRADACOMSWriter_SetLastErrorAndCode
IPWorksEDI_TRADACOMSWriter_StaticDestroy
IPWorksEDI_TRADACOMSWriter_StaticInit
IPWorksEDI_VDAReader_CheckIndex
IPWorksEDI_VDAReader_Create
IPWorksEDI_VDAReader_Destroy
IPWorksEDI_VDAReader_Do
IPWorksEDI_VDAReader_Get
IPWorksEDI_VDAReader_GetEventError
IPWorksEDI_VDAReader_GetEventErrorCode
IPWorksEDI_VDAReader_GetLastError
IPWorksEDI_VDAReader_GetLastErrorCode
IPWorksEDI_VDAReader_Set
IPWorksEDI_VDAReader_SetEventErrorAndCode
IPWorksEDI_VDAReader_SetLastErrorAndCode
IPWorksEDI_VDAReader_StaticDestroy
IPWorksEDI_VDAReader_StaticInit
IPWorksEDI_VDATranslator_CheckIndex
IPWorksEDI_VDATranslator_Create
IPWorksEDI_VDATranslator_Destroy
IPWorksEDI_VDATranslator_Do
IPWorksEDI_VDATranslator_Get
IPWorksEDI_VDATranslator_GetEventError
IPWorksEDI_VDATranslator_GetEventErrorCode
IPWorksEDI_VDATranslator_GetLastError
IPWorksEDI_VDATranslator_GetLastErrorCode
IPWorksEDI_VDATranslator_Set
IPWorksEDI_VDATranslator_SetEventErrorAndCode
IPWorksEDI_VDATranslator_SetLastErrorAndCode
IPWorksEDI_VDATranslator_StaticDestroy
IPWorksEDI_VDATranslator_StaticInit
IPWorksEDI_VDAWriter_CheckIndex
IPWorksEDI_VDAWriter_Create
IPWorksEDI_VDAWriter_Destroy
IPWorksEDI_VDAWriter_Do
IPWorksEDI_VDAWriter_Get
IPWorksEDI_VDAWriter_GetEventError
IPWorksEDI_VDAWriter_GetEventErrorCode
IPWorksEDI_VDAWriter_GetLastError
IPWorksEDI_VDAWriter_GetLastErrorCode
IPWorksEDI_VDAWriter_Set
IPWorksEDI_VDAWriter_SetEventErrorAndCode
IPWorksEDI_VDAWriter_SetLastErrorAndCode
IPWorksEDI_VDAWriter_StaticDestroy
IPWorksEDI_VDAWriter_StaticInit
IPWorksEDI_X12Reader_CheckIndex
IPWorksEDI_X12Reader_Create
IPWorksEDI_X12Reader_Destroy
IPWorksEDI_X12Reader_Do
IPWorksEDI_X12Reader_Get
IPWorksEDI_X12Reader_GetEventError
IPWorksEDI_X12Reader_GetEventErrorCode
IPWorksEDI_X12Reader_GetLastError
IPWorksEDI_X12Reader_GetLastErrorCode
IPWorksEDI_X12Reader_Set
IPWorksEDI_X12Reader_SetEventErrorAndCode
IPWorksEDI_X12Reader_SetLastErrorAndCode
IPWorksEDI_X12Reader_StaticDestroy
IPWorksEDI_X12Reader_StaticInit
IPWorksEDI_X12Translator_CheckIndex
IPWorksEDI_X12Translator_Create
IPWorksEDI_X12Translator_Destroy
IPWorksEDI_X12Translator_Do
IPWorksEDI_X12Translator_Get
IPWorksEDI_X12Translator_GetEventError
IPWorksEDI_X12Translator_GetEventErrorCode
IPWorksEDI_X12Translator_GetLastError
IPWorksEDI_X12Translator_GetLastErrorCode
IPWorksEDI_X12Translator_Set
IPWorksEDI_X12Translator_SetEventErrorAndCode
IPWorksEDI_X12Translator_SetLastErrorAndCode
IPWorksEDI_X12Translator_StaticDestroy
IPWorksEDI_X12Translator_StaticInit
IPWorksEDI_X12Writer_CheckIndex
IPWorksEDI_X12Writer_Create
IPWorksEDI_X12Writer_Destroy
IPWorksEDI_X12Writer_Do
IPWorksEDI_X12Writer_Get
IPWorksEDI_X12Writer_GetEventError
IPWorksEDI_X12Writer_GetEventErrorCode
IPWorksEDI_X12Writer_GetLastError
IPWorksEDI_X12Writer_GetLastErrorCode
IPWorksEDI_X12Writer_Set
IPWorksEDI_X12Writer_SetEventErrorAndCode
IPWorksEDI_X12Writer_SetLastErrorAndCode
IPWorksEDI_X12Writer_StaticDestroy
IPWorksEDI_X12Writer_StaticInit

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 371KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 475KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/libeay32.dll
.dll windows:5 windows x86 arch:x86

Password: infected

43b0fe249f8f5a5ce8ac2d967a025119

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

sendto
recvfrom
bind
listen
accept
ntohl
ioctlsocket
WSACleanup
WSAStartup
gethostbyname
getsockopt
getservbyname
ntohs
htons
htonl
socket
setsockopt
connect
send
WSASetLastError
recv
WSAGetLastError
shutdown
closesocket

gdi32

CreateCompatibleBitmap
GetObjectA
GetDIBits
DeleteObject
GetDeviceCaps

advapi32

ReportEventA
DeregisterEventSource
RegisterEventSourceA

user32

GetDC
ReleaseDC
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

kernel32

GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoA
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetProcessHeap
SetEndOfFile
GetCurrentDirectoryA
CompareStringA
CompareStringW
HeapSize
SetEnvironmentVariableA
CreateFileW
GetEnvironmentStrings
WideCharToMultiByte
GetFullPathNameA
FlushFileBuffers
RtlUnwind
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
ExitProcess
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
GetLastError
GetVersion
WriteFile
GetFileType
GetStdHandle
FindNextFileA
FindFirstFileA
FindClose
FreeLibrary
LoadLibraryA
CloseHandle
SetLastError
MultiByteToWideChar
SystemTimeToFileTime
GetSystemTime
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
FlushConsoleInputBuffer
GetModuleHandleW
Sleep
SetConsoleCtrlHandler
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
ReadFile
GetConsoleCP
GetConsoleMode
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
SetFileAttributesA
GetFileAttributesA
CreateFileA
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
DeleteCriticalSection
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetTimeZoneInformation
SetFilePointer
SetStdHandle

Exports

Exports

ACCESS_DESCRIPTION_free
ACCESS_DESCRIPTION_it
ACCESS_DESCRIPTION_new
AES_bi_ige_encrypt
AES_cbc_encrypt
AES_cfb128_encrypt
AES_cfb1_encrypt
AES_cfb8_encrypt
AES_ctr128_encrypt
AES_decrypt
AES_ecb_encrypt
AES_encrypt
AES_ige_encrypt
AES_ofb128_encrypt
AES_options
AES_set_decrypt_key
AES_set_encrypt_key
AES_unwrap_key
AES_wrap_key
ASN1_ANY_it
ASN1_BIT_STRING_check
ASN1_BIT_STRING_free
ASN1_BIT_STRING_get_bit
ASN1_BIT_STRING_it
ASN1_BIT_STRING_name_print
ASN1_BIT_STRING_new
ASN1_BIT_STRING_num_asc
ASN1_BIT_STRING_set
ASN1_BIT_STRING_set_asc
ASN1_BIT_STRING_set_bit
ASN1_BMPSTRING_free
ASN1_BMPSTRING_it
ASN1_BMPSTRING_new
ASN1_BOOLEAN_it
ASN1_ENUMERATED_free
ASN1_ENUMERATED_get
ASN1_ENUMERATED_it
ASN1_ENUMERATED_new
ASN1_ENUMERATED_set
ASN1_ENUMERATED_to_BN
ASN1_FBOOLEAN_it
ASN1_GENERALIZEDTIME_adj
ASN1_GENERALIZEDTIME_check
ASN1_GENERALIZEDTIME_free
ASN1_GENERALIZEDTIME_it
ASN1_GENERALIZEDTIME_new
ASN1_GENERALIZEDTIME_print
ASN1_GENERALIZEDTIME_set
ASN1_GENERALIZEDTIME_set_string
ASN1_GENERALSTRING_free
ASN1_GENERALSTRING_it
ASN1_GENERALSTRING_new
ASN1_IA5STRING_free
ASN1_IA5STRING_it
ASN1_IA5STRING_new
ASN1_INTEGER_cmp
ASN1_INTEGER_dup
ASN1_INTEGER_free
ASN1_INTEGER_get
ASN1_INTEGER_it
ASN1_INTEGER_new
ASN1_INTEGER_set
ASN1_INTEGER_to_BN
ASN1_NULL_free
ASN1_NULL_it
ASN1_NULL_new
ASN1_OBJECT_create
ASN1_OBJECT_free
ASN1_OBJECT_it
ASN1_OBJECT_new
ASN1_OCTET_STRING_NDEF_it
ASN1_OCTET_STRING_cmp
ASN1_OCTET_STRING_dup
ASN1_OCTET_STRING_free
ASN1_OCTET_STRING_it
ASN1_OCTET_STRING_new
ASN1_OCTET_STRING_set
ASN1_PCTX_free
ASN1_PCTX_get_cert_flags
ASN1_PCTX_get_flags
ASN1_PCTX_get_nm_flags
ASN1_PCTX_get_oid_flags
ASN1_PCTX_get_str_flags
ASN1_PCTX_new
ASN1_PCTX_set_cert_flags
ASN1_PCTX_set_flags
ASN1_PCTX_set_nm_flags
ASN1_PCTX_set_oid_flags
ASN1_PCTX_set_str_flags
ASN1_PRINTABLESTRING_free
ASN1_PRINTABLESTRING_it
ASN1_PRINTABLESTRING_new
ASN1_PRINTABLE_free
ASN1_PRINTABLE_it
ASN1_PRINTABLE_new
ASN1_PRINTABLE_type
ASN1_SEQUENCE_ANY_it
ASN1_SEQUENCE_it
ASN1_SET_ANY_it
ASN1_STRING_TABLE_add
ASN1_STRING_TABLE_cleanup
ASN1_STRING_TABLE_get
ASN1_STRING_clear_free
ASN1_STRING_cmp
ASN1_STRING_copy
ASN1_STRING_data
ASN1_STRING_dup
ASN1_STRING_free
ASN1_STRING_get_default_mask
ASN1_STRING_length
ASN1_STRING_length_set
ASN1_STRING_new
ASN1_STRING_print
ASN1_STRING_print_ex
ASN1_STRING_print_ex_fp
ASN1_STRING_set
ASN1_STRING_set0
ASN1_STRING_set_by_NID
ASN1_STRING_set_default_mask
ASN1_STRING_set_default_mask_asc
ASN1_STRING_to_UTF8
ASN1_STRING_type
ASN1_STRING_type_new
ASN1_T61STRING_free
ASN1_T61STRING_it
ASN1_T61STRING_new
ASN1_TBOOLEAN_it
ASN1_TIME_adj
ASN1_TIME_check
ASN1_TIME_diff
ASN1_TIME_free
ASN1_TIME_it
ASN1_TIME_new
ASN1_TIME_print
ASN1_TIME_set
ASN1_TIME_set_string
ASN1_TIME_to_generalizedtime
ASN1_TYPE_cmp
ASN1_TYPE_free
ASN1_TYPE_get
ASN1_TYPE_get_int_octetstring
ASN1_TYPE_get_octetstring
ASN1_TYPE_new
ASN1_TYPE_set
ASN1_TYPE_set1
ASN1_TYPE_set_int_octetstring
ASN1_TYPE_set_octetstring
ASN1_UNIVERSALSTRING_free
ASN1_UNIVERSALSTRING_it
ASN1_UNIVERSALSTRING_new
ASN1_UNIVERSALSTRING_to_string
ASN1_UTCTIME_adj
ASN1_UTCTIME_check
ASN1_UTCTIME_cmp_time_t
ASN1_UTCTIME_free
ASN1_UTCTIME_it
ASN1_UTCTIME_new
ASN1_UTCTIME_print
ASN1_UTCTIME_set
ASN1_UTCTIME_set_string
ASN1_UTF8STRING_free
ASN1_UTF8STRING_it
ASN1_UTF8STRING_new
ASN1_VISIBLESTRING_free
ASN1_VISIBLESTRING_it
ASN1_VISIBLESTRING_new
ASN1_add_oid_module
ASN1_bn_print
ASN1_check_infinite_end
ASN1_const_check_infinite_end
ASN1_d2i_bio
ASN1_d2i_fp
ASN1_digest
ASN1_dup
ASN1_generate_nconf
ASN1_generate_v3
ASN1_get_object
ASN1_i2d_bio
ASN1_i2d_fp
ASN1_item_d2i
ASN1_item_d2i_bio
ASN1_item_d2i_fp
ASN1_item_digest
ASN1_item_dup
ASN1_item_ex_d2i
ASN1_item_ex_free
ASN1_item_ex_i2d
ASN1_item_ex_new
ASN1_item_free
ASN1_item_i2d
ASN1_item_i2d_bio
ASN1_item_i2d_fp
ASN1_item_ndef_i2d
ASN1_item_new
ASN1_item_pack
ASN1_item_print
ASN1_item_sign
ASN1_item_sign_ctx
ASN1_item_unpack
ASN1_item_verify
ASN1_mbstring_copy
ASN1_mbstring_ncopy
ASN1_object_size
ASN1_pack_string
ASN1_parse
ASN1_parse_dump
ASN1_primitive_free
ASN1_primitive_new
ASN1_put_eoc
ASN1_put_object
ASN1_seq_pack
ASN1_seq_unpack
ASN1_sign
ASN1_tag2bit
ASN1_tag2str
ASN1_template_d2i
ASN1_template_free
ASN1_template_i2d
ASN1_template_new
ASN1_unpack_string
ASN1_verify
AUTHORITY_INFO_ACCESS_free
AUTHORITY_INFO_ACCESS_it
AUTHORITY_INFO_ACCESS_new
AUTHORITY_KEYID_free
AUTHORITY_KEYID_it
AUTHORITY_KEYID_new
BASIC_CONSTRAINTS_free
BASIC_CONSTRAINTS_it
BASIC_CONSTRAINTS_new
BF_cbc_encrypt
BF_cfb64_encrypt
BF_decrypt
BF_ecb_encrypt
BF_encrypt
BF_ofb64_encrypt
BF_options
BF_set_key
BIGNUM_it
BIO_accept
BIO_asn1_get_prefix
BIO_asn1_get_suffix
BIO_asn1_set_prefix
BIO_asn1_set_suffix
BIO_callback_ctrl
BIO_clear_flags
BIO_copy_next_retry
BIO_ctrl
BIO_ctrl_get_read_request
BIO_ctrl_get_write_guarantee
BIO_ctrl_pending
BIO_ctrl_reset_read_request
BIO_ctrl_wpending
BIO_debug_callback
BIO_dgram_non_fatal_error
BIO_dump
BIO_dump_cb
BIO_dump_fp
BIO_dump_indent
BIO_dump_indent_cb
BIO_dump_indent_fp
BIO_dup_chain
BIO_f_asn1
BIO_f_base64
BIO_f_buffer
BIO_f_cipher
BIO_f_md
BIO_f_nbio_test
BIO_f_null
BIO_f_reliable
BIO_fd_non_fatal_error
BIO_fd_should_retry
BIO_find_type
BIO_free
BIO_free_all
BIO_get_accept_socket
BIO_get_callback
BIO_get_callback_arg
BIO_get_ex_data
BIO_get_ex_new_index
BIO_get_host_ip
BIO_get_port
BIO_get_retry_BIO
BIO_get_retry_reason
BIO_gethostbyname
BIO_gets
BIO_hex_string
BIO_indent
BIO_int_ctrl
BIO_method_name
BIO_method_type
BIO_new
BIO_new_CMS
BIO_new_NDEF
BIO_new_PKCS7
BIO_new_accept
BIO_new_bio_pair
BIO_new_connect
BIO_new_dgram
BIO_new_fd
BIO_new_file
BIO_new_fp
BIO_new_mem_buf
BIO_new_socket
BIO_next
BIO_nread
BIO_nread0
BIO_number_read
BIO_number_written
BIO_nwrite
BIO_nwrite0
BIO_pop
BIO_printf
BIO_ptr_ctrl
BIO_push
BIO_puts
BIO_read
BIO_s_accept
BIO_s_bio
BIO_s_connect
BIO_s_datagram
BIO_s_fd
BIO_s_file
BIO_s_mem
BIO_s_null
BIO_s_socket
BIO_set
BIO_set_callback
BIO_set_callback_arg
BIO_set_cipher
BIO_set_ex_data
BIO_set_flags
BIO_set_tcp_ndelay
BIO_snprintf
BIO_sock_cleanup
BIO_sock_error
BIO_sock_init
BIO_sock_non_fatal_error
BIO_sock_should_retry
BIO_socket_ioctl
BIO_socket_nbio
BIO_test_flags
BIO_vfree
BIO_vprintf
BIO_vsnprintf
BIO_write
BN_BLINDING_convert
BN_BLINDING_convert_ex
BN_BLINDING_create_param
BN_BLINDING_free
BN_BLINDING_get_flags
BN_BLINDING_get_thread_id
BN_BLINDING_invert
BN_BLINDING_invert_ex
BN_BLINDING_new
BN_BLINDING_set_flags
BN_BLINDING_set_thread_id
BN_BLINDING_thread_id
BN_BLINDING_update
BN_CTX_end
BN_CTX_free
BN_CTX_get
BN_CTX_init
BN_CTX_new
BN_CTX_start
BN_GENCB_call
BN_GF2m_add
BN_GF2m_arr2poly
BN_GF2m_mod
BN_GF2m_mod_arr
BN_GF2m_mod_div
BN_GF2m_mod_div_arr
BN_GF2m_mod_exp
BN_GF2m_mod_exp_arr
BN_GF2m_mod_inv
BN_GF2m_mod_inv_arr
BN_GF2m_mod_mul
BN_GF2m_mod_mul_arr
BN_GF2m_mod_solve_quad
BN_GF2m_mod_solve_quad_arr
BN_GF2m_mod_sqr
BN_GF2m_mod_sqr_arr
BN_GF2m_mod_sqrt
BN_GF2m_mod_sqrt_arr
BN_GF2m_poly2arr
BN_MONT_CTX_copy
BN_MONT_CTX_free
BN_MONT_CTX_init
BN_MONT_CTX_new
BN_MONT_CTX_set
BN_MONT_CTX_set_locked
BN_RECP_CTX_free
BN_RECP_CTX_init
BN_RECP_CTX_new
BN_RECP_CTX_set
BN_X931_derive_prime_ex
BN_X931_generate_Xpq
BN_X931_generate_prime_ex
BN_add
BN_add_word
BN_asc2bn
BN_bin2bn
BN_bn2bin
BN_bn2dec
BN_bn2hex
BN_bn2mpi
BN_bntest_rand
BN_clear
BN_clear_bit
BN_clear_free
BN_cmp
BN_consttime_swap
BN_copy
BN_dec2bn
BN_div
BN_div_recp
BN_div_word
BN_dup
BN_exp
BN_free
BN_from_montgomery
BN_gcd
BN_generate_prime
BN_generate_prime_ex
BN_get0_nist_prime_192
BN_get0_nist_prime_224
BN_get0_nist_prime_256
BN_get0_nist_prime_384
BN_get0_nist_prime_521
BN_get_params
BN_get_word
BN_hex2bn
BN_init
BN_is_bit_set
BN_is_prime
BN_is_prime_ex
BN_is_prime_fasttest
BN_is_prime_fasttest_ex
BN_kronecker
BN_lshift
BN_lshift1
BN_mask_bits
BN_mod_add
BN_mod_add_quick
BN_mod_exp
BN_mod_exp2_mont
BN_mod_exp_mont
BN_mod_exp_mont_consttime
BN_mod_exp_mont_word
BN_mod_exp_recp
BN_mod_exp_simple
BN_mod_inverse
BN_mod_lshift
BN_mod_lshift1
BN_mod_lshift1_quick
BN_mod_lshift_quick
BN_mod_mul
BN_mod_mul_montgomery
BN_mod_mul_reciprocal
BN_mod_sqr
BN_mod_sqrt
BN_mod_sub
BN_mod_sub_quick
BN_mod_word
BN_mpi2bn
BN_mul
BN_mul_word
BN_new
BN_nist_mod_192
BN_nist_mod_224
BN_nist_mod_256
BN_nist_mod_384
BN_nist_mod_521
BN_nnmod
BN_num_bits
BN_num_bits_word
BN_options
BN_print
BN_print_fp
BN_pseudo_rand
BN_pseudo_rand_range
BN_rand
BN_rand_range
BN_reciprocal
BN_rshift
BN_rshift1
BN_set_bit
BN_set_negative
BN_set_params
BN_set_word
BN_sqr
BN_sub
BN_sub_word
BN_swap
BN_to_ASN1_ENUMERATED
BN_to_ASN1_INTEGER
BN_uadd
BN_ucmp
BN_usub
BN_value_one

Sections

.text
Size: 915KB - Virtual size: 914KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 342KB - Virtual size: 341KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/ssleay32.dll
.dll windows:5 windows x86 arch:x86

Password: infected

5d4ca97e613c17181b46764d204584bd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libeay32

ord2572
ord3315
ord2894
ord2927
ord464
ord168
ord2747
ord961
ord167
ord169
ord3844
ord3837
ord3896
ord2201
ord904
ord176
ord282
ord572
ord3165
ord3489
ord1071
ord2925
ord268
ord316
ord363
ord2712
ord4164
ord493
ord4262
ord3719
ord216
ord333
ord4125
ord4470
ord1010
ord4046
ord3682
ord2877
ord3711
ord205
ord486
ord484
ord577
ord763
ord907
ord87
ord3450
ord2107
ord2063
ord283
ord3418
ord481
ord323
ord2915
ord3836
ord3873
ord1096
ord1097
ord3244
ord3874
ord3816
ord3888
ord109
ord2589
ord78
ord95
ord3891
ord89
ord1145
ord1144
ord3906
ord1081
ord2292
ord3823
ord3846
ord187
ord3857
ord267
ord3675
ord3737
ord3633
ord3631
ord3664
ord3479
ord1011
ord341
ord1012
ord503
ord359
ord365
ord4684
ord3192
ord3388
ord3528
ord2568
ord3312
ord3922
ord2898
ord264
ord266
ord3067
ord3313
ord3314
ord4210
ord4701
ord653
ord4692
ord3124
ord3925
ord541
ord2702
ord4372
ord4144
ord4174
ord2400
ord3782
ord1202
ord193
ord3866
ord3704
ord3758
ord3767
ord3647
ord3766
ord3365
ord4114
ord3460
ord3783
ord3454
ord3754
ord3394
ord897
ord3414
ord3495
ord3610
ord67
ord65
ord53
ord98
ord3826
ord3559
ord3899
ord636
ord2257
ord914
ord2478
ord626
ord890
ord1004
ord3527
ord4513
ord364
ord2051
ord206
ord497
ord85
ord58
ord630
ord628
ord1041
ord1007
ord1005
ord4331
ord1027
ord3437
ord629
ord892
ord74
ord248
ord3378
ord1655
ord575
ord1025
ord246
ord1100
ord4693
ord2135
ord622
ord679
ord2524
ord3505
ord3595
ord1023
ord2451
ord623
ord657
ord401
ord93
ord911
ord3396
ord3657
ord857
ord908
ord680
ord1016
ord2204
ord3205
ord624
ord128
ord4045
ord2475
ord368
ord367
ord370
ord369
ord887
ord889
ord891
ord4320
ord4383
ord315
ord1671
ord1147
ord189
ord314
ord956
ord280
ord2181
ord399
ord748
ord279
ord400
ord751
ord750
ord394
ord774
ord1959
ord37
ord35
ord824
ord822
ord8
ord1091
ord3700
ord3623
ord718
ord7
ord716
ord703
ord2426
ord86
ord88
ord3724
ord313
ord1101
ord293
ord3914
ord3807
ord3795
ord4740
ord4731
ord4656
ord4637
ord4615
ord4601
ord2996
ord3155
ord959
ord325
ord329
ord318
ord304
ord292
ord299
ord395
ord955
ord2252
ord91
ord247
ord225
ord129
ord4578
ord4572
ord4576
ord125
ord4570
ord4573
ord4582
ord4575
ord4577
ord4584
ord4580
ord4581
ord276
ord274
ord964
ord965
ord256
ord2784
ord2411
ord754
ord910
ord641
ord912
ord909
ord635
ord52
ord290
ord498
ord219
ord3666
ord4474
ord4369
ord66
ord2206
ord490
ord222
ord3245
ord654
ord967
ord2128
ord281
ord118
ord201
ord123
ord202
ord3663
ord3512
ord3459
ord2924
ord3010
ord2578
ord3644
ord2929
ord3422
ord3513
ord170
ord165
ord4119
ord4245
ord4488
ord32
ord1070
ord4233
ord4430
ord866
ord2630
ord2760
ord4540
ord203
ord3353
ord3729
ord3480
ord3608
ord3550
ord3575
ord3570
ord3695
ord3178
ord188
ord111
ord110
ord151
ord285
ord3239
ord120
ord181
ord3883
ord3109
ord269
ord2936
ord495
ord2821
ord289
ord252
ord1654
ord1653
ord905
ord3399
ord903

kernel32

CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CloseHandle
HeapSize
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LoadLibraryA
VirtualAlloc
HeapReAlloc
HeapAlloc
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
WriteFile
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
ExitProcess
GetProcAddress
GetModuleHandleW
HeapFree
Sleep
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsDebuggerPresent
GetCurrentProcess
TerminateProcess
GetCommandLineA
GetCurrentThreadId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
GetLastError
GetSystemTime
SystemTimeToFileTime
SetLastError

Exports

Exports

BIO_f_ssl
BIO_new_buffer_ssl_connect
BIO_new_ssl
BIO_new_ssl_connect
BIO_ssl_copy_session_id
BIO_ssl_shutdown
DTLS_client_method
DTLS_method
DTLS_server_method
DTLSv1_2_client_method
DTLSv1_2_method
DTLSv1_2_server_method
DTLSv1_client_method
DTLSv1_method
DTLSv1_server_method
ERR_load_SSL_strings
PEM_read_SSL_SESSION
PEM_read_bio_SSL_SESSION
PEM_write_SSL_SESSION
PEM_write_bio_SSL_SESSION
SRP_Calc_A_param
SRP_generate_client_master_secret
SRP_generate_server_master_secret
SSL_CIPHER_description
SSL_CIPHER_find
SSL_CIPHER_get_bits
SSL_CIPHER_get_id
SSL_CIPHER_get_name
SSL_CIPHER_get_version
SSL_COMP_add_compression_method
SSL_COMP_free_compression_methods
SSL_COMP_get_compression_methods
SSL_COMP_get_name
SSL_COMP_set0_compression_methods
SSL_CONF_CTX_clear_flags
SSL_CONF_CTX_finish
SSL_CONF_CTX_free
SSL_CONF_CTX_new
SSL_CONF_CTX_set1_prefix
SSL_CONF_CTX_set_flags
SSL_CONF_CTX_set_ssl
SSL_CONF_CTX_set_ssl_ctx
SSL_CONF_cmd
SSL_CONF_cmd_argv
SSL_CONF_cmd_value_type
SSL_CTX_SRP_CTX_free
SSL_CTX_SRP_CTX_init
SSL_CTX_add_client_CA
SSL_CTX_add_client_custom_ext
SSL_CTX_add_server_custom_ext
SSL_CTX_add_session
SSL_CTX_callback_ctrl
SSL_CTX_check_private_key
SSL_CTX_ctrl
SSL_CTX_flush_sessions
SSL_CTX_free
SSL_CTX_get0_certificate
SSL_CTX_get0_param
SSL_CTX_get0_privatekey
SSL_CTX_get_cert_store
SSL_CTX_get_client_CA_list
SSL_CTX_get_client_cert_cb
SSL_CTX_get_ex_data
SSL_CTX_get_ex_new_index
SSL_CTX_get_info_callback
SSL_CTX_get_quiet_shutdown
SSL_CTX_get_ssl_method
SSL_CTX_get_timeout
SSL_CTX_get_verify_callback
SSL_CTX_get_verify_depth
SSL_CTX_get_verify_mode
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_remove_session
SSL_CTX_sess_get_get_cb
SSL_CTX_sess_get_new_cb
SSL_CTX_sess_get_remove_cb
SSL_CTX_sess_set_get_cb
SSL_CTX_sess_set_new_cb
SSL_CTX_sess_set_remove_cb
SSL_CTX_sessions
SSL_CTX_set1_param
SSL_CTX_set_alpn_protos
SSL_CTX_set_alpn_select_cb
SSL_CTX_set_cert_cb
SSL_CTX_set_cert_store
SSL_CTX_set_cert_verify_callback
SSL_CTX_set_cipher_list
SSL_CTX_set_client_CA_list
SSL_CTX_set_client_cert_cb
SSL_CTX_set_client_cert_engine
SSL_CTX_set_cookie_generate_cb
SSL_CTX_set_cookie_verify_cb
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_verify_paths
SSL_CTX_set_ex_data
SSL_CTX_set_generate_session_id
SSL_CTX_set_info_callback
SSL_CTX_set_msg_callback
SSL_CTX_set_next_proto_select_cb
SSL_CTX_set_next_protos_advertised_cb
SSL_CTX_set_psk_client_callback
SSL_CTX_set_psk_server_callback
SSL_CTX_set_purpose
SSL_CTX_set_quiet_shutdown
SSL_CTX_set_session_id_context
SSL_CTX_set_srp_cb_arg
SSL_CTX_set_srp_client_pwd_callback
SSL_CTX_set_srp_password
SSL_CTX_set_srp_strength
SSL_CTX_set_srp_username
SSL_CTX_set_srp_username_callback
SSL_CTX_set_srp_verify_param_callback
SSL_CTX_set_ssl_version
SSL_CTX_set_timeout
SSL_CTX_set_tlsext_use_srtp
SSL_CTX_set_tmp_dh_callback
SSL_CTX_set_tmp_ecdh_callback
SSL_CTX_set_tmp_rsa_callback
SSL_CTX_set_trust
SSL_CTX_set_verify
SSL_CTX_set_verify_depth
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_ASN1
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_RSAPrivateKey_ASN1
SSL_CTX_use_RSAPrivateKey_file
SSL_CTX_use_certificate
SSL_CTX_use_certificate_ASN1
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_CTX_use_psk_identity_hint
SSL_CTX_use_serverinfo
SSL_CTX_use_serverinfo_file
SSL_SESSION_free
SSL_SESSION_get0_peer
SSL_SESSION_get_compress_id
SSL_SESSION_get_ex_data
SSL_SESSION_get_ex_new_index
SSL_SESSION_get_id
SSL_SESSION_get_time
SSL_SESSION_get_timeout
SSL_SESSION_new
SSL_SESSION_print
SSL_SESSION_print_fp
SSL_SESSION_set1_id_context
SSL_SESSION_set_ex_data
SSL_SESSION_set_time
SSL_SESSION_set_timeout
SSL_SRP_CTX_free
SSL_SRP_CTX_init
SSL_accept
SSL_add_client_CA
SSL_add_dir_cert_subjects_to_stack
SSL_add_file_cert_subjects_to_stack
SSL_alert_desc_string
SSL_alert_desc_string_long
SSL_alert_type_string
SSL_alert_type_string_long
SSL_cache_hit
SSL_callback_ctrl
SSL_certs_clear
SSL_check_chain
SSL_check_private_key
SSL_clear
SSL_connect
SSL_copy_session_id
SSL_ctrl
SSL_do_handshake
SSL_dup
SSL_dup_CA_list
SSL_export_keying_material
SSL_extension_supported
SSL_free
SSL_get0_alpn_selected
SSL_get0_next_proto_negotiated
SSL_get0_param
SSL_get1_session
SSL_get_SSL_CTX
SSL_get_certificate
SSL_get_cipher_list
SSL_get_ciphers
SSL_get_client_CA_list
SSL_get_current_cipher
SSL_get_current_compression
SSL_get_current_expansion
SSL_get_default_timeout
SSL_get_error
SSL_get_ex_data
SSL_get_ex_data_X509_STORE_CTX_idx
SSL_get_ex_new_index
SSL_get_fd
SSL_get_finished
SSL_get_info_callback
SSL_get_peer_cert_chain
SSL_get_peer_certificate
SSL_get_peer_finished
SSL_get_privatekey
SSL_get_psk_identity
SSL_get_psk_identity_hint
SSL_get_quiet_shutdown
SSL_get_rbio
SSL_get_read_ahead
SSL_get_rfd
SSL_get_selected_srtp_profile
SSL_get_servername
SSL_get_servername_type
SSL_get_session
SSL_get_shared_ciphers
SSL_get_shared_sigalgs
SSL_get_shutdown
SSL_get_sigalgs
SSL_get_srp_N
SSL_get_srp_g
SSL_get_srp_userinfo
SSL_get_srp_username
SSL_get_srtp_profiles
SSL_get_ssl_method
SSL_get_verify_callback
SSL_get_verify_depth
SSL_get_verify_mode
SSL_get_verify_result
SSL_get_version
SSL_get_wbio
SSL_get_wfd
SSL_has_matching_session_id
SSL_is_server
SSL_library_init
SSL_load_client_CA_file
SSL_load_error_strings
SSL_new
SSL_peek
SSL_pending
SSL_read
SSL_renegotiate
SSL_renegotiate_abbreviated
SSL_renegotiate_pending
SSL_rstate_string
SSL_rstate_string_long
SSL_select_next_proto
SSL_set1_param
SSL_set_SSL_CTX
SSL_set_accept_state
SSL_set_alpn_protos
SSL_set_bio
SSL_set_cert_cb
SSL_set_cipher_list
SSL_set_client_CA_list
SSL_set_connect_state
SSL_set_debug
SSL_set_ex_data
SSL_set_fd
SSL_set_generate_session_id
SSL_set_info_callback
SSL_set_msg_callback
SSL_set_psk_client_callback
SSL_set_psk_server_callback
SSL_set_purpose
SSL_set_quiet_shutdown
SSL_set_read_ahead
SSL_set_rfd
SSL_set_session
SSL_set_session_id_context
SSL_set_session_secret_cb
SSL_set_session_ticket_ext
SSL_set_session_ticket_ext_cb
SSL_set_shutdown
SSL_set_srp_server_param
SSL_set_srp_server_param_pw
SSL_set_ssl_method
SSL_set_state
SSL_set_tlsext_use_srtp
SSL_set_tmp_dh_callback
SSL_set_tmp_ecdh_callback
SSL_set_tmp_rsa_callback
SSL_set_trust
SSL_set_verify
SSL_set_verify_depth
SSL_set_verify_result
SSL_set_wfd
SSL_shutdown
SSL_srp_server_param_with_username
SSL_state
SSL_state_string
SSL_state_string_long
SSL_use_PrivateKey
SSL_use_PrivateKey_ASN1
SSL_use_PrivateKey_file
SSL_use_RSAPrivateKey
SSL_use_RSAPrivateKey_ASN1
SSL_use_RSAPrivateKey_file
SSL_use_certificate
SSL_use_certificate_ASN1
SSL_use_certificate_file
SSL_use_psk_identity_hint
SSL_version
SSL_want
SSL_write
SSLv23_client_method
SSLv23_method
SSLv23_server_method
SSLv2_client_method
SSLv2_method
SSLv2_server_method
SSLv3_client_method
SSLv3_method
SSLv3_server_method
TLSv1_1_client_method
TLSv1_1_method
TLSv1_1_server_method
TLSv1_2_client_method
TLSv1_2_method
TLSv1_2_server_method
TLSv1_client_method
TLSv1_method
TLSv1_server_method
d2i_SSL_SESSION
i2d_SSL_SESSION
ssl3_ciphers

Sections

.text
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/vfluapriv.dll
.dll windows:10 windows x64 arch:x64

Password: infected

f662a5745cd287aa861d89b58ac332e2

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:07

Not After

08/08/2019, 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:97:de:db:83:e6:57:3c:5f:b0:58:74:eb:cf:4c:7b:6f:5e:dc:5a:2f:5c:24:ec:7d:11:f3:89:e9:7b:bc:43
Signer

Actual PE Digest

2c:97:de:db:83:e6:57:3c:5f:b0:58:74:eb:cf:4c:7b:6f:5e:dc:5a:2f:5c:24:ec:7d:11:f3:89:e9:7b:bc:43

Digest Algorithm

sha256

PE Digest Matches

true

4f:01:35:6a:f0:67:a8:a0:03:f2:c0:fc:85:1f:7b:e3:c9:4f:e1:e3
Signer

Actual PE Digest

4f:01:35:6a:f0:67:a8:a0:03:f2:c0:fc:85:1f:7b:e3:c9:4f:e1:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetLongPathNameW
GetFullPathNameW
SetLastError
LoadLibraryExW
VirtualQuery
FreeLibrary
SetFilePointerEx
FindResourceW
GetFileAttributesW
LocalAlloc
FindResourceExW
CloseHandle
HeapCreate
InitializeCriticalSection
HeapFree
GetModuleFileNameW
GetShortPathNameW
GetVersionExW
LoadResource
HeapReAlloc
HeapAlloc
GetLastError
CreateFileW
GetCurrentProcess
EnumResourceNamesW
SetFilePointer
GetFileSizeEx
GetCurrentThread
SizeofResource
LocalFree
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetProcessId
WaitForSingleObject
OpenEventW
ReleaseMutex
OpenFileMappingW
SetEvent
ResetEvent
MapViewOfFile
OpenMutexW
CreateActCtxW
QueryActCtxW
LoadLibraryW
GetProcAddress
ReleaseActCtx
MultiByteToWideChar
WideCharToMultiByte
FlushFileBuffers
ReadFile
GetModuleHandleW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetCommandLineA
FlsSetValue
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringA
EncodePointer
DecodePointer
FlsAlloc
FlsGetValue
FlsFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
HeapDestroy
HeapSetInformation
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
LCMapStringW
GetStringTypeW
Sleep
WriteFile
GetConsoleCP
GetConsoleMode
CompareStringW
SetEnvironmentVariableW
LoadLibraryExA
SetThreadStackGuarantee
GetSystemInfo
VirtualAlloc
VirtualProtect
SetStdHandle
WriteConsoleW
HeapSize
DelayLoadFailureHook

advapi32

GetSecurityDescriptorOwner
LookupPrivilegeDisplayNameW
OpenProcessToken
GetLengthSid
OpenThreadToken
GetTokenInformation
CloseServiceHandle
EqualSid
ConvertSidToStringSidW
LookupAccountSidW
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
ConvertSecurityDescriptorToStringSecurityDescriptorA
GetSecurityDescriptorDacl
GetSecurityInfo
RegQueryValueExW
AccessCheck
GetSecurityDescriptorLength
GetAce
GetSidSubAuthorityCount
GetSidSubAuthority
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
LookupPrivilegeNameW
RegEnumKeyExW
IsValidSid
RegOpenCurrentUser
RegCloseKey
MapGenericMask
InitializeSecurityDescriptor

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

GetModuleBaseNameW

ntdll

NtQueryObject
DbgPrint
RtlInitializeSid
RtlSubAuthoritySid
RtlLengthRequiredSid
RtlFreeHeap
RtlAllocateHeap

vrfcore

VerifierGetRecursionTlsSlot
VerifierStopMessageEx
VerifierRegisterLayer
VerifierIsLayerEnabled
VerifierUnregisterLayer
VerifierTlsGetValue
VerifierTlsSetValue
VerifierRegisterProvider

Sections

.text
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/vfnet.dll
.dll windows:10 windows x64 arch:x64

5397dc1a473e1f8f0585f089032bc5fc

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:07

Not After

08/08/2019, 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

34:3c:c7:b8:84:41:31:8b:b6:b9:27:5b:33:fa:f9:d1:b1:3f:a1:f0:dc:ce:be:80:eb:ad:11:ba:a3:58:27:ef
Signer

Actual PE Digest

34:3c:c7:b8:84:41:31:8b:b6:b9:27:5b:33:fa:f9:d1:b1:3f:a1:f0:dc:ce:be:80:eb:ad:11:ba:a3:58:27:ef

Digest Algorithm

sha256

PE Digest Matches

true

71:ce:bc:15:6f:e3:e1:4b:0c:f6:ca:56:00:8d:70:92:b2:6f:cb:3c
Signer

Actual PE Digest

71:ce:bc:15:6f:e3:e1:4b:0c:f6:ca:56:00:8d:70:92:b2:6f:cb:3c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

RtlFreeHeap
RtlLeaveCriticalSection
RtlCreateHeap
RtlSetLastWin32Error
RtlRaiseException
RtlEnterCriticalSection
NtTerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
RtlGetVersion
RtlCaptureStackBackTrace
RtlInitializeCriticalSectionAndSpinCount
_wcsicmp
RtlAllocateHeap
RtlDeleteCriticalSection
memset

kernel32

FreeLibrary
GetProcAddress
LoadLibraryW
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection

vrfcore

VerifierRegisterLayer
VerifierIsLayerEnabled
VerifierStopMessageEx
VerifierGetAppCallerAddress
VerifierIsDllEntryActive
VerifierUnregisterLayer
VerifierRegisterProvider

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/vfntlmless.dll
.dll windows:10 windows x64 arch:x64

f1956ea6c9757cb4ab16245e384c7442

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:07

Not After

08/08/2019, 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:89:16:44:13:0c:7a:bf:26:01:24:b7:35:83:4f:31:c8:4a:bd:c7:0c:3a:57:ad:8e:62:e2:85:40:8b:90:2a
Signer

Actual PE Digest

eb:89:16:44:13:0c:7a:bf:26:01:24:b7:35:83:4f:31:c8:4a:bd:c7:0c:3a:57:ad:8e:62:e2:85:40:8b:90:2a

Digest Algorithm

sha256

PE Digest Matches

true

cd:fc:5d:98:a7:2f:03:f5:35:ed:0a:5d:c2:0a:a3:7f:87:30:0b:bd
Signer

Actual PE Digest

cd:fc:5d:98:a7:2f:03:f5:35:ed:0a:5d:c2:0a:a3:7f:87:30:0b:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

RtlDeleteCriticalSection
RtlInitializeCriticalSection
_wcsicmp
RtlEnterCriticalSection
_stricmp
RtlLeaveCriticalSection
wcschr
_wcsnicmp
_strnicmp
strchr
RtlAllocateHeap
RtlFreeHeap
NtTerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
memcpy
memset

vrfcore

VerifierUnregisterLayer
VerifierStopMessageEx
VerifierIsLayerEnabled
VerifierRegisterLayer
VerifierRegisterProvider

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/vfnws.dll
.dll windows:10 windows x64 arch:x64

6d0497bd389fa0a8bc514bb8246f4abe

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:07

Not After

08/08/2019, 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:9b:ba:ee:ee:a6:3a:77:41:7c:fc:4d:24:e4:7c:9b:ec:1b:74:3f:75:99:4e:f1:a9:21:6d:7d:c0:cc:de:42
Signer

Actual PE Digest

bd:9b:ba:ee:ee:a6:3a:77:41:7c:fc:4d:24:e4:7c:9b:ec:1b:74:3f:75:99:4e:f1:a9:21:6d:7d:c0:cc:de:42

Digest Algorithm

sha256

PE Digest Matches

true

77:94:71:5d:8f:11:d3:21:23:05:45:0e:f7:73:bb:20:f1:39:2b:b6
Signer

Actual PE Digest

77:94:71:5d:8f:11:d3:21:23:05:45:0e:f7:73:bb:20:f1:39:2b:b6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtTerminateProcess
DbgPrint
RtlCaptureStackBackTrace
__C_specific_handler
memset

kernel32

InitializeCriticalSection
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
HeapDestroy
HeapSetInformation
LoadLibraryW
HeapReAlloc
GetLastError
HeapFree
EnterCriticalSection
LeaveCriticalSection
CreateEventW
SetEvent
WaitForSingleObjectEx
CloseHandle
HeapAlloc
GetTickCount
HeapCreate
GetCurrentProcess
Sleep
GetCurrentThreadId
FreeLibrary

vrfcore

VerifierIsLayerEnabled
VerifierUnregisterLayer
VerifierStopMessageEx
VerifierRegisterLayer
VerifierRegisterProvider

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/vfprint.dll
.dll windows:10 windows x64 arch:x64

078686015c445a818a21364619b248d1

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:07

Not After

08/08/2019, 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d2:ca:4e:43:7f:23:62:9a:e6:06:e3:22:18:ae:ac:61:7e:6a:4c:30:4c:b6:37:8a:e5:09:0c:54:9b:5c:27:af
Signer

Actual PE Digest

d2:ca:4e:43:7f:23:62:9a:e6:06:e3:22:18:ae:ac:61:7e:6a:4c:30:4c:b6:37:8a:e5:09:0c:54:9b:5c:27:af

Digest Algorithm

sha256

PE Digest Matches

true

ea:d0:bb:32:ed:e6:2e:43:7a:4a:c1:6a:2f:b0:2f:a4:9d:30:23:3a
Signer

Actual PE Digest

ea:d0:bb:32:ed:e6:2e:43:7a:4a:c1:6a:2f:b0:2f:a4:9d:30:23:3a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlDeleteCriticalSection
DbgPrint
memcmp
RtlCaptureContext
NtTerminateProcess
LdrDisableThreadCalloutsForDll
NtQueryPerformanceCounter
RtlRandom
wcsrchr
RtlGetVersion
RtlNormalizeProcessParams
_wcsicmp
RtlRaiseException
RtlInitializeCriticalSectionAndSpinCount
RtlCaptureStackBackTrace
memcpy
NtCompareTokens
_stricmp
NtQueryInformationProcess
NtQuerySystemInformation
memset

kernel32

RemoveVectoredExceptionHandler
GetCurrentThread
CloseHandle
LoadLibraryExW
ProcessIdToSessionId
GetCurrentProcessId
VirtualProtect
LoadLibraryExA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
RaiseException
GetSystemInfo
GetProcessHeap
GetModuleHandleExW
TerminateProcess
AddVectoredExceptionHandler
VirtualQuery
TlsFree
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
DebugBreak
GetTickCount
SetLastError
GetLastError
TlsSetValue
SetFilePointer
HeapAlloc
TlsGetValue
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
HeapCreate
GetCurrentProcess
TlsAlloc
HeapDestroy
GetModuleHandleW
ReadProcessMemory

vrfcore

VerifierTlsGetValue
VerifierAreStaticDllsInitialized
VerifierTlsSetValue
VerifierEnableFaultInjectionTargetRange
VerifierSetAPIClassName
VerifierSetFaultInjectionProbability
VerifierRegisterFaultInjectProvider
VerifierGetRecursionTlsSlot
VerifierShouldFaultInject
VerifierGetAppCallerAddress
VerifierUnregisterLayer
VerifierIsLayerEnabled
VerifierRegisterLayer
VerifierRegisterProvider
VerifierStopMessageEx
VerifierIsDllEntryActive

Exports

Exports

CreateFilterTestHook
GetAccessViolationsCount
GetInvalidHandleExceptionCount
GetPrinterHandleCount
PrintVerifierCreatePluginInterfaceWrapper
PrintVerifierIsLayerEnabled

Sections

.text
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/wersvc.dll
.dll windows:10 windows x64 arch:x64

8ea7bbb362f807fd5f04d89335411e9e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_lock
__C_specific_handler
_initterm
malloc
??1type_info@@UEAA@XZ
_unlock
_XcptFilter
_onexit
_scwprintf
_callnewh
?terminate@@YAXXZ
free
_amsg_exit
_vsnprintf_s
__dllonexit
??0exception@@QEAA@AEBV0@@Z
__CxxFrameHandler3
??0exception@@QEAA@XZ
_CxxThrowException
??1exception@@UEAA@XZ
_purecall
memcmp
memcpy_s
_vsnprintf
memcpy
_vsnwprintf
memmove
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadLibraryExW
GetModuleFileNameA
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
GetProcAddress
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

SetEvent
ResetEvent
ReleaseSRWLockExclusive
CreateMutexW
OpenSemaphoreW
CreateMutexExW
WaitForSingleObjectEx
OpenEventW
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
LeaveCriticalSection
CreateEventW
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
EnterCriticalSection
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSectionEx
CreateSemaphoreExW
WaitForMultipleObjectsEx

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

CreateThread
CreateProcessW
GetThreadId
TerminateProcess
GetCurrentProcess
GetExitCodeProcess
OpenThreadToken
GetProcessId
OpenThread
GetCurrentProcessId
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CreateProcessAsUserW
GetCurrentThreadId
OpenProcessToken
DeleteProcThreadAttributeList
GetProcessTimes
ProcessIdToSessionId
ResumeThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
EventProviderEnabled

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW
GetSystemWow64Directory2W
IsWow64Process2

ntdll

RtlIdentifierAuthoritySid
EtwCheckCoverage
RtlSetThreadErrorMode
vDbgPrintExWithPrefix
NtAlpcCancelMessage
NtQueryInformationToken
RtlGUIDFromString
RtlNtStatusToDosError
NtQuerySystemInformation
NtCreateFile
wcstoul
wcsspn
memmove_s
towlower
wcstol
wcsrchr
RtlSubAuthorityCountSid
NtSetSystemInformation
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
NtTerminateProcess
NtAlpcAcceptConnectPort
NtClose
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
NtAlpcCreatePort
RtlDeleteBoundaryDescriptor
RtlAddSIDToBoundaryDescriptor
RtlCreateServiceSid
RtlCreateBoundaryDescriptor
NtOpenEvent
RtlInitUnicodeString
NtQueryInformationProcess
NtAlpcOpenSenderThread
NtAlpcOpenSenderProcess
toupper
wcschr
iswspace
_wcsicmp
_wcsnicmp
_vscwprintf
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlFreeHeap
NtDuplicateToken
NtSetInformationProcess
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
RtlSecondsSince1970ToTime
swprintf_s
wcscpy_s
wcscat_s
wcsncpy_s
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
RtlQueryResourcePolicy

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-base-l1-1-0

GetTokenInformation
ImpersonateLoggedOnUser
RevertToSelf
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateWellKnownSid
GetSidSubAuthorityCount
GetSidSubAuthority
AllocateAndInitializeSid
SetTokenInformation
DuplicateTokenEx
CreateRestrictedToken
DuplicateToken
FreeSid
CheckTokenMembership

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
ReadProcessMemory

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolCleanupGroup
LeaveCriticalSectionWhenCallbackReturns
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolCleanupGroup
SetThreadpoolWait
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-namespace-l1-1-0

ClosePrivateNamespace
OpenPrivateNamespaceW
CreatePrivateNamespaceW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-file-l1-1-0

ReadFile
WriteFile
SetFilePointerEx
GetFinalPathNameByHandleW
GetFileSizeEx
GetFileAttributesW
CreateDirectoryW
GetLongPathNameW
SetFileInformationByHandle
CreateFileW
GetTempFileNameW
FindFirstFileW
FindNextFileW
FindClose

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW
K32GetModuleFileNameExW

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

rpcrt4

UuidFromStringW
UuidCreate

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-processsnapshot-l1-1-0

PssDuplicateSnapshot
PssCaptureSnapshot

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-path-l1-1-0

PathCchRemoveBackslash
PathCchRemoveFileSpec

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

windowsperformancerecordercontrol

WPRCReleaseInstanceByName
WPRCCreateInstanceUnderInstanceName
WPRCDisableBuiltinProfiles

api-ms-win-core-file-l2-1-0

CopyFileExW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

weretw

WerMergeEtlEx

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/werui.dll
.dll windows:10 windows x64 arch:x64

600f604125e1820f1c2db1735c5b4db1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcmp
memcpy
_lock
__C_specific_handler
??1type_info@@UEAA@XZ
_unlock
_XcptFilter
_initterm
malloc
__dllonexit
_onexit
memmove
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
?terminate@@YAXXZ
_callnewh
toupper
_CxxThrowException
??0exception@@QEAA@XZ
__CxxFrameHandler3
_purecall
memcpy_s
free
_amsg_exit
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
FreeLibraryAndExitThread
GetProcAddress
LoadLibraryExW
FreeLibrary

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

CreateProcessW
CreateThread
GetProcessId
GetExitCodeThread
OpenProcessToken
GetProcessTimes
OpenThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

ntdll

ZwQueryWnfStateNameInformation
ZwUpdateWnfStateData
EtwEventWriteNoRegistration
NtWaitForSingleObject
RtlAllocateAndInitializeSid
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
RtlFreeSid
NtQuerySystemInformation
NtClose
RtlNtStatusToDosError
NtOpenEvent
memmove_s
_vsnprintf_s
_vscwprintf
NtQueryLicenseValue
NtQueryInformationToken
RtlInitUnicodeString
_wcsnicmp
_vsnwprintf
_wtoi
_wcsicmp
NtSuspendProcess
NtResumeProcess
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids

wer

WerpGetReportSettings
WerReportCloseHandle
WerReportCreate
WerReportSetUIOption
WerpGetReportInformation
WerpIsTransportAvailable
WerpSetReportFlags
WerpGetFileByIndex
WerpGetNumFiles
WerpGetReportFlags
WerpGetUIParamByIndex
WerpIsDisabled
WerpGetNumSigParams
WerpGetEventType
WerpGetSigParamByIndex
WerpGetDynamicParameter
WerpGetReportType

comctl32

ord412
ord345
ord410
ord413

dbghelp

SymInitialize
StackWalk64
SymGetModuleInfoW64
SymFunctionTableAccess64
SymCleanup
MiniDumpWriteDump
SymGetModuleBase64

shell32

Shell_NotifyIconW
ShellExecuteExW
SHCreateDirectoryExW
ExtractIconExW

dui70

??1CritSecLock@DirectUI@@QEAA@XZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
??0ClassInfoBase@DirectUI@@QEAA@XZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
??0CCBase@DirectUI@@QEAA@KPEBG@Z
??1CCBase@DirectUI@@UEAA@XZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?DirectionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnInput@CCBase@DirectUI@@UEAAXPEAUInputEvent@2@@Z
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
?Register@CCBase@DirectUI@@SAJXZ
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?SetFontSize@Element@DirectUI@@QEAAJH@Z
?SetWidth@Element@DirectUI@@QEAAJH@Z
?SetHeight@Element@DirectUI@@QEAAJH@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?DefaultAction@CCBase@DirectUI@@UEAAJXZ
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
CreateDUIWrapper
UnInitThread
UnInitProcessPriv
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
?OnNotify@CCBase@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
InitProcessPriv
InitThread
??1ClassInfoBase@DirectUI@@UEAA@XZ
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?GetClassInfoPtr@CCBase@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?Initialize@CCBase@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
?PostCreate@CCBase@DirectUI@@MEAAXPEAUHWND__@@@Z
?OnReceivedDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
?OnLostDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
?OnCustomDraw@CCBase@DirectUI@@UEAA_NPEAUtagNMCUSTOMDRAWINFO@@PEA_J@Z
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z
?CreateAccNameLabel@HWNDHost@DirectUI@@IEAAPEAUHWND__@@PEAU3@@Z
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z

user32

GetWindowThreadProcessId
GetWindowInfo
IsWindowVisible
GetWindowRect
EnumWindows
ChangeDisplaySettingsW
FindWindowW
ShowWindow
DrawAnimatedRects
SetForegroundWindow
GetWindow
GetWindowLongW
SetWindowPos
SendMessageW
GetClassNameW
SetParent
IsWindow
GetWindowBand
MonitorFromRect
GetMonitorInfoW
CheckWindowThreadDesktop
RegisterWindowMessageW
FindWindowExW
ChangeWindowMessageFilter
GetCursorPos
DispatchMessageW
LoadMenuW
GetSubMenu
SetMenuDefaultItem
TrackPopupMenuEx
DestroyMenu
LoadIconW
EndDialog
FlashWindowEx
TranslateMessage
SetWindowLongW
PostMessageW
DestroyIcon
EnableMenuItem
GetWindowTextLengthW
GetSysColor
LoadStringW
SetWindowLongPtrW
GetWindowLongPtrW
DefWindowProcW
RegisterClassExW
CreateWindowExW
GetMessageW
IsHungAppWindow

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
CreateActCtxW
ReleaseActCtx
ActivateActCtx

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-console-l1-2-0

FreeConsole
AttachConsole

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-synch-l1-1-0

SetEvent
AcquireSRWLockShared
EnterCriticalSection
CreateEventW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForMultipleObjectsEx
CreateSemaphoreExW
ReleaseSRWLockShared
LeaveCriticalSection
ReleaseMutex
CreateMutexExW
InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSemaphore
WaitForSingleObject
ResetEvent

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-localization-l1-2-0

GetThreadUILanguage
FormatMessageW

api-ms-win-core-file-l1-1-0

CreateFileW
FindFirstFileExW
SetFileInformationByHandle
FindClose
FindNextFileW
GetFileAttributesW
GetFinalPathNameByHandleW
CompareFileTime
FindFirstFileW

api-ms-win-security-base-l1-1-0

GetSidSubAuthorityCount
GetTokenInformation
CopySid
GetLengthSid
IsValidSid
GetSidSubAuthority

api-ms-win-core-processthreads-l1-1-1

GetThreadContext
OpenProcess

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegGetValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-heap-l2-1-0

LocalAlloc

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
ReportEventW
RegisterEventSourceW

Exports

Exports

WerUICreate
WerUIDelete
WerUIGetUserSelection
WerUIPromptForSecondLevel
WerUIPromptUser
WerUIReportSilentProcessExit
WerUIShowUpsell
WerUIStart
WerUITerminate
WerUIUpdateStateProgress
WerUIUpdateUIForState
WerUIWaitForUserAction
WerUIpCheckWindow
WerUIpDefSubclassProc
WerUIpHeadlessOrImersive
WerUIpRemoveWindowSubclass
WerUIpSetWindowSubclass
WerUIpTaskDialogIndirect
WerUIpUIHandleWERWindowMsg

Sections

.text
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/wevtapi.dll
.dll windows:10 windows x64 arch:x64

3df6efe26236bc1b0d866e5bcceeb49c

Code Sign

33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:4c:1f:dd:eb:0d:75:85:a4:90:e2:f0:23:b2:ce:27:c6:96:0d:87:42:be:78:5a:62:8b:1e:c2:d1:9a:a3:c2
Signer

Actual PE Digest

3d:4c:1f:dd:eb:0d:75:85:a4:90:e2:f0:23:b2:ce:27:c6:96:0d:87:42:be:78:5a:62:8b:1e:c2:d1:9a:a3:c2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcp_win

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__ui64tow_s
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
_o__wcstoi64
_o__wcstoui64
_o__wtof
_o__wtoi
_o__wtoi64
_o__wtol
_o_free
_o_iswalnum
_o_iswalpha
_o_iswdigit
_o_iswspace
_o_strncpy_s
_o_terminate
_o_toupper
_o_wcscpy_s
_o_wcsncpy_s
__C_specific_handler
_o__cexit
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
_o__crt_atexit
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcsnlen
wcscmp
memset
strnlen

ntdll

EtwGetTraceEnableFlags
RtlCaptureContext
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwTraceMessage
RtlLookupFunctionEntry
RtlSetLastWin32Error
RtlNtStatusToDosError
NtSetInformationFile
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlComputeCrc32
NtWriteFile
NtReadFile
EtwUnregisterTraceGuids
RtlVirtualUnwind

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-synch-l1-1-0

ResetEvent
ReleaseSRWLockShared
AcquireSRWLockExclusive
SetEvent
CreateMutexExW
CreateSemaphoreExW
CreateEventW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
ReleaseMutex
WaitForSingleObjectEx
ReleaseSRWLockExclusive
ReleaseSemaphore
AcquireSRWLockShared
OpenSemaphoreW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetThreadLocale
GetThreadUILanguage
GetLocaleInfoW

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventSetInformation
EventRegister

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

ReadFile
FlushFileBuffers
GetFileAttributesW
GetFullPathNameW
SetFilePointerEx
GetTempFileNameW
GetFileSizeEx
GetDiskFreeSpaceExW
SetEndOfFile
DeleteFileW
GetFileInformationByHandle
CreateFileW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TlsAlloc
TlsFree
TerminateProcess
TlsSetValue
TlsGetValue
GetCurrentProcess

api-ms-win-security-base-l1-1-0

IsValidSid
GetLengthSid

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolCleanupGroup
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolCleanupGroup
CreateThreadpoolWork
SetThreadpoolWait
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolTimer
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns
CloseThreadpoolWork

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
FreeLibrary
GetModuleHandleW
GetModuleFileNameA

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

EvtArchiveExportedLog
EvtCancel
EvtClearLog
EvtClose
EvtCreateBookmark
EvtCreateRenderContext
EvtExportLog
EvtFormatMessage
EvtGetChannelConfigProperty
EvtGetEventInfo
EvtGetEventMetadataProperty
EvtGetExtendedStatus
EvtGetLogInfo
EvtGetObjectArrayProperty
EvtGetObjectArraySize
EvtGetPublisherMetadataProperty
EvtGetQueryInfo
EvtIntAssertConfig
EvtIntCreateBinXMLFromCustomXML
EvtIntCreateLocalLogfile
EvtIntGetClassicLogDisplayName
EvtIntRenderResourceEventTemplate
EvtIntReportAuthzEventAndSourceAsync
EvtIntReportEventAndSourceAsync
EvtIntRetractConfig
EvtIntSysprepCleanup
EvtIntWriteXmlEventToLocalLogfile
EvtNext
EvtNextChannelPath
EvtNextEventMetadata
EvtNextPublisherId
EvtOpenChannelConfig
EvtOpenChannelEnum
EvtOpenEventMetadataEnum
EvtOpenLog
EvtOpenPublisherEnum
EvtOpenPublisherMetadata
EvtOpenSession
EvtQuery
EvtRender
EvtSaveChannelConfig
EvtSeek
EvtSetChannelConfigProperty
EvtSubscribe
EvtUpdateBookmark

Sections

.text
Size: 290KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/wevtfwd.dll
.dll windows:10 windows x64 arch:x64

e9b76d35f59e84b8ed8b0b52e612c06c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_vsnwprintf
memset
??1type_info@@UEAA@XZ
_onexit
swprintf_s
_wcstoui64
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
wcsncpy_s
_wcsnicmp
iswspace
_wcsicmp
malloc
free
_purecall
_unlock
__CxxFrameHandler3
__dllonexit
wcscmp

ntdll

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

kernel32

FormatMessageW
GetSystemTime
GetThreadLocale
WaitForSingleObject
CreateThread
GetComputerNameExW
HeapAlloc
GetComputerNameW
HeapFree
GetCurrentThread
CloseHandle
DisableThreadLibraryCalls
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
GetTickCount
Sleep
CreateEventW
GetThreadPriority
SetThreadPriority
WaitForMultipleObjects
RegisterWaitForSingleObject
SetEvent
UnregisterWaitEx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LocaleNameToLCID
GetProcessHeap

advapi32

SetThreadToken
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
EventWrite
EventRegister
EventUnregister
RegEnumValueW
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
OpenThreadToken
UnregisterTraceGuids
RegCloseKey
RegOpenKeyExW

wsmsvc

WSManAddSubscriptionManagerInternal
WSManRemoveSubscriptionManagerInternal
WSManEncodeObject
WSManEnumeratorAddEvent
WSManClosePublisherHandle
WSManDeliverEndSubscriptionNotification
WSManDeliverEvent
WSManDecodeObject
WSManCloseObjectHandle
WSManConstructError

wevtapi

EvtNext
EvtQuery
EvtOpenPublisherMetadata
EvtSeek
EvtClose
EvtCreateRenderContext
EvtSubscribe
EvtCreateBookmark
EvtUpdateBookmark
EvtGetQueryInfo
EvtRender
EvtFormatMessage

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

userenv

UnregisterGPNotification
RegisterGPNotification

Exports

Exports

WSManPluginShutdown
WSManPluginStartup
WSManProvPullEvents
WSManProvSubscribe
WSManProvUnsubscribe

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SEDAGRO yvl/wevtsvc.dll
.dll windows:10 windows x64 arch:x64

a905ef31a7398e7354ddfcec5cc82a93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcp_win

_Mtx_unlock
_Mtx_init_in_situ
_Mtx_lock
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
?_Throw_C_error@std@@YAXH@Z

api-ms-win-crt-string-l1-1-0

wcsspn
wcsncmp
wcspbrk
strncmp
wcscspn
strnlen
memset
wcscmp
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__itow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__strnicmp
_o__ui64tow_s
_o__ultow_s
_o__wcsicmp
_o__wcsnicmp
_o__wcstoi64
_o__wcstoui64
_o__wfopen
memmove
_o__wtof
_o__wtoi
_o__wtoi64
_o__wtol
_o_bsearch
_o_calloc
_o_fclose
_o_fgetws
_o_free
_o_iswalnum
_o_iswalpha
_o_iswdigit
_o_iswspace
_o_malloc
_o_memcpy_s
_o_qsort
_o_strncpy_s
_o_strtol
_o_terminate
_o_toupper
_o_towupper
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wcstok_s
_o_wcstol
_o_wcstoul
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
wcsrchr
wcsstr
__CxxFrameHandler3
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__i64tow_s
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
strrchr
strchr
wcschr
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_o__crt_atexit
_o__configure_narrow_argv
_CxxThrowException
memcmp
memcpy
_o__cexit

ntdll

NtQuerySystemInformation
RtlFreeUnicodeString
RtlDosPathNameToNtPathName_U
RtlReleaseSRWLockExclusive
NtDeleteFile
RtlAcquireSRWLockExclusive
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
RtlEthernetAddressToStringW
RtlIpv6AddressToStringW
RtlAnsiStringToUnicodeString
NtOpenProcess
RtlInitUnicodeString
NtDuplicateObject
RtlEnumerateGenericTableAvl
RtlInitializeGenericTableAvl
RtlGetPersistedStateLocation
RtlSetLastWin32Error
NtReadFile
NtWriteFile
NtClose
RtlComputeCrc32
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlGetLastNtStatus
NtSetInformationFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlSecondsSince1970ToTime
RtlNtStatusToDosError
NtQueryVolumeInformationFile
NtCreateFile
RtlDeleteCriticalSection
RtlTimeToSecondsSince1970
NtQueryAttributesFile
RtlNtStatusToDosErrorNoTeb
RtlLengthSid
RtlEnterCriticalSection
RtlInitializeCriticalSection
RtlLeaveCriticalSection
RtlGetVersion
NtQuerySystemTime

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSize
HeapReAlloc
HeapDestroy
HeapAlloc
HeapFree

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle

rpcrt4

NdrAsyncServerCall
I_RpcMapWin32Status
RpcAsyncCompleteCall
RpcBindingVectorFree
RpcServerUseProtseqExW
RpcServerUseProtseqEpW
RpcServerUnregisterIfEx
RpcBindingToStringBindingW
Ndr64AsyncServerCallAll
NdrServerCall2
RpcServerRegisterIf3
RpcStringFreeW
RpcStringBindingParseW
RpcServerRegisterIfEx
RpcImpersonateClient
RpcRevertToSelf
RpcServerRegisterAuthInfoW
UuidCreate
RpcEpUnregister
RpcEpRegisterW
RpcServerInqCallAttributesW
RpcServerInqBindings
NdrServerCallAll
RpcRevertToSelfEx
I_RpcBindingInqLocalClientPID
I_RpcBindingIsClientLocal
RpcServerSubscribeForNotification
RpcServerUnsubscribeForNotification

api-ms-win-core-perfcounters-l1-1-0

PerfStopProvider
PerfSetCounterRefValue
PerfSetCounterSetInfo
PerfCreateInstance
PerfStartProviderEx
PerfDeleteInstance

api-ms-win-core-synch-l1-2-0

SleepConditionVariableCS
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
Sleep
InitializeConditionVariable
InitOnceComplete

api-ms-win-security-base-l1-2-0

CheckTokenMembershipEx

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventProviderEnabled
EventSetInformation
EventUnregister
EventActivityIdControl

api-ms-win-core-registry-l1-1-0

RegGetKeySecurity
RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegNotifyChangeKeyValue
RegDeleteKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW

api-ms-win-security-base-l1-1-0

AccessCheck
PrivilegeCheck
AccessCheckAndAuditAlarmW
GetSecurityDescriptorSacl
GetSecurityDescriptorLength
GetAclInformation
InitializeAcl
GetLengthSid
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
AdjustTokenPrivileges
IsValidSecurityDescriptor
IsValidSid
AllocateAndInitializeSid
MapGenericMask
AddAce
IsWellKnownSid
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
CreateWellKnownSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
FreeSid
MakeSelfRelativeSD
GetAce
GetTokenInformation

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
OpenEventW
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseMutex
ReleaseSRWLockShared
WaitForMultipleObjectsEx
InitializeSRWLock
InitializeCriticalSectionEx
LeaveCriticalSection
TryAcquireSRWLockExclusive
CreateEventW
CancelWaitableTimer
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
ResetEvent
CreateWaitableTimerExW
CreateMutexExW
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
SetWaitableTimer
SetEvent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FreeLibrary
GetProcAddress
GetModuleFileNameW
SizeofResource
FreeResource
LockResource
GetModuleHandleExW
FindResourceExW
GetModuleFileNameA
LoadLibraryExW
LoadResource

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
StartThreadpoolIo
WaitForThreadpoolTimerCallbacks
CloseThreadpoolIo
CreateThreadpoolIo
CloseThreadpoolTimer
WaitForThreadpoolIoCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolWait
CancelThreadpoolIo
CreateThreadpoolCleanupGroup
SubmitThreadpoolWork
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait

api-ms-win-core-processthreads-l1-1-0

CreateThread
TlsAlloc
SetThreadToken
OpenProcessToken
GetCurrentProcess
GetCurrentThreadId
OpenThreadToken
TerminateProcess
TlsFree
GetCurrentThread
TlsSetValue
GetCurrentProcessId
TlsGetValue

api-ms-win-core-localization-l1-2-0

GetSystemDefaultLangID
GetThreadLocale
SetThreadPreferredUILanguages
GetThreadPreferredUILanguages
SetThreadUILanguage
GetThreadUILanguage
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-kernel32-legacy-l1-1-0

PulseEvent

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemInfo
GlobalMemoryStatusEx
GetComputerNameExW
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount64
GetSystemTime
GetVersionExW

api-ms-win-core-file-l1-1-0

SetFilePointer
GetDiskFreeSpaceExW
FlushFileBuffers
ReadFile
CreateDirectoryW
WriteFile
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetTempFileNameW
DeleteFileW
FileTimeToLocalFileTime
GetFileInformationByHandle
GetFileSizeEx
CreateFileW
CompareFileTime
GetFileSize
GetFileAttributesExW
GetFileAttributesW

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-eventing-consumer-l1-1-0

ProcessTrace
OpenTraceW
CloseTrace

api-ms-win-core-file-l1-2-0

GetTempPathW

userenv

EnterCriticalPolicySection
RegisterGPNotification
UnregisterGPNotification
LeaveCriticalPolicySection

api-ms-win-security-isolatedcontainer-l1-1-1

IsProcessInWDAGContainer

api-ms-win-service-core-l1-1-3

GetServiceRegistryStateKey

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
EnableTraceEx2
StartTraceW

api-ms-win-core-processthreads-l1-1-3

SetThreadDescription

ws2_32

WSAStartup
WSAGetLastError
setsockopt
ntohl
WSASocketW
ntohs
WSAAddressToStringW
WSASend
WSAIoctl
listen
WSACleanup
WSAStringToAddressW
WSARecv
closesocket
getpeername
bind

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToFileTime

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
GetEnvironmentVariableW
GetCurrentDirectoryW
ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

bcrypt

BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptGetProperty
BCryptCreateHash

api-ms-win-core-state-helpers-l1-1-0

GetRegistryValueWithFallbackW

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx
GetTimeFormatEx

api-ms-win-service-core-l1-1-4

GetServiceDirectory

api-ms-win-core-sysinfo-l1-2-0

GetOsSafeBootMode

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

ServiceMain
SvchostPushServiceGlobalsEx

Sections

.text
Size: 945KB - Virtual size: 944KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 594KB - Virtual size: 593KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 206KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

a537db9e3ac79e5e57fd21566451cb10

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

gdi32

version

olepro32

ole32

comctl32

shell32

msvcrt

winspool.drv

winmm

gdiplus

winhttp

oleacc

Exports

Exports

Sections

.text Size: 6.0MB - Virtual size: 6.0MB

.itext Size: 12KB - Virtual size: 12KB

.data Size: 57KB - Virtual size: 57KB

.bss Size: - Virtual size: 25KB

.idata Size: 22KB - Virtual size: 21KB

.didata Size: 3KB - Virtual size: 3KB

.edata Size: 1024B - Virtual size: 928B

.rdata Size: 512B - Virtual size: 69B

.reloc Size: 568KB - Virtual size: 567KB

.rsrc Size: 13.0MB - Virtual size: 13.0MB

Password: infected

7c8614e26af160453644266cf4f67143

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

42:17:85:f6:b6:bc:98:c1:4a:5f:0b:89:76:96:f8:a8Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

6f:63:73:58:08:3e:98:9a:d2:1b:a0:90:e0:32:8d:38:e0:e0:56:5dSigner

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 27KB - Virtual size: 26KB

.itext Size: 512B - Virtual size: 260B

.data Size: 4KB - Virtual size: 3KB

.bss Size: - Virtual size: 19KB

.idata Size: 1KB - Virtual size: 1KB

.didata Size: 512B - Virtual size: 152B

.edata Size: 1024B - Virtual size: 553B

.rdata Size: 512B - Virtual size: 69B

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

Password: infected

dd146b8114dfb5cdb561950bfbd20252

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

.text
Size: 6.0MB - Virtual size: 6.0MB

.itext
Size: 12KB - Virtual size: 12KB

.data
Size: 57KB - Virtual size: 57KB

.bss
Size: - Virtual size: 25KB

.idata
Size: 22KB - Virtual size: 21KB

.didata
Size: 3KB - Virtual size: 3KB

.edata
Size: 1024B - Virtual size: 928B

.rdata
Size: 512B - Virtual size: 69B

.reloc
Size: 568KB - Virtual size: 567KB

.rsrc
Size: 13.0MB - Virtual size: 13.0MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

42:17:85:f6:b6:bc:98:c1:4a:5f:0b:89:76:96:f8:a8
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

6f:63:73:58:08:3e:98:9a:d2:1b:a0:90:e0:32:8d:38:e0:e0:56:5d
Signer

.text
Size: 27KB - Virtual size: 26KB

.itext
Size: 512B - Virtual size: 260B

.data
Size: 4KB - Virtual size: 3KB

.bss
Size: - Virtual size: 19KB

.idata
Size: 1KB - Virtual size: 1KB

.didata
Size: 512B - Virtual size: 152B

.edata
Size: 1024B - Virtual size: 553B

.rdata
Size: 512B - Virtual size: 69B

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

30:5b:a2:dd:88:fe:39:8d:8c:f9:07:90:c9:d2:66:ba
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

a3:24:38:d5:cd:5b:d1:f0:ec:9f:d4:cc:7f:b5:fa:f1:62:ac:31:60
Signer

.text
Size: - Virtual size: 743KB

CODE
Size: - Virtual size: 131KB

.rdata
Size: - Virtual size: 286KB

.data
Size: - Virtual size: 59KB

DATA
Size: - Virtual size: 5KB

BSS
Size: - Virtual size: 1KB

.gas0
Size: - Virtual size: 15KB

.gas1
Size: 605KB - Virtual size: 605KB

.rsrc
Size: 4KB - Virtual size: 3KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

5a:f9:41:12:00:0a:ce:4f:ab:9b:b4:ae:77:09:2e:8c
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

5a:6a:3c:54:97:8c:4f:2e:09:73:2c:cf:56:ec:17:28:56:fd:3b:d1:ae:ff:15:1f:d2:2e:92:b8:4a:16:70:bf
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 381KB - Virtual size: 380KB

.data
Size: 34KB - Virtual size: 57KB

.CRT
Size: 512B - Virtual size: 72B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 77KB - Virtual size: 77KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate