MaestroPro v9[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

MaestroPro v9.zip
Size

60.4MB
MD5

53e6de94cf379e35dc46b593a6532860
SHA1

effb6410ef8fbd15bb230879ff09eae90e75462e
SHA256

bff57ccfbe2690d2b35717379b6c6902270dba122a8d508457124c073eaffd0e
SHA512

23cf4c0dac0c6bea089cbc2c7814b5005c39357a159f70a8a6840a8eceed3065709a376ce0d12ec35bffc24b7d48de455c3b50e727f6471b0f92ab14b6bfd145
SSDEEP

1572864:d/xTZgKJuC+IiNy6A00gS5iQhPafZLlWYOndEnzJc3pGtN4M1DJQmCONvD:5x1uC9YyzgSwfZLlYndEtcmSyDJQ4D

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack002/DotNetInstaller.exe
unpack002/IScript.dll
unpack002/IUser.dll
unpack002/ctor.dll
unpack002/ikernel.dll
unpack002/objectps.dll

Files

MaestroPro v9.zip
.zip
AUTORUN.INF
Disk1/0x0409.ini
Disk1/ISSetup.dll
.dll regsvr32 windows:6 windows x86 arch:x86

3b21d8d1e000e7b5598cfcf259c0e165

Code Sign

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

16-07-2036 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04-03-2014 00:00

Not After

03-03-2024 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:25:6d:27:52:0b:14:a0:2b:f9:a5:fb:d5:56:63:d1
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03-09-2019 00:00

Not After

02-09-2022 23:59

Subject

SERIALNUMBER=2090570,CN=AMETEK INC,OU=AMT IT,O=AMETEK INC,L=Oak Ridge,ST=Tennessee,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13094f616b205269646765,1.3.6.1.4.1.311.60.2.1.2=#130954656e6e6573736565,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-10-2019 00:00

Not After

17-10-2030 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:04:1f:ec:cd:55:bf:56:08:57:00:94:8b:3b:b6:69:bc:7b:bb:88:4c:73:38:f9:d8:ef:44:c9:84:d9:f8:e9
Signer

Actual PE Digest

30:04:1f:ec:cd:55:bf:56:08:57:00:94:8b:3b:b6:69:bc:7b:bb:88:4c:73:38:f9:d8:ef:44:c9:84:d9:f8:e9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\CodeBases\isdev\redist\Language Independent\i386\ISP\ISSetup.pdb

Imports

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW
NdrStubCall2
NdrOleFree
UuidFromStringW
NdrOleAllocate
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrStubForwardingFunction
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke

gdiplus

GdipGetImageHeight
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromResource
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetInterpolationMode
GdipDrawImageRectI
GdipGetImageWidth

kernel32

GetCurrentProcess
lstrcmpiA
GetVersion
WinExec
WritePrivateProfileStringW
SetFileTime
MoveFileExW
ExpandEnvironmentStringsW
IsBadWritePtr
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetCurrentThreadId
FlushInstructionCache
MulDiv
OutputDebugStringW
lstrlenA
FlushFileBuffers
GetSystemDefaultLangID
GetUserDefaultLangID
CreateFileA
GetShortPathNameW
GlobalFree
GlobalAlloc
RemoveDirectoryW
GetTickCount
SetFileAttributesW
SetEvent
GetPrivateProfileSectionW
WaitForSingleObject
GetTempPathW
GetTempFileNameW
GetDiskFreeSpaceW
SearchPathW
LoadLibraryW
GetWindowsDirectoryW
GetSystemDirectoryW
CompareStringA
CompareStringW
SystemTimeToFileTime
IsBadReadPtr
DosDateTimeToFileTime
FileTimeToDosDateTime
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualQuery
GetVersionExW
GetSystemInfo
GetSystemTime
CreateEventW
QueryPerformanceFrequency
WriteFile
SetFilePointer
FreeResource
ReadConsoleW
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetModuleFileNameA
GetFileType
GetStringTypeW
HeapReAlloc
HeapSize
GetModuleHandleExW
ExitProcess
GetStdHandle
GetCPInfo
GetOEMCP
IsValidCodePage
GetACP
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
ExitThread
CreateThread
IsDebuggerPresent
RtlUnwind
GetCurrentThread
ReadFile
LocalFileTimeToFileTime
GetFileTime
GetFileSize
FileTimeToLocalFileTime
CreateFileW
lstrcpyW
CreateProcessW
Sleep
WideCharToMultiByte
MoveFileW
CopyFileW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrlenW
lstrcmpW
FormatMessageW
LocalFree
GetCurrentProcessId
OpenEventW
ResetEvent
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
GetUserDefaultLCID
MultiByteToWideChar
lstrcmpiW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RaiseException
CloseHandle
DecodePointer
EncodePointer
LoadLibraryExA
LoadLibraryA
GetSystemDirectoryA
FindResourceW
GlobalUnlock
GlobalLock
SizeofResource
LockResource
LoadResource
SetLastError
GetLastError
TerminateProcess
QueryPerformanceCounter
lstrcatW
lstrcpynW
GetLocalTime
LCMapStringW
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
InterlockedCompareExchange
GetProcessHeap
HeapFree
HeapAlloc
InterlockedExchange

user32

LoadStringW
CharNextW
wsprintfW
WaitForInputIdle
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
ExitWindowsEx
CharUpperW
RegisterWindowMessageW
SendMessageW
DefWindowProcW
CallWindowProcW
RegisterClassExW
GetClassInfoExW
CharUpperBuffW
IsWindow
IsChild
DestroyWindow
MoveWindow
SetWindowPos
GetDlgItem
SetFocus
GetFocus
SetCapture
ReleaseCapture
CreateAcceleratorTableW
DestroyAcceleratorTable
GetDC
ReleaseDC
MsgWaitForMultipleObjects
PeekMessageW
UnregisterClassW
BeginPaint
EndPaint
InvalidateRect
InvalidateRgn
GetDesktopWindow
CreateWindowExW
OffsetRect
CopyRect
RemovePropW
SetPropW
DrawTextW
GetDlgCtrlID
MonitorFromPoint
EnumChildWindows
GetWindowDC
GetDlgItemTextW
MessageBeep
AdjustWindowRectEx
UpdateWindow
SystemParametersInfoW
MapWindowPoints
CreateDialogIndirectParamW
GetWindowPlacement
GetSystemMetrics
RemoveMenu
AppendMenuW
GetSystemMenu
SetDlgItemTextW
DialogBoxParamW
LoadIconW
SetCursor
GetPropW
SetWindowRgn
EnableWindow
IsIconic
ShowWindow
IsRectEmpty
IntersectRect
GetWindowRect
LoadCursorW
GetWindow
GetClassNameW
GetParent
SetWindowLongW
GetWindowLongW
FillRect
GetSysColor
ScreenToClient
ClientToScreen
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
RedrawWindow

gdi32

SaveDC
RestoreDC
CreateFontIndirectW
GetObjectW
SelectObject
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CreateDIBitmap
CreateBitmap
CreatePalette
GetSystemPaletteEntries
PlayMetaFile
SetBkColor
SetMetaFileBitsEx
StretchBlt
SetStretchBltMode
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
UnrealizeObject
SetBkMode
TextOutW
CreatePatternBrush
CreateRectRgn
GetMapMode
PatBlt
RealizePalette
SelectClipRgn
SelectPalette
SetMapMode
SetPixel
LPtoDP
Rectangle
GetTextExtentPoint32W
DeleteMetaFile
EnumFontFamiliesExW
SetTextColor

advapi32

RegConnectRegistryW
EqualSid
GetTokenInformation
OpenThreadToken
CryptVerifySignatureW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
ControlService
CloseServiceHandle
RegOpenKeyW
RegQueryValueExW
RegEnumValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
SetFileSecurityW
IsValidSecurityDescriptor
GetFileSecurityW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
CryptCreateHash
CryptImportKey
CryptGetHashParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegEnumKeyW
FreeSid
CryptDestroyHash
AllocateAndInitializeSid

shell32

SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFolderPathW

ole32

CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CLSIDFromString
GetRunningObjectTable
CreateItemMoniker
CoCreateGuid
CoRegisterClassObject
StgOpenStorage
StgCreateDocfile
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromCLSID
CoCreateInstance
CoReleaseMarshalData
CreateStreamOnHGlobal
PropVariantClear
CLSIDFromProgID
CoGetClassObject
OleInitialize
CoRegisterPSClsid
CoRevokeClassObject
CoUninitialize
OleUninitialize
OleLockRunning
ProgIDFromCLSID
ReadClassStm
WriteClassStm
OleSaveToStream

oleaut32

GetErrorInfo
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserSize
VARIANT_UserFree
VARIANT_UserUnmarshal
VARIANT_UserMarshal
VARIANT_UserSize
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SysStringLen
VariantInit
VariantClear
VarUI4FromStr
LoadTypeLi
SysAllocString
VariantCopy
SysStringByteLen
SysAllocStringByteLen
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCopy
VariantChangeType
SafeArrayGetUBound
SafeArrayGetLBound
RegisterTypeLi
UnRegisterTypeLi
VarBstrCat
SafeArrayGetDim
SafeArrayRedim
SetErrorInfo
CreateErrorInfo
VariantCopyInd
DispGetParam
LoadRegTypeLi
OleCreateFontIndirect
DispCallFunc
OleLoadPicturePath

shlwapi

SHStrDupW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProductSKU
GetScriptEngine
InstallEngineTypelib
RemoveEngineTypelib
SuiteIsFeatureInstalled
SuiteStartupInstall

Sections

.text
Size: 818KB - Virtual size: 818KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 304KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Disk1/data1.cab
Disk1/data1.hdr
Disk1/data2.cab
Disk1/engine32.cab
.cab
DotNetInstaller.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IScript.dll
.dll regsvr32 windows:4 windows x86 arch:x86

01079e578402fb3b7165570d3ad44913

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
GetShortPathNameA
GetModuleHandleA
lstrlenW
lstrlenA
GetModuleFileNameA
lstrcmpiA
HeapDestroy
FindClose
FindFirstFileA
GetFileAttributesA
CreateFileA
MultiByteToWideChar
EnterCriticalSection
CloseHandle
UnmapViewOfFile
ReadFile
WaitForSingleObject
SetEvent
FreeLibrary
LoadLibraryA
GetProcAddress
GetOEMCP
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
LocalFree
GetLastError
FormatMessageA
WideCharToMultiByte
QueryPerformanceFrequency
CreateEventA
IsBadCodePtr
ResetEvent
GetACP
GetStringTypeW
GetStringTypeA
SystemTimeToFileTime
VirtualAlloc
WriteFile
IsBadWritePtr
HeapCreate
GetVersionExA
VirtualFree
GetEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentVariableA
FreeEnvironmentStringsA
GetStartupInfoA
FreeEnvironmentStringsW
IsBadReadPtr
GetCPInfo
Sleep
InterlockedExchange
GetStdHandle
SetHandleCount
GetFileType
LCMapStringW
UnhandledExceptionFilter
LCMapStringA
SetLastError
lstrcatA
MapViewOfFile
CreateFileMappingA
GetFileSize
VirtualQuery
VirtualProtect
SearchPathA
lstrcpyA
GetWindowsDirectoryA
lstrcpynA
GetCommandLineA
GetTickCount
QueryPerformanceCounter
GetVersion
HeapFree
HeapReAlloc
HeapSize
RaiseException
RtlUnwind
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
SetUnhandledExceptionFilter
TlsAlloc
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
TlsFree
TlsGetValue

user32

MsgWaitForMultipleObjects
PeekMessageA
LoadStringA
wsprintfA
CharLowerBuffA
TranslateMessage
GetDesktopWindow
GetMessageA
DispatchMessageA
PostThreadMessageA

advapi32

RegQueryValueA
RegQueryValueExA
RegOpenKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA

ole32

CLSIDFromProgID
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
StringFromCLSID
ProgIDFromCLSID
CoTaskMemFree

oleaut32

GetErrorInfo
SafeArrayRedim
SafeArrayGetUBound
SysStringByteLen
SafeArrayCreate
DispGetParam
VariantCopyInd
LoadRegTypeLi
SafeArrayGetElement
SafeArrayPutElement
SysAllocStringLen
SafeArrayGetLBound
SafeArrayGetDim
SysStringLen
SafeArrayDestroy
SysFreeString
SysAllocString
SysReAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantInit
SetErrorInfo
CreateErrorInfo
SysAllocStringByteLen

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IUser.dll
.dll regsvr32 windows:4 windows x86 arch:x86

ed67065e5e9b57547897a7e97c585c27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InitializeCriticalSection
DisableThreadLibraryCalls
lstrcmpiA
LoadResource
HeapDestroy
GetTickCount
FreeLibrary
FindResourceA
FlushInstructionCache
LockResource
GetCurrentProcess
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
lstrcatA
GetModuleHandleA
GetModuleFileNameA
GlobalFree
LoadLibraryA
GetProcAddress
GlobalUnlock
GlobalAlloc
GlobalLock
GetShortPathNameA
DeleteCriticalSection
EnterCriticalSection
GetEnvironmentStrings
CloseHandle
FlushFileBuffers
SetFilePointer
SetStdHandle
ReadFile
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetFileAttributesA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
HeapSize
HeapReAlloc
TerminateProcess
ExitProcess
SetLastError
HeapAlloc
TlsGetValue
lstrcpyA
TlsFree
TlsAlloc
TlsSetValue
RaiseException
HeapFree
GetVersion
GetCommandLineA
RtlUnwind
InterlockedExchange
Sleep
GetLastError
LeaveCriticalSection
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
lstrlenA

user32

DestroyWindow
GetDlgCtrlID
GetClassNameA
MessageBeep
IntersectRect
IsIconic
EnumChildWindows
SetWindowRgn
LoadIconA
ScreenToClient
GetWindowRect
FillRect
GetSysColor
GetDlgItem
MoveWindow
SetWindowPos
SetWindowLongA
GetWindowLongA
ReleaseDC
GetDC
IsWindow
SetWindowTextA
ReleaseCapture
SetCursor
LoadCursorA
SetCapture
EnableWindow
GetDesktopWindow
CopyRect
OffsetRect
DrawTextA
wsprintfA
GetDlgItemTextA
GetWindowDC
DefWindowProcA
CreateWindowExA
GetParent
ShowWindow
BeginPaint
EndPaint
SendMessageA
UpdateWindow
GetWindow
SystemParametersInfoA
MapWindowPoints
CreateDialogIndirectParamA
ClientToScreen
SetFocus
SetDlgItemTextA
AppendMenuA
InvalidateRect
DialogBoxParamA
GetSystemMenu
RemoveMenu
LoadStringA
GetClientRect
GetClassInfoExA
RegisterClassExA
GetWindowTextLengthA
GetWindowTextA
CallWindowProcA

gdi32

DeleteObject
CreateRectRgn
TextOutA
SetTextColor
RestoreDC
SelectObject
SaveDC
SetBkMode
CreateFontIndirectA
GetDeviceCaps
CreateSolidBrush
GetStockObject
GetTextExtentPoint32A
Rectangle
DeleteDC
BitBlt
DeleteMetaFile
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
EnumFontFamiliesExA

advapi32

RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA

ole32

StringFromCLSID
CoTaskMemFree
ProgIDFromCLSID

oleaut32

SysStringLen
SysReAllocStringLen
GetErrorInfo
CreateErrorInfo
SetErrorInfo
SysFreeString
SysAllocStringLen
LoadRegTypeLi
SysAllocString

winmm

mciSendCommandA
sndPlaySoundA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IsProBE9x.tlb
IsProBENT.tlb
ctor.dll
.dll regsvr32 windows:4 windows x86 arch:x86

66e125b3db52dda3a29db9e25cbdb706

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CopyFileA
HeapAlloc
GetSystemInfo
GetVersionExA
HeapCreate
SetLastError
CreateFileA
GetLastError
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
CompareStringA
CompareStringW
GetPrivateProfileIntA
CreateEventA
HeapDestroy
LoadLibraryA
lstrcatA
DeleteFileA
GetTempPathA
GetWindowsDirectoryA
GetTickCount
GetFileAttributesA
GetTempFileNameA
GetCurrentProcessId
GetCurrentProcess
DebugBreak
HeapFree
GetPrivateProfileStringA
GetProcAddress
LoadLibraryExA
FreeLibrary
DisableThreadLibraryCalls
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
CreateProcessA
CloseHandle
lstrlenA
lstrcpyA
GetModuleFileNameA
GetModuleHandleA
lstrcmpiA
GetShortPathNameA
GetSystemDirectoryA
GetVersion
GetCurrentThread

user32

MessageBoxA
CharUpperA
LoadStringA
PeekMessageA
MsgWaitForMultipleObjects
wsprintfA
CharNextA

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegDeleteValueA
RegQueryInfoKeyA
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid

ole32

StringFromCLSID
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
CLSIDFromString
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
CoLoadLibrary

oleaut32

CreateErrorInfo
SetErrorInfo
GetErrorInfo
VariantChangeType
LoadTypeLi
SysAllocStringLen
VariantCopy
VariantClear
SysAllocString
SysFreeString
SysStringLen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
LaunchSetup

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iKernel.rgs
ikernel.dll
.dll regsvr32 windows:4 windows x86 arch:x86

4388eae753019d8a9b20cf9b64adc7d4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
GetModuleHandleA
GetModuleFileNameA
Sleep
CreateProcessA
GetPrivateProfileStringA
lstrcmpA
CreateFileA
QueryPerformanceFrequency
CreateEventA
SetFilePointer
ReadFile
SystemTimeToFileTime
GetSystemTime
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileSize
GetFileTime
CompareStringA
CompareStringW
GetVersionExA
WriteFile
LocalFileTimeToFileTime
DosDateTimeToFileTime
LoadLibraryExA
SearchPathA
FreeLibrary
WaitForSingleObject
OpenEventA
GetCurrentProcessId
GetWindowsDirectoryA
CreateDirectoryA
CopyFileA
GetVersion
GetPrivateProfileSectionA
GetShortPathNameA
DisableThreadLibraryCalls
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
SetEvent
LockResource
LoadResource
SizeofResource
FindResourceA
SetFileAttributesA
RemoveDirectoryA
SetFileTime
GetCurrentProcess
WritePrivateProfileStringA
GetSystemDirectoryA
WinExec
MoveFileExA
IsBadWritePtr
IsBadReadPtr
GetPrivateProfileSectionNamesA
WritePrivateProfileSectionA
MoveFileA
ResetEvent
DeleteFileA
GetPrivateProfileIntA
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FindFirstFileA
lstrcmpiA
FindNextFileA
FindClose
lstrlenA
GlobalAlloc
CloseHandle
GlobalLock
InterlockedDecrement
GlobalUnlock
GlobalFree
FormatMessageA
LocalFree
InterlockedIncrement
lstrlenW
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
lstrcpyA
GetTickCount
LoadLibraryA
SetUnhandledExceptionFilter
TlsFree
SetLastError
GetLastError
HeapSize
HeapReAlloc
GetStringTypeW
GetStringTypeA
IsBadCodePtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
UnhandledExceptionFilter
LCMapStringW
TerminateProcess
HeapFree
HeapAlloc
GetCommandLineA
TlsSetValue
GetCurrentThreadId
ExitThread
RaiseException
RtlUnwind
CreateThread
QueryPerformanceCounter
lstrcpynA
InterlockedExchange
TlsAlloc
ExitProcess
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
VirtualQuery
GetCurrentThread
VirtualProtect
GetCPInfo
GetACP
LCMapStringA
TlsGetValue
lstrcatA
GetOEMCP

user32

PostThreadMessageA
MsgWaitForMultipleObjects
LoadStringA
wsprintfA
CharUpperA
GetDesktopWindow
CharLowerA
ExitWindowsEx
PeekMessageA
CharLowerBuffA
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxA

advapi32

IsValidSecurityDescriptor
ControlService
QueryServiceStatus
OpenServiceA
CloseServiceHandle
RegEnumValueA
DeleteService
RegDeleteValueA
RegQueryInfoKeyA
RegConnectRegistryA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegDeleteKeyA
RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyA
GetFileSecurityA
RegSetValueExA
SetFileSecurityA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenThreadToken
RegQueryValueA
OpenSCManagerA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc

ole32

WriteClassStm
ProgIDFromCLSID
CoTaskMemFree
CreateStreamOnHGlobal
StgCreateDocfile
StgOpenStorage
StringFromCLSID
CoLoadLibrary
OleLoadFromStream
CoCreateGuid
CLSIDFromString
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
StringFromGUID2
OleSaveToStream

oleaut32

SafeArrayGetDim
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
SafeArrayGetLBound
SafeArrayCopy
SafeArrayGetUBound
SafeArrayCreate
SysAllocStringByteLen
GetErrorInfo
VariantChangeType
SafeArrayGetElement
SafeArrayDestroy
SetErrorInfo
SysReAllocStringLen
CreateErrorInfo
VariantCopy
VariantInit
VariantCopyInd
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
VariantClear
SafeArrayPutElement
SysStringByteLen

rpcrt4

UuidFromStringA
UuidCreate

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 500KB - Virtual size: 498KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
objectps.dll
.dll regsvr32 windows:4 windows x86 arch:x86

a946c4bf5da14af630ebc8e61f6454ef

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
RtlUnwind

rpcrt4

CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrProxyErrorHandler
NdrClearOutParameters
NdrProxyFreeBuffer
NdrPointerUnmarshall
NdrConvert
NdrSimpleStructMarshall
CStdStubBuffer_DebugServerRelease
NdrProxyGetBuffer
RpcRaiseException
NdrProxyInitialize
NdrPointerFree
NdrPointerMarshall
NdrStubGetBuffer
NdrPointerBufferSize
NdrSimpleStructUnmarshall
NdrStubInitialize
NdrInterfacePointerMarshall
NdrInterfacePointerBufferSize
NdrInterfacePointerFree
NdrInterfacePointerUnmarshall
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrProxySendReceive

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 128B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 762B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Disk1/layout.bin
Disk1/setup.boot
Disk1/setup.exe
.exe windows:5 windows x86 arch:x86

42669f99775f2f541a042cacf40fa06b

Code Sign

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

16-07-2036 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04-03-2014 00:00

Not After

03-03-2024 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:25:6d:27:52:0b:14:a0:2b:f9:a5:fb:d5:56:63:d1
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03-09-2019 00:00

Not After

02-09-2022 23:59

Subject

SERIALNUMBER=2090570,CN=AMETEK INC,OU=AMT IT,O=AMETEK INC,L=Oak Ridge,ST=Tennessee,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13094f616b205269646765,1.3.6.1.4.1.311.60.2.1.2=#130954656e6e6573736565,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-10-2019 00:00

Not After

17-10-2030 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:79:50:29:39:f9:fb:96:b5:e5:eb:05:e6:c7:14:d1:30:5b:3a:7a:ec:00:b9:03:78:2c:34:41:c0:4c:5a:7f
Signer

Actual PE Digest

0f:79:50:29:39:f9:fb:96:b5:e5:eb:05:e6:c7:14:d1:30:5b:3a:7a:ec:00:b9:03:78:2c:34:41:c0:4c:5a:7f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\CodeBases\isdev\redist\Language Independent\i386\ISP\setup.pdb

Imports

comctl32

ord17

kernel32

CompareStringW
CompareStringA
GetSystemDefaultLangID
GetUserDefaultLangID
ExpandEnvironmentStringsW
GetCurrentDirectoryW
FileTimeToLocalFileTime
GetFileTime
SetFileAttributesW
HeapAlloc
HeapFree
GetProcessHeap
CopyFileW
GetSystemDefaultUILanguage
GlobalAlloc
LocalFree
MulDiv
GetVersionExW
InterlockedDecrement
InterlockedIncrement
GetTempPathW
CreateFileW
LoadLibraryA
GetSystemDirectoryA
FindResourceW
GlobalUnlock
GlobalLock
IsBadReadPtr
LockResource
LoadResource
MultiByteToWideChar
MoveFileExW
WriteProcessMemory
VirtualProtectEx
GetWindowsDirectoryW
GetSystemDirectoryW
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
TerminateProcess
ExitProcess
MoveFileW
GetPrivateProfileIntW
LoadLibraryW
lstrcatW
lstrcpynW
lstrcmpiW
LoadLibraryExW
FreeLibrary
FindResourceExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualQuery
GetSystemInfo
GetSystemTimeAsFileTime
CreateEventW
CreateMutexW
ReleaseMutex
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
QueryPerformanceFrequency
FreeResource
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcatA
lstrcmpiA
FlushFileBuffers
WriteConsoleW
SetStdHandle
OutputDebugStringW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetErrorMode
RaiseException
WriteFile
SetFilePointer
GetFileSize
GetFileAttributesW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
FindFirstFileW
FindClose
CreateDirectoryW
VerLanguageNameW
IsValidLocale
GetLocaleInfoW
WideCharToMultiByte
lstrcpyA
GetTickCount
ExitThread
CreateThread
GetExitCodeProcess
ReadFile
GetCommandLineW
SizeofResource
FormatMessageW
GetCurrentProcess
WaitForSingleObject
SetLastError
GetLastError
DuplicateHandle
RemoveDirectoryW
DeleteFileW
SetCurrentDirectoryW
lstrlenW
lstrcpyW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
CreateProcessW
Sleep
CloseHandle
GlobalFree
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
HeapReAlloc
GetStdHandle
HeapSize
GetModuleHandleExW
GetStringTypeW
GetCurrentThreadId
GetCPInfo
GetOEMCP
IsValidCodePage
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetACP
IsProcessorFeaturePresent
IsDebuggerPresent
RtlUnwind
FindNextFileW
lstrcmpW
GetCurrentThread
QueryPerformanceCounter
lstrcmpA
SystemTimeToFileTime
ResetEvent
SetEvent
GetDateFormatW
GetTimeFormatW
GetTempFileNameW
CompareFileTime
SetFileTime
OpenProcess
GetProcessTimes
InterlockedExchange
LoadLibraryExA
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
LCMapStringW
GetVersion
GetCurrentProcessId
GetLocalTime
lstrlenA

user32

DialogBoxIndirectParamW
MoveWindow
SendMessageW
WaitForInputIdle
wsprintfW
GetDlgItem
SetDlgItemTextW
EndDialog
SetForegroundWindow
SetWindowTextW
GetWindowRect
MessageBoxW
GetWindowLongW
SetWindowLongW
LoadIconW
TranslateMessage
DispatchMessageW
PeekMessageW
SetActiveWindow
SystemParametersInfoW
GetWindow
FillRect
GetSysColor
MapWindowPoints
RemovePropW
GetPropW
SetPropW
EndPaint
BeginPaint
EnableMenuItem
GetSystemMetrics
SetFocus
ExitWindowsEx
CharUpperW
wsprintfA
CallWindowProcW
CreateWindowExW
DrawIcon
DrawTextW
UpdateWindow
GetWindowDC
InvalidateRect
DrawFocusRect
CopyRect
InflateRect
EnumChildWindows
GetClassNameW
MapDialogRect
RegisterClassExW
GetDlgItemTextW
IntersectRect
MonitorFromPoint
DefWindowProcW
GetMessageW
LoadStringW
LoadImageW
ReleaseDC
GetDC
CreateDialogParamW
GetParent
GetWindowTextW
CharNextW
GetDesktopWindow
GetClientRect
IsWindowEnabled
CreateDialogIndirectParamW
IsWindowVisible
IsDialogMessageW
FindWindowExW
ScreenToClient
EnableWindow
MsgWaitForMultipleObjects
SendDlgItemMessageW
SetWindowPos
ShowWindow
DestroyWindow
IsWindow
PostMessageW

gdi32

SetTextColor
SetBkMode
SetBkColor
SaveDC
RestoreDC
CreateSolidBrush
UnrealizeObject
CreateHalftonePalette
GetDIBColorTable
SelectPalette
SelectObject
RealizePalette
GetSystemPaletteEntries
GetDeviceCaps
DeleteDC
CreatePalette
CreateCompatibleDC
BitBlt
GetObjectW
TranslateCharsetInfo
DeleteObject
CreateFontIndirectW
CreateCompatibleBitmap
CreateDCW
CreatePatternBrush
GetStockObject
GetTextExtentPoint32W
DeleteMetaFile
CreateDIBitmap
CreateBitmap
CreateRectRgn
PatBlt
PlayMetaFile
SelectClipRgn
SetMapMode
SetMetaFileBitsEx
SetPixel
StretchBlt
SetStretchBltMode
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
TextOutW

advapi32

RegEnumValueW
RegQueryValueExW
SetEntriesInAclW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateWellKnownSid
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyW
OpenProcessToken
AdjustTokenPrivileges
AllocateAndInitializeSid
FreeSid
LookupPrivilegeValueW
RegEnumKeyW
OpenThreadToken
GetTokenInformation
EqualSid

shell32

ShellExecuteExW
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW

ole32

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitializeSecurity
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize

oleaut32

VarUI4FromStr
VarBstrCmp
VariantChangeType
VarBstrCat
SysAllocString
SysFreeString
SysStringLen
SysAllocStringLen
SysReAllocStringLen
GetErrorInfo
SysStringByteLen
VariantInit
SysAllocStringByteLen
VariantClear

shlwapi

PathFileExistsW

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

gdiplus

GdipFree
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromResource
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipGetImageWidth
GdipGetImageHeight
GdipAlloc

Sections

.text
Size: 421KB - Virtual size: 421KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 294KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Disk1/setup.ini
Disk1/setup.inx
Manuals/ORTEC File Structures.pdf
.pdf
Manuals/V9 Users Manual.pdf
.pdf
Support/vc_redist.x86.exe
.exe windows:5 windows x86 arch:x86

8e2588a9cf43886de3449dfff03137b6

Code Sign

33:00:00:00:ac:63:16:e7:e3:46:55:b3:1c:00:00:00:00:00:ac
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-05-2016 17:13

Not After

03-08-2017 17:13

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-06-2015 17:42

Not After

04-09-2016 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28-10-2015 20:31

Not After

28-01-2017 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:12:80:9c:ca:f7:eb:86:79:f3:3f:cb:2a:a5:60:d7:0d:dc:44:88:bc:55:c1:a3:7b:54:00:7a:b1:82:77:ed
Signer

Actual PE Digest

4d:12:80:9c:ca:f7:eb:86:79:f3:3f:cb:2a:a5:60:d7:0d:dc:44:88:bc:55:c1:a3:7b:54:00:7a:b1:82:77:ed

Digest Algorithm

sha256

PE Digest Matches

true

82:d9:a5:27:22:5d:9a:32:85:b0:da:6e:7a:b5:fd:fd:e5:15:e1:df
Signer

Actual PE Digest

82:d9:a5:27:22:5d:9a:32:85:b0:da:6e:7a:b5:fd:fd:e5:15:e1:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

E:\delivery\Dev\wix37\build\ship\x86\burn.pdb

Imports

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromResource
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipAlloc

advapi32

QueryServiceConfigW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner

user32

GetMessageW
PeekMessageW
PostMessageW
IsWindow
PostQuitMessage
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
BeginPaint
EndPaint
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
ReleaseDC
MessageBoxW
PostThreadMessageW
RegisterClassW
CreateWindowExW

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

gdi32

GetDeviceCaps
CreateDCW

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
StringFromGUID2
CoInitializeSecurity
CLSIDFromProgID

kernel32

GetCurrentProcess
InitializeCriticalSection
TlsFree
DeleteCriticalSection
CloseHandle
TlsGetValue
Sleep
GetLastError
ReleaseMutex
TlsSetValue
TlsAlloc
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
HeapAlloc
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
HeapSetInformation
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetTimeZoneInformation
TerminateProcess
UnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
IsProcessorFeaturePresent
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
GlobalFree
MoveFileExW
CopyFileW
GetFileSizeEx
GetModuleHandleA
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
UnmapViewOfFile
IsDebuggerPresent
DuplicateHandle
HeapFree
FormatMessageW
GetTempFileNameW
GetWindowsDirectoryW
CompareStringA
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
ExitProcess
SetUnhandledExceptionFilter
GetStartupInfoW
GetCommandLineW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap

cabinet

ord22
ord20
ord23

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

msi

ord88
ord17
ord125
ord116
ord115
ord118
ord8
ord171
ord205
ord45
ord137
ord141
ord238
ord190
ord169
ord90
ord173
ord111
ord70

rpcrt4

UuidCreate

wininet

InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetOpenW
HttpQueryInfoW
InternetCrackUrlW
InternetConnectW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b21d8d1e000e7b5598cfcf259c0e165

Code Sign

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4aCertificate

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

39:25:6d:27:52:0b:14:a0:2b:f9:a5:fb:d5:56:63:d1Certificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

30:04:1f:ec:cd:55:bf:56:08:57:00:94:8b:3b:b6:69:bc:7b:bb:88:4c:73:38:f9:d8:ef:44:c9:84:d9:f8:e9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 818KB - Virtual size: 818KB

.orpc Size: 1024B - Virtual size: 544B

.rdata Size: 304KB - Virtual size: 304KB

.data Size: 63KB - Virtual size: 152KB

.rsrc Size: 119KB - Virtual size: 119KB

.reloc Size: 283KB - Virtual size: 282KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

File Characteristics

Imports

mscoree

Sections

.text Size: 3KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

01079e578402fb3b7165570d3ad44913

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

version

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 152KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 16KB - Virtual size: 16KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 15KB

ed67065e5e9b57547897a7e97c585c27

Headers

File Characteristics

Imports

kernel32

user32

gdi32

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

39:25:6d:27:52:0b:14:a0:2b:f9:a5:fb:d5:56:63:d1
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

30:04:1f:ec:cd:55:bf:56:08:57:00:94:8b:3b:b6:69:bc:7b:bb:88:4c:73:38:f9:d8:ef:44:c9:84:d9:f8:e9
Signer

.text
Size: 818KB - Virtual size: 818KB

.orpc
Size: 1024B - Virtual size: 544B

.rdata
Size: 304KB - Virtual size: 304KB

.data
Size: 63KB - Virtual size: 152KB

.rsrc
Size: 119KB - Virtual size: 119KB

.reloc
Size: 283KB - Virtual size: 282KB

.text
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 156KB - Virtual size: 152KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB

.text
Size: 96KB - Virtual size: 92KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 16KB - Virtual size: 20KB

.rsrc
Size: 8KB - Virtual size: 6KB

.reloc
Size: 12KB - Virtual size: 9KB

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 500KB - Virtual size: 498KB

.rdata
Size: 92KB - Virtual size: 89KB

.data
Size: 32KB - Virtual size: 119KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 44KB - Virtual size: 40KB

.text
Size: 8KB - Virtual size: 5KB

.orpc
Size: 4KB - Virtual size: 128B

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 140B

.rsrc
Size: 4KB - Virtual size: 1024B

.reloc
Size: 4KB - Virtual size: 762B

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate