minimal_548[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

minimal_548.rar
Size

22.0MB
MD5

8bde578a918c97d3a695223d9099f54b
SHA1

86fa300d6a9e1d8bbabf0093f05f4a138fce388d
SHA256

30603dfa0f0c2b529fb64d6e372f901b45bc54106cacfe70246f5847af55371c
SHA512

1f07c0783266e614d15ec7f8c63af6bbaf162b1a0f8a6fabda6d45966f45423499c914e19607699c406317af2fe21fef00f60b36c21add135cf88f5d7b62f3f3
SSDEEP

393216:qExfa7Fg3ESZNb1lSlAo2QsLIMum4XVRqB1G0GzGjN4N4L0cl:3lgSjy6c3m4XqB16zarLRl

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/World of Warcraft 5.4.8 minimal/Scan.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/World of Warcraft 5.4.8 minimal/Scan.dll	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/World of Warcraft 5.4.8 minimal/Ionic.Zip.dll
unpack001/World of Warcraft 5.4.8 minimal/Scan-64.dll
unpack001/World of Warcraft 5.4.8 minimal/Scan.dll
unpack002/out.upx
unpack001/World of Warcraft 5.4.8 minimal/divxdecoder.dll

Files

minimal_548.rar
.rar
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_AchievementUI/Blizzard_AchievementUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_ArchaeologyUI/Blizzard_ArchaeologyUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_ArenaUI/Blizzard_ArenaUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_AuctionUI/Blizzard_AuctionUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_AuthChallengeUI/Blizzard_AuthChallengeUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_BarbershopUI/Blizzard_BarbershopUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_BattlefieldMinimap/Blizzard_BattlefieldMinimap.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_BindingUI/Blizzard_BindingUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_BlackMarketUI/Blizzard_BlackMarketUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_CUFProfiles/Blizzard_CUFProfiles.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_Calendar/Blizzard_Calendar.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_ChallengesUI/Blizzard_ChallengesUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_ClientSavedVariables/Blizzard_ClientSavedVariables.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_CombatLog/Blizzard_CombatLog.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_CombatText/Blizzard_CombatText.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_CompactRaidFrames/Blizzard_CompactRaidFrames.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_DebugTools/Blizzard_DebugTools.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_EncounterJournal/Blizzard_EncounterJournal.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_GMChatUI/Blizzard_GMChatUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_GMSurveyUI/Blizzard_GMSurveyUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_GlyphUI/Blizzard_GlyphUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_GuildBankUI/Blizzard_GuildBankUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_GuildControlUI/Blizzard_GuildControlUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_GuildUI/Blizzard_GuildUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_InspectUI/Blizzard_InspectUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_ItemAlterationUI/Blizzard_ItemAlterationUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_ItemSocketingUI/Blizzard_ItemSocketingUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_ItemUpgradeUI/Blizzard_ItemUpgradeUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_LookingForGuildUI/Blizzard_LookingForGuildUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_MacroUI/Blizzard_MacroUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_MovePad/Blizzard_MovePad.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_PVPUI/Blizzard_PVPUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_PetBattleUI/Blizzard_PetBattleUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_PetJournal/Blizzard_PetJournal.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_QuestChoice/Blizzard_QuestChoice.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_RaidUI/Blizzard_RaidUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_ReforgingUI/Blizzard_ReforgingUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_StoreUI/Blizzard_StoreUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_TalentUI/Blizzard_TalentUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_TimeManager/Blizzard_TimeManager.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_TokenUI/Blizzard_TokenUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_TradeSkillUI/Blizzard_TradeSkillUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_TrainerUI/Blizzard_TrainerUI.pub
World of Warcraft 5.4.8 minimal/Interface/AddOns/Blizzard_VoidStorageUI/Blizzard_VoidStorageUI.pub
World of Warcraft 5.4.8 minimal/Ionic.Zip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

x:\DotNetZip.Semverd\src\Zip\obj\Release\Ionic.Zip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 450KB - Virtual size: 449KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
World of Warcraft 5.4.8 minimal/MovieProxy.exe
.exe windows:5 windows x86 arch:x86

9333ad3fc8e962a7d8c660d3e57faf62

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:a1:aa:68:02:ea:d5:f5:8a:6a:01:6d:4d:84:c5:65
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

03/12/2013, 00:00

Not After

04/12/2015, 23:59

Subject

CN=Blizzard Entertainment\, Inc.,OU=TECHNICAL SUPPORT,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

46:ce:d0:59:82:e1:42:a8:4c:10:b3:65:0d:ec:10:6a:71:ef:d6:41
Signer

Actual PE Digest

46:ce:d0:59:82:e1:42:a8:4c:10:b3:65:0d:ec:10:6a:71:ef:d6:41

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BuildServer\WoW\1\work\WoW-code\branches\wow-patch-5_4_8-branch-fastpatch-0\WoW\Bin\MovieProxy.pdb

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryW
MultiByteToWideChar
CloseHandle
MapViewOfFile
OpenFileMappingW
UnmapViewOfFile
TerminateProcess
GetCurrentProcess
GetUserDefaultLangID
WaitForMultipleObjectsEx
SetEvent
GetHandleInformation
SetUnhandledExceptionFilter
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapAlloc
GetLastError
HeapFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
ReadFile
UnhandledExceptionFilter
IsDebuggerPresent
RaiseException
SetFilePointer
IsProcessorFeaturePresent
Sleep
HeapSize
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
HeapReAlloc
WriteConsoleW
CreateFileW
LCMapStringW
GetStringTypeW
SetEndOfFile
GetProcessHeap

user32

MessageBoxW

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
World of Warcraft 5.4.8 minimal/Scan-64.dll
.dll windows:5 windows x64 arch:x64

6dd65b7172f55acc1886a3b43edc91b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Sourcecodes\NormGITRepo\ScanVC10\Release\x64\ReleaseNoCompress\Scan-64.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

EnterCriticalSection
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
OpenProcess
GetCurrentProcessId
VirtualQueryEx
MultiByteToWideChar
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetSystemInfo
GetVersionExA
Module32Next
Module32First
GetModuleFileNameA
HeapFree
GetModuleFileNameW
GetProcessHeap
FreeLibrary
UnmapViewOfFile
VirtualFree
FlushInstructionCache
VirtualProtect
VirtualAlloc
VirtualQuery
MapViewOfFileEx
CreateFileMappingW
CreateFileW
LoadLibraryW
GetModuleHandleW
LeaveCriticalSection
GetStringTypeW
GetSystemTimeAsFileTime
GetTickCount
HeapSize
HeapAlloc
RtlUnwindEx
DecodePointer
EncodePointer
HeapReAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
WriteFile
GetStdHandle
GetLastError
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsFree
SetLastError
FlsAlloc
WideCharToMultiByte
LCMapStringW
RaiseException
RtlPcToFileHeader
Sleep
ExitProcess
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter

user32

GetShellWindow
EnumWindows
GetWindowThreadProcessId
GetWindowTextW
GetWindowTextA

advapi32

LookupPrivilegeValueW
PrivilegeCheck
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
World of Warcraft 5.4.8 minimal/Scan.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

UPX0
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
World of Warcraft 5.4.8 minimal/WTF/Config.wtf
World of Warcraft 5.4.8 minimal/Wow-32_NoFileCheck.exe
.exe windows:5 windows x86 arch:x86

60cb11d1a0462e45bc7845987dd5efdc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:a1:aa:68:02:ea:d5:f5:8a:6a:01:6d:4d:84:c5:65
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

03/12/2013, 00:00

Not After

04/12/2015, 23:59

Subject

CN=Blizzard Entertainment\, Inc.,OU=TECHNICAL SUPPORT,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

88:b8:fe:e8:3b:90:9e:c2:8e:d9:52:84:43:2c:1d:2f:96:a5:9b:1b
Signer

Actual PE Digest

88:b8:fe:e8:3b:90:9e:c2:8e:d9:52:84:43:2c:1d:2f:96:a5:9b:1b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BuildServer\WoW\5\work\WoW-code\branches\wow-patch-5_4_8-branch-fastpatch-0\WoW\Bin\Wow.pdb

Imports

kernel32

GetDiskFreeSpaceExW
GetShortPathNameW
SetFilePointer
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFileTime
SetFilePointerEx
GetModuleHandleExW
GetVersionExA
GetACP
IsWow64Process
GetNativeSystemInfo
GlobalMemoryStatusEx
GetProcessTimes
CreateEventA
Process32NextW
Process32FirstW
GetCompressedFileSizeA
CopyFileW
GetFullPathNameA
GetCommandLineW
GetWindowsDirectoryA
GetProcessAffinityMask
SetPriorityClass
GetPriorityClass
GetUserDefaultLangID
CreateIoCompletionPort
InterlockedExchange
WaitForMultipleObjects
GetQueuedCompletionStatus
DuplicateHandle
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
LocalAlloc
RaiseException
ResetEvent
GetDriveTypeA
GetSystemDirectoryA
OpenEventA
OpenFileMappingA
OpenFile
TerminateJobObject
SetInformationJobObject
QueryInformationJobObject
CreateJobObjectW
CreateFileMappingW
AssignProcessToJobObject
CreateMutexA
ReleaseMutex
VerifyVersionInfoW
VerSetConditionMask
HeapSetInformation
SetProcessAffinityMask
HeapAlloc
FlushFileBuffers
FormatMessageW
FindFirstFileA
CreateMutexW
HeapFree
ExitProcess
CreateSemaphoreA
CreateDirectoryA
SetHandleInformation
FlushInstructionCache
VirtualProtect
GetEnvironmentVariableW
IsProcessorFeaturePresent
GetStartupInfoW
UnhandledExceptionFilter
GetStdHandle
SetConsoleCtrlHandler
RtlUnwind
GetFullPathNameW
ExitThread
GetTimeFormatA
GetDateFormatA
HeapReAlloc
FindFirstFileExA
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetLocaleInfoW
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
HeapSize
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeW
CompareStringW
GetDriveTypeW
PeekNamedPipe
SetStdHandle
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetEnvironmentVariableA
FindNextFileW
ReadFile
RtlCaptureContext
CreateFileMappingA
MapViewOfFile
WaitForSingleObjectEx
UnmapViewOfFile
GetTempPathA
DeleteFileA
GetSystemTimeAsFileTime
DeleteFileW
GetVolumeInformationW
MoveFileW
SetCurrentDirectoryW
GetFileSize
GetCompressedFileSizeW
GetFileAttributesExW
CreateFileA
InterlockedIncrement
CreateThread
InterlockedDecrement
GetDiskFreeSpaceW
Module32Next
Module32First
Process32Next
Process32First
GetVersionExW
TlsSetValue
MultiByteToWideChar
GetCurrentDirectoryW
GetModuleFileNameW
FindFirstFileW
SetEnvironmentVariableW
GetDiskFreeSpaceA
WaitForMultipleObjectsEx
WriteFileEx
ReadFileEx
CancelIo
MulDiv
ExpandEnvironmentStringsA
SleepEx
FindClose
QueryPerformanceFrequency
TlsAlloc
SetThreadAffinityMask
FormatMessageA
GetComputerNameW
CreateProcessW
CreateDirectoryW
GetFileAttributesW
GetLocalTime
OpenThread
SuspendThread
GetThreadContext
IsBadWritePtr
DebugActiveProcess
GetSystemWindowsDirectoryW
SetConsoleTextAttribute
GetConsoleWindow
AllocConsole
SetConsoleTitleW
GetConsoleScreenBufferInfo
GetExitCodeThread
MoveFileExW
OutputDebugStringW
SetLastError
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentThread
QueryPerformanceCounter
TlsFree
TlsGetValue
GetThreadPriority
SetThreadPriority
TerminateThread
ResumeThread
Sleep
GlobalMemoryStatus
ReleaseSemaphore
CreateSemaphoreW
DeleteCriticalSection
LeaveCriticalSection
GetModuleHandleA
EnterCriticalSection
InitializeCriticalSection
WaitForSingleObject
SetEvent
InterlockedCompareExchange
LoadLibraryA
FreeLibrary
GetProcAddress
GetSystemInfo
GetFileInformationByHandle
GetFileSizeEx
DeviceIoControl
SetUnhandledExceptionFilter
VirtualQuery
VirtualFree
VirtualAlloc
GetCurrentProcess
TerminateProcess
WriteFile
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
Thread32Next
CloseHandle
GetCurrentThreadId
GetModuleFileNameA
IsDebuggerPresent
OutputDebugStringA
GetOverlappedResult
WideCharToMultiByte
CreateFileW
CreateEventW
GetComputerNameA
ConvertThreadToFiber
GetLastError
CreateFiberEx
SwitchToFiber
LocalFree
DeleteFiber
ConvertFiberToThread
LoadLibraryW
GetTickCount
GetProcessHeap
GetModuleHandleW

shell32

SHGetSpecialFolderPathA
FindExecutableA
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteW
ShellExecuteA

secur32

GetUserNameExW

wintrust

WinVerifyTrust

crypt32

CryptQueryObject
CryptProtectData
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptUnprotectData

gdi32

CreateBitmap
CreateDIBSection
SetPixelFormat
DescribePixelFormat
SetDeviceGammaRamp
GetPixelFormat
ChoosePixelFormat
TranslateCharsetInfo
GdiFlush
DeleteObject
GetDeviceGammaRamp
GetStockObject
DeleteDC
StretchBlt
BitBlt
CreateCompatibleDC
OffsetViewportOrgEx
SetViewportOrgEx
SelectClipRgn
CreateRectRgn
Rectangle
CreateFontIndirectA
GetObjectA
SetMapMode
SetBkMode
CreateSolidBrush
SetTextColor
SetBkColor
SelectObject

ole32

CoTaskMemFree
CoUninitialize
CLSIDFromString
CoCreateInstance
PropVariantClear
CoInitialize

wininet

InternetSetOptionA
InternetConnectA
InternetReadFileExA
InternetOpenA
HttpSendRequestA
InternetSetCookieW
HttpOpenRequestA
InternetCrackUrlA
InternetCloseHandle
InternetSetStatusCallbackA
HttpQueryInfoA

winmm

timeSetEvent
timeGetTime
waveOutGetNumDevs
waveInGetNumDevs
mciSendCommandA
waveInClose
timeKillEvent
waveOutGetDevCapsA
waveOutPrepareHeader
waveInReset
waveInOpen
waveInStart
waveInGetDevCapsA
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveOutGetPosition
waveOutReset
waveOutWrite
waveOutUnprepareHeader
waveOutOpen
waveOutClose

d3d9

D3DPERF_SetOptions

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA
ImmAssociateContext
ImmSetConversionStatus
ImmAssociateContextEx
ImmNotifyIME
ImmGetCandidateListA
ImmGetConversionStatus

msacm32

acmStreamPrepareHeader
acmStreamConvert
acmStreamUnprepareHeader
acmFormatSuggest
acmStreamOpen
acmStreamSize

ws2_32

send
getsockopt
WSACleanup
accept
ioctlsocket
select
WSAGetLastError
WSASetLastError
WSAStartup
setsockopt
closesocket
__WSAFDIsSet
connect
listen
bind
htons
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
socket
WSAIoctl
recvfrom
inet_ntoa
WSAAsyncGetHostByName
freeaddrinfo
getaddrinfo
WSACancelAsyncRequest
htonl
gethostbyname
gethostname
ntohl
getpeername
getsockname
sendto
recv
inet_addr
ntohs

user32

SetTimer
WaitForInputIdle
GetMonitorInfoA
ClipCursor
ShowCursor
SetCursor
GetForegroundWindow
IsIconic
EnumDisplaySettingsA
ReleaseDC
GetDC
GetClientRect
ScreenToClient
GetCursorPos
UnregisterClassA
SetClassLongA
CreateIconIndirect
EnumDisplayDevicesA
DefWindowProcA
EndPaint
BeginPaint
SetWindowLongA
GetWindowLongA
RegisterClassExA
LoadImageA
CreateWindowExA
AdjustWindowRectEx
EnumDisplayMonitors
ChangeDisplaySettingsExA
MapWindowPoints
SetCursorPos
MapVirtualKeyA
VkKeyScanA
ClientToScreen
GetAsyncKeyState
SystemParametersInfoA
UnhookWindowsHookEx
SendInput
SetCapture
ReleaseCapture
MoveWindow
GetWindowPlacement
SetFocus
IsZoomed
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetPropA
GetParent
IsWindow
KillTimer
GetClipboardData
OpenClipboard
MessageBeep
MessageBoxW
GetKeyState
FillRect
IsDialogMessageA
TranslateAcceleratorA
GetKeyboardLayout
SetClipboardData
EmptyClipboard
CharLowerBuffA
LoadStringA
MessageBoxA
wsprintfA
LoadBitmapA
DefWindowProcW
UnregisterClassW
CreateWindowExW
RegisterClassExW
DrawTextExA
InvertRect
DrawTextExW
DestroyIcon
PeekMessageW
GetMessageW
IsDialogMessageW
GetDesktopWindow
CreateDialogParamW
GetDlgItem
LoadStringW
SetWindowTextW
ShowWindow
PostQuitMessage
SetWindowLongW
GetSystemMetrics
LoadImageW
SendMessageW
IsWindowVisible
GetWindowRect
SetWindowPos
CloseClipboard
GetActiveWindow
SendMessageA
PostMessageA
GetWindowTextW
DestroyWindow

iphlpapi

GetIfTable

advapi32

MakeSelfRelativeSD
RegCreateKeyExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyA
RegOpenKeyA
ImpersonateLoggedOnUser
DuplicateTokenEx
RegSetValueExW
GetUserNameA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegFlushKey
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
CryptGenRandom
RegDeleteValueW
RevertToSelf
CreateProcessAsUserW
GetSecurityDescriptorDacl
GetSecurityInfo
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetEntriesInAclW
CreateWellKnownSid
BuildSecurityDescriptorW
SetKernelObjectSecurity
SetTokenInformation
CreateRestrictedToken
EqualSid
CopySid
LookupPrivilegeValueA
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGenKey
CryptExportKey
CryptImportKey
CryptEncrypt
CryptAcquireContextW
MakeAbsoluteSD
CryptCreateHash
GetLengthSid
IsValidSid
AddAce
GetTokenInformation
InitializeAcl
SetSecurityInfo
CryptHashData
CryptDestroyHash
CryptGetHashParam

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpGetDefaultProxyConfiguration
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpOpen

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA

Exports

Exports

AssertAndCrash
GetBattlenetAllocator

Sections

.text
Size: 9.1MB - Virtual size: 9.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 721KB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 659KB - Virtual size: 658KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
World of Warcraft 5.4.8 minimal/Wow-64.exe
.exe windows:5 windows x64 arch:x64

29ac7a5ffc8d8079facc015464e70263

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:a1:aa:68:02:ea:d5:f5:8a:6a:01:6d:4d:84:c5:65
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

03/12/2013, 00:00

Not After

04/12/2015, 23:59

Subject

CN=Blizzard Entertainment\, Inc.,OU=TECHNICAL SUPPORT,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

84:32:6b:92:fb:b5:e3:a9:92:60:8a:c6:91:b8:b0:0b:cb:89:ed:c9
Signer

Actual PE Digest

84:32:6b:92:fb:b5:e3:a9:92:60:8a:c6:91:b8:b0:0b:cb:89:ed:c9

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BuildServer\WoW\3\work\WoW-code\branches\wow-patch-5_4_8-branch-fastpatch-0\WoW\Bin\Wow-64.pdb

Imports

kernel32

SetFilePointerEx
GetModuleHandleExW
GetVersionExA
GetACP
GlobalMemoryStatusEx
GetProcessTimes
CreateEventA
Process32NextW
Process32FirstW
GetCompressedFileSizeA
CopyFileW
GetFullPathNameA
GetCommandLineW
GetWindowsDirectoryA
GetProcessAffinityMask
SetPriorityClass
GetPriorityClass
LocalFree
GetUserDefaultLangID
CreateIoCompletionPort
WaitForMultipleObjects
GetQueuedCompletionStatus
DuplicateHandle
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
LocalAlloc
RaiseException
ResetEvent
GetDriveTypeA
GetSystemDirectoryA
OpenEventA
OpenFileMappingA
TerminateJobObject
SetInformationJobObject
QueryInformationJobObject
CreateJobObjectW
CreateFileMappingW
AssignProcessToJobObject
CreateMutexA
ReleaseMutex
VerifyVersionInfoW
VerSetConditionMask
SetProcessAffinityMask
HeapAlloc
GetProcessHeap
FormatMessageW
FindFirstFileA
CreateMutexW
SetUnhandledExceptionFilter
HeapFree
ExitProcess
CreateSemaphoreA
CreateDirectoryA
SetHandleInformation
SetFileTime
RtlAddFunctionTable
FlushInstructionCache
VirtualProtect
GetEnvironmentVariableW
GetStartupInfoW
UnhandledExceptionFilter
GetStdHandle
SetConsoleCtrlHandler
RtlUnwindEx
RtlPcToFileHeader
GetFullPathNameW
ExitThread
GetDateFormatA
GetTimeFormatA
HeapReAlloc
FindFirstFileExA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
GetLocaleInfoW
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
HeapSize
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeW
CompareStringW
GetDriveTypeW
PeekNamedPipe
SetStdHandle
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetEnvironmentVariableA
SetFileAttributesW
SetEndOfFile
RemoveDirectoryW
SetFilePointer
GetShortPathNameW
GetDiskFreeSpaceExW
FlushFileBuffers
FindNextFileW
ReadFile
RtlLookupFunctionEntry
RtlVirtualUnwind
CreateFileMappingA
MapViewOfFile
WaitForSingleObjectEx
UnmapViewOfFile
GetTempPathA
DeleteFileA
GetSystemTimeAsFileTime
DeleteFileW
GetVolumeInformationW
MoveFileW
SetCurrentDirectoryW
GetFileSize
GetCompressedFileSizeW
GetFileAttributesExW
CreateFileA
CreateThread
GetDiskFreeSpaceW
Module32Next
Module32First
Process32Next
Process32First
GetVersionExW
TlsSetValue
SetEnvironmentVariableW
GetDiskFreeSpaceA
WaitForMultipleObjectsEx
WriteFileEx
ReadFileEx
MultiByteToWideChar
GetCurrentDirectoryW
GetModuleFileNameW
FindFirstFileW
FindClose
QueryPerformanceFrequency
TlsAlloc
SetThreadAffinityMask
FormatMessageA
GetCurrentThreadId
CreateToolhelp32Snapshot
Thread32First
OpenThread
CancelIo
MulDiv
SignalObjectAndWait
SearchPathW
SetErrorMode
ExpandEnvironmentStringsA
SleepEx
DebugActiveProcess
IsProcessorFeaturePresent
GetNativeSystemInfo
GetSystemWindowsDirectoryW
SetConsoleTextAttribute
GetConsoleWindow
AllocConsole
SetConsoleTitleW
GetConsoleScreenBufferInfo
GetExitCodeThread
MoveFileExW
OutputDebugStringW
SuspendThread
GetThreadContext
Thread32Next
RtlCaptureContext
VirtualFree
VirtualAlloc
GetComputerNameW
CreateProcessW
CreateDirectoryW
GetFileAttributesW
GetLocalTime
VirtualQuery
SetLastError
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentThread
QueryPerformanceCounter
TlsFree
TlsGetValue
GetThreadPriority
SetThreadPriority
TerminateThread
ResumeThread
GetCurrentProcessId
Sleep
GlobalMemoryStatus
ReleaseSemaphore
CreateSemaphoreW
DeleteCriticalSection
LeaveCriticalSection
GetModuleHandleA
EnterCriticalSection
InitializeCriticalSection
WaitForSingleObject
SetEvent
LoadLibraryA
FreeLibrary
GetProcAddress
GetSystemInfo
GetFileInformationByHandle
GetFileSizeEx
DeviceIoControl
GetVersion
GetCurrentProcess
TerminateProcess
CloseHandle
WriteFile
GetModuleFileNameA
IsDebuggerPresent
OutputDebugStringA
GetOverlappedResult
WideCharToMultiByte
GetLastError
CreateFileW
CreateEventW
GetComputerNameA
LoadLibraryW
GetTickCount
RtlDeleteFunctionTable
GetModuleHandleW

shell32

SHGetSpecialFolderPathA
FindExecutableA
SHGetFolderPathW
ShellExecuteW
ShellExecuteA

secur32

GetUserNameExW

wintrust

WinVerifyTrust

crypt32

CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CryptUnprotectData
CertGetNameStringW
CryptProtectData

gdi32

GetStockObject
TranslateCharsetInfo
ChoosePixelFormat
GetPixelFormat
SetDeviceGammaRamp
DescribePixelFormat
SetPixelFormat
CreateDIBSection
CreateBitmap
DeleteObject
DeleteDC
StretchBlt
BitBlt
CreateCompatibleDC
OffsetViewportOrgEx
SetViewportOrgEx
SelectClipRgn
CreateRectRgn
Rectangle
CreateFontIndirectA
GetObjectA
SetMapMode
GdiFlush
SetBkMode
CreateSolidBrush
SetTextColor
SetBkColor
SelectObject
GetDeviceGammaRamp

ole32

CoInitialize

wininet

InternetSetOptionA
InternetConnectA
InternetReadFileExA
InternetOpenA
HttpSendRequestA
InternetSetCookieW
HttpOpenRequestA
InternetCrackUrlA
InternetCloseHandle
HttpQueryInfoA
InternetSetStatusCallbackA

winmm

waveOutGetDevCapsA
waveOutClose
waveOutGetNumDevs
waveInGetNumDevs
mciSendCommandA
timeGetTime
waveOutOpen
waveOutUnprepareHeader
waveOutPrepareHeader
waveInReset
waveInClose
waveInOpen
waveInStart
waveInGetDevCapsA
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveOutGetPosition
waveOutReset
waveOutWrite

d3d9

D3DPERF_SetOptions

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

imm32

ImmReleaseContext
ImmGetConversionStatus
ImmGetContext
ImmGetCompositionStringA
ImmAssociateContext
ImmSetConversionStatus
ImmAssociateContextEx
ImmNotifyIME
ImmGetCandidateListA

msacm32

acmStreamPrepareHeader
acmStreamConvert
acmStreamUnprepareHeader
acmFormatSuggest
acmStreamOpen
acmStreamSize

ws2_32

send
getsockopt
WSACleanup
accept
ioctlsocket
select
WSAGetLastError
WSASetLastError
WSAStartup
setsockopt
socket
closesocket
__WSAFDIsSet
connect
listen
bind
htons
htonl
WSAEventSelect
WSAEnumNetworkEvents
WSAAsyncGetHostByName
freeaddrinfo
recvfrom
WSACloseEvent
gethostbyname
gethostname
ntohl
getpeername
getsockname
sendto
recv
inet_addr
ntohs
inet_ntoa
WSAIoctl
WSACancelAsyncRequest
getaddrinfo
WSACreateEvent

user32

GetDC
GetClientRect
ScreenToClient
GetCursorPos
UnregisterClassA
SetClassLongPtrA
CreateIconIndirect
EnumDisplayDevicesA
DefWindowProcA
EndPaint
BeginPaint
SetWindowLongPtrA
GetWindowLongPtrA
RegisterClassExA
LoadImageA
CreateWindowExA
AdjustWindowRectEx
EnumDisplayMonitors
ChangeDisplaySettingsExA
MapWindowPoints
SetCursorPos
MapVirtualKeyA
VkKeyScanA
ClientToScreen
GetAsyncKeyState
SystemParametersInfoA
UnhookWindowsHookEx
SendInput
SetCapture
ReleaseCapture
MoveWindow
GetWindowPlacement
SetFocus
IsZoomed
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetWindowLongA
GetPropA
GetParent
CloseClipboard
GetClipboardData
OpenClipboard
IsIconic
ReleaseDC
MessageBeep
MessageBoxW
GetKeyState
FillRect
IsDialogMessageA
TranslateAcceleratorA
GetKeyboardLayout
SetClipboardData
EmptyClipboard
LoadStringA
MessageBoxA
wsprintfA
LoadBitmapA
DefWindowProcW
UnregisterClassW
CreateWindowExW
RegisterClassExW
DrawTextExA
InvertRect
DrawTextExW
SetTimer
KillTimer
GetActiveWindow
IsWindow
IsWindowVisible
GetWindowRect
SetWindowPos
SendMessageA
PostMessageA
GetWindowTextW
DestroyWindow
DestroyIcon
PeekMessageW
GetMessageW
IsDialogMessageW
GetDesktopWindow
CreateDialogParamW
GetDlgItem
LoadStringW
SetWindowTextW
ShowWindow
PostQuitMessage
SetWindowLongPtrW
GetSystemMetrics
LoadImageW
SendMessageW
GetForegroundWindow
SetCursor
EnumDisplaySettingsA
ShowCursor
ClipCursor
GetMonitorInfoA
WaitForInputIdle

iphlpapi

GetIfTable

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
ImpersonateLoggedOnUser
GetUserNameA
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptGetHashParam
OpenProcessToken
CryptDestroyHash
SetSecurityInfo
InitializeAcl
DuplicateTokenEx
RevertToSelf
CreateProcessAsUserW
GetSecurityDescriptorDacl
GetSecurityInfo
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetEntriesInAclW
CreateWellKnownSid
BuildSecurityDescriptorW
SetKernelObjectSecurity
SetTokenInformation
CreateRestrictedToken
EqualSid
CopySid
LookupPrivilegeValueA
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGenKey
CryptExportKey
CryptImportKey
CryptEncrypt
CryptAcquireContextW
MakeAbsoluteSD
MakeSelfRelativeSD
GetLengthSid
IsValidSid
AddAce
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
CryptGenRandom
RegDeleteValueW
CryptCreateHash
CryptHashData

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpGetDefaultProxyConfiguration
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA

Exports

Exports

AssertAndCrash
GetBattlenetAllocator

Sections

.text
Size: 14.5MB - Virtual size: 14.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 968KB - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 897KB - Virtual size: 896KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 253KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
World of Warcraft 5.4.8 minimal/Wow-64_NoFileCheck.exe
.exe windows:5 windows x64 arch:x64

29ac7a5ffc8d8079facc015464e70263

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:a1:aa:68:02:ea:d5:f5:8a:6a:01:6d:4d:84:c5:65
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

03/12/2013, 00:00

Not After

04/12/2015, 23:59

Subject

CN=Blizzard Entertainment\, Inc.,OU=TECHNICAL SUPPORT,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1f:44:9e:34:b4:46:15:ed:98:ec:26:ef:18:e1:41:79:af:fa:1f:c5
Signer

Actual PE Digest

1f:44:9e:34:b4:46:15:ed:98:ec:26:ef:18:e1:41:79:af:fa:1f:c5

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BuildServer\WoW\3\work\WoW-code\branches\wow-patch-5_4_8-branch-fastpatch-0\WoW\Bin\Wow-64.pdb

Imports

kernel32

SetFilePointerEx
GetModuleHandleExW
GetVersionExA
GetACP
GlobalMemoryStatusEx
GetProcessTimes
CreateEventA
Process32NextW
Process32FirstW
GetCompressedFileSizeA
CopyFileW
GetFullPathNameA
GetCommandLineW
GetWindowsDirectoryA
GetProcessAffinityMask
SetPriorityClass
GetPriorityClass
LocalFree
GetUserDefaultLangID
CreateIoCompletionPort
WaitForMultipleObjects
GetQueuedCompletionStatus
DuplicateHandle
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
LocalAlloc
RaiseException
ResetEvent
GetDriveTypeA
GetSystemDirectoryA
OpenEventA
OpenFileMappingA
TerminateJobObject
SetInformationJobObject
QueryInformationJobObject
CreateJobObjectW
CreateFileMappingW
AssignProcessToJobObject
CreateMutexA
ReleaseMutex
VerifyVersionInfoW
VerSetConditionMask
SetProcessAffinityMask
HeapAlloc
GetProcessHeap
FormatMessageW
FindFirstFileA
CreateMutexW
SetUnhandledExceptionFilter
HeapFree
ExitProcess
CreateSemaphoreA
CreateDirectoryA
SetHandleInformation
SetFileTime
RtlAddFunctionTable
FlushInstructionCache
VirtualProtect
GetEnvironmentVariableW
GetStartupInfoW
UnhandledExceptionFilter
GetStdHandle
SetConsoleCtrlHandler
RtlUnwindEx
RtlPcToFileHeader
GetFullPathNameW
ExitThread
GetDateFormatA
GetTimeFormatA
HeapReAlloc
FindFirstFileExA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
GetLocaleInfoW
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
HeapSize
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeW
CompareStringW
GetDriveTypeW
PeekNamedPipe
SetStdHandle
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetEnvironmentVariableA
SetFileAttributesW
SetEndOfFile
RemoveDirectoryW
SetFilePointer
GetShortPathNameW
GetDiskFreeSpaceExW
FlushFileBuffers
FindNextFileW
ReadFile
RtlLookupFunctionEntry
RtlVirtualUnwind
CreateFileMappingA
MapViewOfFile
WaitForSingleObjectEx
UnmapViewOfFile
GetTempPathA
DeleteFileA
GetSystemTimeAsFileTime
DeleteFileW
GetVolumeInformationW
MoveFileW
SetCurrentDirectoryW
GetFileSize
GetCompressedFileSizeW
GetFileAttributesExW
CreateFileA
CreateThread
GetDiskFreeSpaceW
Module32Next
Module32First
Process32Next
Process32First
GetVersionExW
TlsSetValue
SetEnvironmentVariableW
GetDiskFreeSpaceA
WaitForMultipleObjectsEx
WriteFileEx
ReadFileEx
MultiByteToWideChar
GetCurrentDirectoryW
GetModuleFileNameW
FindFirstFileW
FindClose
QueryPerformanceFrequency
TlsAlloc
SetThreadAffinityMask
FormatMessageA
GetCurrentThreadId
CreateToolhelp32Snapshot
Thread32First
OpenThread
CancelIo
MulDiv
SignalObjectAndWait
SearchPathW
SetErrorMode
ExpandEnvironmentStringsA
SleepEx
DebugActiveProcess
IsProcessorFeaturePresent
GetNativeSystemInfo
GetSystemWindowsDirectoryW
SetConsoleTextAttribute
GetConsoleWindow
AllocConsole
SetConsoleTitleW
GetConsoleScreenBufferInfo
GetExitCodeThread
MoveFileExW
OutputDebugStringW
SuspendThread
GetThreadContext
Thread32Next
RtlCaptureContext
VirtualFree
VirtualAlloc
GetComputerNameW
CreateProcessW
CreateDirectoryW
GetFileAttributesW
GetLocalTime
VirtualQuery
SetLastError
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentThread
QueryPerformanceCounter
TlsFree
TlsGetValue
GetThreadPriority
SetThreadPriority
TerminateThread
ResumeThread
GetCurrentProcessId
Sleep
GlobalMemoryStatus
ReleaseSemaphore
CreateSemaphoreW
DeleteCriticalSection
LeaveCriticalSection
GetModuleHandleA
EnterCriticalSection
InitializeCriticalSection
WaitForSingleObject
SetEvent
LoadLibraryA
FreeLibrary
GetProcAddress
GetSystemInfo
GetFileInformationByHandle
GetFileSizeEx
DeviceIoControl
GetVersion
GetCurrentProcess
TerminateProcess
CloseHandle
WriteFile
GetModuleFileNameA
IsDebuggerPresent
OutputDebugStringA
GetOverlappedResult
WideCharToMultiByte
GetLastError
CreateFileW
CreateEventW
GetComputerNameA
LoadLibraryW
GetTickCount
RtlDeleteFunctionTable
GetModuleHandleW

shell32

SHGetSpecialFolderPathA
FindExecutableA
SHGetFolderPathW
ShellExecuteW
ShellExecuteA

secur32

GetUserNameExW

wintrust

WinVerifyTrust

crypt32

CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CryptUnprotectData
CertGetNameStringW
CryptProtectData

gdi32

GetStockObject
TranslateCharsetInfo
ChoosePixelFormat
GetPixelFormat
SetDeviceGammaRamp
DescribePixelFormat
SetPixelFormat
CreateDIBSection
CreateBitmap
DeleteObject
DeleteDC
StretchBlt
BitBlt
CreateCompatibleDC
OffsetViewportOrgEx
SetViewportOrgEx
SelectClipRgn
CreateRectRgn
Rectangle
CreateFontIndirectA
GetObjectA
SetMapMode
GdiFlush
SetBkMode
CreateSolidBrush
SetTextColor
SetBkColor
SelectObject
GetDeviceGammaRamp

ole32

CoInitialize

wininet

InternetSetOptionA
InternetConnectA
InternetReadFileExA
InternetOpenA
HttpSendRequestA
InternetSetCookieW
HttpOpenRequestA
InternetCrackUrlA
InternetCloseHandle
HttpQueryInfoA
InternetSetStatusCallbackA

winmm

waveOutGetDevCapsA
waveOutClose
waveOutGetNumDevs
waveInGetNumDevs
mciSendCommandA
timeGetTime
waveOutOpen
waveOutUnprepareHeader
waveOutPrepareHeader
waveInReset
waveInClose
waveInOpen
waveInStart
waveInGetDevCapsA
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveOutGetPosition
waveOutReset
waveOutWrite

d3d9

D3DPERF_SetOptions

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

imm32

ImmReleaseContext
ImmGetConversionStatus
ImmGetContext
ImmGetCompositionStringA
ImmAssociateContext
ImmSetConversionStatus
ImmAssociateContextEx
ImmNotifyIME
ImmGetCandidateListA

msacm32

acmStreamPrepareHeader
acmStreamConvert
acmStreamUnprepareHeader
acmFormatSuggest
acmStreamOpen
acmStreamSize

ws2_32

send
getsockopt
WSACleanup
accept
ioctlsocket
select
WSAGetLastError
WSASetLastError
WSAStartup
setsockopt
socket
closesocket
__WSAFDIsSet
connect
listen
bind
htons
htonl
WSAEventSelect
WSAEnumNetworkEvents
WSAAsyncGetHostByName
freeaddrinfo
recvfrom
WSACloseEvent
gethostbyname
gethostname
ntohl
getpeername
getsockname
sendto
recv
inet_addr
ntohs
inet_ntoa
WSAIoctl
WSACancelAsyncRequest
getaddrinfo
WSACreateEvent

user32

GetDC
GetClientRect
ScreenToClient
GetCursorPos
UnregisterClassA
SetClassLongPtrA
CreateIconIndirect
EnumDisplayDevicesA
DefWindowProcA
EndPaint
BeginPaint
SetWindowLongPtrA
GetWindowLongPtrA
RegisterClassExA
LoadImageA
CreateWindowExA
AdjustWindowRectEx
EnumDisplayMonitors
ChangeDisplaySettingsExA
MapWindowPoints
SetCursorPos
MapVirtualKeyA
VkKeyScanA
ClientToScreen
GetAsyncKeyState
SystemParametersInfoA
UnhookWindowsHookEx
SendInput
SetCapture
ReleaseCapture
MoveWindow
GetWindowPlacement
SetFocus
IsZoomed
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetWindowLongA
GetPropA
GetParent
CloseClipboard
GetClipboardData
OpenClipboard
IsIconic
ReleaseDC
MessageBeep
MessageBoxW
GetKeyState
FillRect
IsDialogMessageA
TranslateAcceleratorA
GetKeyboardLayout
SetClipboardData
EmptyClipboard
LoadStringA
MessageBoxA
wsprintfA
LoadBitmapA
DefWindowProcW
UnregisterClassW
CreateWindowExW
RegisterClassExW
DrawTextExA
InvertRect
DrawTextExW
SetTimer
KillTimer
GetActiveWindow
IsWindow
IsWindowVisible
GetWindowRect
SetWindowPos
SendMessageA
PostMessageA
GetWindowTextW
DestroyWindow
DestroyIcon
PeekMessageW
GetMessageW
IsDialogMessageW
GetDesktopWindow
CreateDialogParamW
GetDlgItem
LoadStringW
SetWindowTextW
ShowWindow
PostQuitMessage
SetWindowLongPtrW
GetSystemMetrics
LoadImageW
SendMessageW
GetForegroundWindow
SetCursor
EnumDisplaySettingsA
ShowCursor
ClipCursor
GetMonitorInfoA
WaitForInputIdle

iphlpapi

GetIfTable

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
ImpersonateLoggedOnUser
GetUserNameA
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptGetHashParam
OpenProcessToken
CryptDestroyHash
SetSecurityInfo
InitializeAcl
DuplicateTokenEx
RevertToSelf
CreateProcessAsUserW
GetSecurityDescriptorDacl
GetSecurityInfo
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetEntriesInAclW
CreateWellKnownSid
BuildSecurityDescriptorW
SetKernelObjectSecurity
SetTokenInformation
CreateRestrictedToken
EqualSid
CopySid
LookupPrivilegeValueA
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGenKey
CryptExportKey
CryptImportKey
CryptEncrypt
CryptAcquireContextW
MakeAbsoluteSD
MakeSelfRelativeSD
GetLengthSid
IsValidSid
AddAce
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
CryptGenRandom
RegDeleteValueW
CryptCreateHash
CryptHashData

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpGetDefaultProxyConfiguration
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA

Exports

Exports

AssertAndCrash
GetBattlenetAllocator

Sections

.text
Size: 14.5MB - Virtual size: 14.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 968KB - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 897KB - Virtual size: 896KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 253KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
World of Warcraft 5.4.8 minimal/Wow.exe
.exe windows:5 windows x86 arch:x86

60cb11d1a0462e45bc7845987dd5efdc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:a1:aa:68:02:ea:d5:f5:8a:6a:01:6d:4d:84:c5:65
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

03/12/2013, 00:00

Not After

04/12/2015, 23:59

Subject

CN=Blizzard Entertainment\, Inc.,OU=TECHNICAL SUPPORT,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

68:5e:b1:a1:78:ce:80:54:a9:c4:2b:6a:9a:c4:a9:95:ba:0b:92:a2
Signer

Actual PE Digest

68:5e:b1:a1:78:ce:80:54:a9:c4:2b:6a:9a:c4:a9:95:ba:0b:92:a2

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BuildServer\WoW\5\work\WoW-code\branches\wow-patch-5_4_8-branch-fastpatch-0\WoW\Bin\Wow.pdb

Imports

kernel32

GetDiskFreeSpaceExW
GetShortPathNameW
SetFilePointer
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFileTime
SetFilePointerEx
GetModuleHandleExW
GetVersionExA
GetACP
IsWow64Process
GetNativeSystemInfo
GlobalMemoryStatusEx
GetProcessTimes
CreateEventA
Process32NextW
Process32FirstW
GetCompressedFileSizeA
CopyFileW
GetFullPathNameA
GetCommandLineW
GetWindowsDirectoryA
GetProcessAffinityMask
SetPriorityClass
GetPriorityClass
GetUserDefaultLangID
CreateIoCompletionPort
InterlockedExchange
WaitForMultipleObjects
GetQueuedCompletionStatus
DuplicateHandle
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
LocalAlloc
RaiseException
ResetEvent
GetDriveTypeA
GetSystemDirectoryA
OpenEventA
OpenFileMappingA
OpenFile
TerminateJobObject
SetInformationJobObject
QueryInformationJobObject
CreateJobObjectW
CreateFileMappingW
AssignProcessToJobObject
CreateMutexA
ReleaseMutex
VerifyVersionInfoW
VerSetConditionMask
HeapSetInformation
SetProcessAffinityMask
HeapAlloc
FlushFileBuffers
FormatMessageW
FindFirstFileA
CreateMutexW
HeapFree
ExitProcess
CreateSemaphoreA
CreateDirectoryA
SetHandleInformation
FlushInstructionCache
VirtualProtect
GetEnvironmentVariableW
IsProcessorFeaturePresent
GetStartupInfoW
UnhandledExceptionFilter
GetStdHandle
SetConsoleCtrlHandler
RtlUnwind
GetFullPathNameW
ExitThread
GetTimeFormatA
GetDateFormatA
HeapReAlloc
FindFirstFileExA
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetLocaleInfoW
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
HeapSize
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeW
CompareStringW
GetDriveTypeW
PeekNamedPipe
SetStdHandle
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetEnvironmentVariableA
FindNextFileW
ReadFile
RtlCaptureContext
CreateFileMappingA
MapViewOfFile
WaitForSingleObjectEx
UnmapViewOfFile
GetTempPathA
DeleteFileA
GetSystemTimeAsFileTime
DeleteFileW
GetVolumeInformationW
MoveFileW
SetCurrentDirectoryW
GetFileSize
GetCompressedFileSizeW
GetFileAttributesExW
CreateFileA
InterlockedIncrement
CreateThread
InterlockedDecrement
GetDiskFreeSpaceW
Module32Next
Module32First
Process32Next
Process32First
GetVersionExW
TlsSetValue
MultiByteToWideChar
GetCurrentDirectoryW
GetModuleFileNameW
FindFirstFileW
SetEnvironmentVariableW
GetDiskFreeSpaceA
WaitForMultipleObjectsEx
WriteFileEx
ReadFileEx
CancelIo
MulDiv
ExpandEnvironmentStringsA
SleepEx
FindClose
QueryPerformanceFrequency
TlsAlloc
SetThreadAffinityMask
FormatMessageA
GetComputerNameW
CreateProcessW
CreateDirectoryW
GetFileAttributesW
GetLocalTime
OpenThread
SuspendThread
GetThreadContext
IsBadWritePtr
DebugActiveProcess
GetSystemWindowsDirectoryW
SetConsoleTextAttribute
GetConsoleWindow
AllocConsole
SetConsoleTitleW
GetConsoleScreenBufferInfo
GetExitCodeThread
MoveFileExW
OutputDebugStringW
SetLastError
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentThread
QueryPerformanceCounter
TlsFree
TlsGetValue
GetThreadPriority
SetThreadPriority
TerminateThread
ResumeThread
Sleep
GlobalMemoryStatus
ReleaseSemaphore
CreateSemaphoreW
DeleteCriticalSection
LeaveCriticalSection
GetModuleHandleA
EnterCriticalSection
InitializeCriticalSection
WaitForSingleObject
SetEvent
InterlockedCompareExchange
LoadLibraryA
FreeLibrary
GetProcAddress
GetSystemInfo
GetFileInformationByHandle
GetFileSizeEx
DeviceIoControl
SetUnhandledExceptionFilter
VirtualQuery
VirtualFree
VirtualAlloc
GetCurrentProcess
TerminateProcess
WriteFile
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
Thread32Next
CloseHandle
GetCurrentThreadId
GetModuleFileNameA
IsDebuggerPresent
OutputDebugStringA
GetOverlappedResult
WideCharToMultiByte
CreateFileW
CreateEventW
GetComputerNameA
ConvertThreadToFiber
GetLastError
CreateFiberEx
SwitchToFiber
LocalFree
DeleteFiber
ConvertFiberToThread
LoadLibraryW
GetTickCount
GetProcessHeap
GetModuleHandleW

shell32

SHGetSpecialFolderPathA
FindExecutableA
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteW
ShellExecuteA

secur32

GetUserNameExW

wintrust

WinVerifyTrust

crypt32

CryptQueryObject
CryptProtectData
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptUnprotectData

gdi32

CreateBitmap
CreateDIBSection
SetPixelFormat
DescribePixelFormat
SetDeviceGammaRamp
GetPixelFormat
ChoosePixelFormat
TranslateCharsetInfo
GdiFlush
DeleteObject
GetDeviceGammaRamp
GetStockObject
DeleteDC
StretchBlt
BitBlt
CreateCompatibleDC
OffsetViewportOrgEx
SetViewportOrgEx
SelectClipRgn
CreateRectRgn
Rectangle
CreateFontIndirectA
GetObjectA
SetMapMode
SetBkMode
CreateSolidBrush
SetTextColor
SetBkColor
SelectObject

ole32

CoTaskMemFree
CoUninitialize
CLSIDFromString
CoCreateInstance
PropVariantClear
CoInitialize

wininet

InternetSetOptionA
InternetConnectA
InternetReadFileExA
InternetOpenA
HttpSendRequestA
InternetSetCookieW
HttpOpenRequestA
InternetCrackUrlA
InternetCloseHandle
InternetSetStatusCallbackA
HttpQueryInfoA

winmm

timeSetEvent
timeGetTime
waveOutGetNumDevs
waveInGetNumDevs
mciSendCommandA
waveInClose
timeKillEvent
waveOutGetDevCapsA
waveOutPrepareHeader
waveInReset
waveInOpen
waveInStart
waveInGetDevCapsA
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveOutGetPosition
waveOutReset
waveOutWrite
waveOutUnprepareHeader
waveOutOpen
waveOutClose

d3d9

D3DPERF_SetOptions

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA
ImmAssociateContext
ImmSetConversionStatus
ImmAssociateContextEx
ImmNotifyIME
ImmGetCandidateListA
ImmGetConversionStatus

msacm32

acmStreamPrepareHeader
acmStreamConvert
acmStreamUnprepareHeader
acmFormatSuggest
acmStreamOpen
acmStreamSize

ws2_32

send
getsockopt
WSACleanup
accept
ioctlsocket
select
WSAGetLastError
WSASetLastError
WSAStartup
setsockopt
closesocket
__WSAFDIsSet
connect
listen
bind
htons
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
socket
WSAIoctl
recvfrom
inet_ntoa
WSAAsyncGetHostByName
freeaddrinfo
getaddrinfo
WSACancelAsyncRequest
htonl
gethostbyname
gethostname
ntohl
getpeername
getsockname
sendto
recv
inet_addr
ntohs

user32

SetTimer
WaitForInputIdle
GetMonitorInfoA
ClipCursor
ShowCursor
SetCursor
GetForegroundWindow
IsIconic
EnumDisplaySettingsA
ReleaseDC
GetDC
GetClientRect
ScreenToClient
GetCursorPos
UnregisterClassA
SetClassLongA
CreateIconIndirect
EnumDisplayDevicesA
DefWindowProcA
EndPaint
BeginPaint
SetWindowLongA
GetWindowLongA
RegisterClassExA
LoadImageA
CreateWindowExA
AdjustWindowRectEx
EnumDisplayMonitors
ChangeDisplaySettingsExA
MapWindowPoints
SetCursorPos
MapVirtualKeyA
VkKeyScanA
ClientToScreen
GetAsyncKeyState
SystemParametersInfoA
UnhookWindowsHookEx
SendInput
SetCapture
ReleaseCapture
MoveWindow
GetWindowPlacement
SetFocus
IsZoomed
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetPropA
GetParent
IsWindow
KillTimer
GetClipboardData
OpenClipboard
MessageBeep
MessageBoxW
GetKeyState
FillRect
IsDialogMessageA
TranslateAcceleratorA
GetKeyboardLayout
SetClipboardData
EmptyClipboard
CharLowerBuffA
LoadStringA
MessageBoxA
wsprintfA
LoadBitmapA
DefWindowProcW
UnregisterClassW
CreateWindowExW
RegisterClassExW
DrawTextExA
InvertRect
DrawTextExW
DestroyIcon
PeekMessageW
GetMessageW
IsDialogMessageW
GetDesktopWindow
CreateDialogParamW
GetDlgItem
LoadStringW
SetWindowTextW
ShowWindow
PostQuitMessage
SetWindowLongW
GetSystemMetrics
LoadImageW
SendMessageW
IsWindowVisible
GetWindowRect
SetWindowPos
CloseClipboard
GetActiveWindow
SendMessageA
PostMessageA
GetWindowTextW
DestroyWindow

iphlpapi

GetIfTable

advapi32

MakeSelfRelativeSD
RegCreateKeyExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyA
RegOpenKeyA
ImpersonateLoggedOnUser
DuplicateTokenEx
RegSetValueExW
GetUserNameA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegFlushKey
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
CryptGenRandom
RegDeleteValueW
RevertToSelf
CreateProcessAsUserW
GetSecurityDescriptorDacl
GetSecurityInfo
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetEntriesInAclW
CreateWellKnownSid
BuildSecurityDescriptorW
SetKernelObjectSecurity
SetTokenInformation
CreateRestrictedToken
EqualSid
CopySid
LookupPrivilegeValueA
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGenKey
CryptExportKey
CryptImportKey
CryptEncrypt
CryptAcquireContextW
MakeAbsoluteSD
CryptCreateHash
GetLengthSid
IsValidSid
AddAce
GetTokenInformation
InitializeAcl
SetSecurityInfo
CryptHashData
CryptDestroyHash
CryptGetHashParam

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpGetDefaultProxyConfiguration
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpOpen

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA

Exports

Exports

AssertAndCrash
GetBattlenetAllocator

Sections

.text
Size: 9.1MB - Virtual size: 9.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 721KB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 659KB - Virtual size: 658KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
World of Warcraft 5.4.8 minimal/dbghelp.dll
.dll windows:6 windows x86 arch:x86

fa6b094f828920cf8999743ff0004319

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

8f:30:24:0d:35:ff:73:8c:8f:ce:2e:fe:f2:26:b5:b2:12:d2:d0:aa
Signer

Actual PE Digest

8f:30:24:0d:35:ff:73:8c:8f:ce:2e:fe:f2:26:b5:b2:12:d2:d0:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dbghelp.pdb

Imports

msvcrt

_isatty
_write
_lseeki64
??3@YAXPAX@Z
_fileno
_read
__pioinfo
__badioinfo
ferror
wctomb
_snprintf
isleadbyte
mbtowc
_onexit
_lock
__dllonexit
_unlock
_ismbblead
_amsg_exit
_initterm
_XcptFilter
memmove
_iob
__mb_cur_max
strchr
_vsnwprintf
_errno
__CxxFrameHandler
iswspace
calloc
_itoa
_wcsdup
towlower
tolower
_wcslwr
time
_wctime
_ltoa
_strnicmp
_wcsnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
_strlwr
free
wcsrchr
strstr
memcpy
_wcsicmp
qsort
wcschr
wcsstr
wcsncmp
iswxdigit
memset
??2@YAPAXI@Z
iswprint
fflush
fprintf
atol
fclose
__unDName
iswdigit
_CxxThrowException
bsearch
_wfsopen
fread
fseek
wcstol
_wfullpath
_wgetenv
_get_osfhandle
_chsize
_close
_open_osfhandle
ftell
_memicmp
_mbscmp
??1type_info@@UAE@XZ
_wsopen

kernel32

HeapFree
MapViewOfFileEx
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
GetFileType
DeviceIoControl
SetFileAttributesW
CreateFileMappingW
InterlockedIncrement
InterlockedDecrement
LocalFree
FormatMessageW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedExchange
GetThreadSelectorEntry
CreateThread
TerminateThread
VirtualQueryEx
GetPriorityClass
GetThreadPriority
GetThreadTimes
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
GetSystemTimeAsFileTime
Sleep
GetVersion
GetSystemInfo
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
ReadProcessMemory
GetProcessHeap
GetFileAttributesA
SetErrorMode
WriteFile
OutputDebugStringA
VirtualFree
OpenProcess
GetCurrentProcessId
GetModuleHandleA
CreateFileMappingA
MapViewOfFile
DuplicateHandle
VirtualAlloc
VirtualProtect
CreateDirectoryA
UnmapViewOfFile
GetCurrentProcess
SetFilePointer
IsDBCSLeadByte
HeapAlloc
HeapReAlloc
GetVersionExA
InitializeCriticalSection
FindClose
SetLastError
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetLastError
TlsSetValue
TlsGetValue
FreeLibrary
LoadLibraryA
TlsAlloc
TlsFree
DeleteCriticalSection
HeapDestroy
HeapCreate
FlushViewOfFile

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymCleanup
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
itoldyouso
lmi
lminfo
omap
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
World of Warcraft 5.4.8 minimal/divxdecoder.dll
.dll windows:4 windows x86 arch:x86

e839dffc4abdf37d6e8b38debccd0446

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapFree
HeapAlloc
GetCommandLineA
GetVersion
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetProcAddress
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
FlushFileBuffers
SetFilePointer
CloseHandle
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

DivxDecode
InitializeDivxDecoder
SetOutputFormat
UnInitializeDivxDecoder

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
World of Warcraft 5.4.8 minimal/readme.txt

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 450KB - Virtual size: 449KB

.rsrc Size: 1024B - Virtual size: 920B

.reloc Size: 512B - Virtual size: 12B

9333ad3fc8e962a7d8c660d3e57faf62

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

54:a1:aa:68:02:ea:d5:f5:8a:6a:01:6d:4d:84:c5:65Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

46:ce:d0:59:82:e1:42:a8:4c:10:b3:65:0d:ec:10:6a:71:ef:d6:41Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

6dd65b7172f55acc1886a3b43edc91b9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

kernel32

user32

advapi32

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 33KB - Virtual size: 32KB

.data Size: 28KB - Virtual size: 33KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 68KB

UPX1 Size: 45KB - Virtual size: 48KB

.rsrc Size: 2KB - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 37KB - Virtual size: 37KB

.rdata Size: 24KB - Virtual size: 24KB

.data Size: 19KB - Virtual size: 22KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

60cb11d1a0462e45bc7845987dd5efdc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

.text
Size: 450KB - Virtual size: 449KB

.rsrc
Size: 1024B - Virtual size: 920B

.reloc
Size: 512B - Virtual size: 12B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

54:a1:aa:68:02:ea:d5:f5:8a:6a:01:6d:4d:84:c5:65
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

46:ce:d0:59:82:e1:42:a8:4c:10:b3:65:0d:ec:10:6a:71:ef:d6:41
Signer

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 28KB - Virtual size: 33KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

UPX0
Size: - Virtual size: 68KB

UPX1
Size: 45KB - Virtual size: 48KB

.rsrc
Size: 2KB - Virtual size: 4KB

.text
Size: 37KB - Virtual size: 37KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 19KB - Virtual size: 22KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

54:a1:aa:68:02:ea:d5:f5:8a:6a:01:6d:4d:84:c5:65
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

88:b8:fe:e8:3b:90:9e:c2:8e:d9:52:84:43:2c:1d:2f:96:a5:9b:1b
Signer

.text
Size: 9.1MB - Virtual size: 9.1MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 721KB - Virtual size: 4.2MB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 336KB - Virtual size: 335KB

.reloc
Size: 659KB - Virtual size: 658KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

54:a1:aa:68:02:ea:d5:f5:8a:6a:01:6d:4d:84:c5:65
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

84:32:6b:92:fb:b5:e3:a9:92:60:8a:c6:91:b8:b0:0b:cb:89:ed:c9
Signer