412c6d5e6bf5a9dde9e0eb9909b9ba1c[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

412c6d5e6bf5a9dde9e0eb9909b9ba1c.bin
Size

8.4MB
MD5

412c6d5e6bf5a9dde9e0eb9909b9ba1c
SHA1

1b4e3799718e4307eba2119498ab8a8302064fdf
SHA256

0344c5cb268497d4cf2cfc89fcdc8ef2a63b752ce4813158ec2cadaaa8f136ac
SHA512

40f1facef2fe6e77ee5e8db6f16eaffc3d865734d89b519b8c63c0f7c4cb6c3322289e83dd2f5e8c76e5025269f1fa96d3b9fa3bb54efd8c01c69b935efab3e6
SSDEEP

196608:SClXzbHqmv/n6H+136DVHzrSfmCEW3sxyAXvDF46r92HJF:SC8mv/n6et6hHzpBW3sxjbDJ27

Score

3^/10

Malware Config

Signatures

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
unpack002/$PLUGINSDIR/Fusion.dll
unpack002/$PLUGINSDIR/INetC.dll
unpack002/$PLUGINSDIR/StartMenu.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/UAC.dll
unpack002/$PLUGINSDIR/UserInfo.dll
unpack002/$PLUGINSDIR/nsDialogs.dll
unpack002/$PLUGINSDIR/nsis_appid.dll
unpack002/$R2/NSIS.Library.RegTool.v3.$_91_.exe

Files

412c6d5e6bf5a9dde9e0eb9909b9ba1c.bin
.zip

Password: infected
FileZilla_3.33.0_win64-setup_bundled.bin
.exe windows:4 windows x86 arch:x86

Password: infected

4ea4df5d94204fc550be1874e1b77ea7

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/02/2016, 00:00

Not After

13/02/2019, 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/02/2016, 00:00

Not After

13/02/2019, 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

94:54:51:c6:c5:25:f2:ab:9b:99:13:df:a8:63:0a:e9:7e:9a:6c:0b:0d:4b:d6:d3:1b:4f:49:90:21:49:a8:32
Signer

Actual PE Digest

94:54:51:c6:c5:25:f2:ab:9b:99:13:df:a8:63:0a:e9:7e:9a:6c:0b:0d:4b:d6:d3:1b:4f:49:90:21:49:a8:32

Digest Algorithm

sha256

PE Digest Matches

true

6d:b7:47:db:cc:e3:fa:85:43:c3:a0:00:0e:cd:cd:67:94:c2:9c:75
Signer

Actual PE Digest

6d:b7:47:db:cc:e3:fa:85:43:c3:a0:00:0e:cd:cd:67:94:c2:9c:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
Sleep
GetTickCount
CreateFileW
GetFileSize
MoveFileW
SetFileAttributesW
GetModuleFileNameW
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
WaitForSingleObject
GetCurrentProcess
CompareFileTime
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalAlloc
GetShortPathNameW
SearchPathW
lstrcmpiW
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
lstrcmpW
GetDiskFreeSpaceW
lstrlenW
lstrcpynW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW

user32

GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
wsprintfW
ScreenToClient
GetWindowRect
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
LoadImageW
SetTimer
SetWindowTextW
PostQuitMessage
ShowWindow
GetDlgItem
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow

gdi32

SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW

advapi32

RegDeleteKeyW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW

comctl32

ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 252KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Fusion.dll
.dll windows:4 windows x86 arch:x86

Password: infected

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

Bucigos
Buregohireg
Busemenelecec
Celihide
Cihenabani
Copat
Cosebu
Culucaco
Degonesob
Desetemoput
Difan
Fogamuhuh
Guhog
Haganega
Hahelokupi
Higad
Holokemamumer
Kafafem
Kunahodi
Nacocemom
Negekanipad
Pegufete
Peritokugemeg
Pilafel
Pipoh
Resenitim
Teradasab
Tolemokekof

Sections

CODE
Size: 985KB - Virtual size: 984KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/INetC.dll
.dll windows:4 windows x86 arch:x86

Password: infected

735e27ae3d7df8c0487e4353d04f6f28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LocalFree
WideCharToMultiByte
TerminateThread
lstrcpyW
LoadLibraryA
CreateThread
WaitForSingleObject
LocalAlloc
lstrcpynW
SleepEx
MulDiv
GetModuleHandleW
ReadFile
GetLastError
CreateFileW
lstrcmpiW
CreateFileA
lstrcatW
GetFileSize
SetFilePointer
lstrcmpW
MultiByteToWideChar
lstrlenA
WriteFile
lstrlenW
CloseHandle
GlobalAlloc
GlobalFree
GetTickCount
DeleteFileW

user32

GetDlgItem
DestroyWindow
GetClientRect
MessageBoxW
wsprintfA
SystemParametersInfoW
GetWindowTextW
GetWindowLongW
FindWindowExW
IsWindow
CreateDialogParamW
GetParent
ShowWindow
KillTimer
DispatchMessageW
LoadIconW
PostMessageW
IsDialogMessageW
GetMessageW
SetWindowPos
SendDlgItemMessageW
SetWindowTextW
TranslateMessage
GetWindowRect
RedrawWindow
SetTimer
EnableWindow
UpdateWindow
SetWindowLongW
wsprintfW
SendMessageW
SetDlgItemTextW
IsWindowVisible

comctl32

ord17

wininet

InternetConnectW
HttpOpenRequestW
InternetQueryOptionW
InternetErrorDlg
HttpSendRequestExW
InternetWriteFile
HttpSendRequestW
InternetSetFilePointer
HttpAddRequestHeadersA
FtpCreateDirectoryW
InternetCrackUrlW
FtpOpenFileW
InternetSetOptionW
InternetOpenW
InternetGetLastResponseInfoW
HttpEndRequestW
InternetReadFile
HttpAddRequestHeadersW
InternetCloseHandle
HttpQueryInfoW

Exports

Exports

get
head
post
put

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/StartMenu.dll
.dll windows:4 windows x86 arch:x86

Password: infected

80469f6834e579db68a646d49780b9d5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatW
FindClose
FindNextFileW
lstrcmpW
GetModuleHandleW
lstrcmpiW
MulDiv
lstrcpynW
GlobalAlloc
lstrcpyW
FindFirstFileW
GlobalFree

user32

GetMessageW
TranslateMessage
PostMessageW
DispatchMessageW
GetDlgItem
GetWindowLongW
CheckDlgButton
ShowWindow
LoadIconW
GetClientRect
MoveWindow
DestroyWindow
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextW
SendMessageW
IsDlgButtonChecked
GetWindowTextW
CreateDialogParamW
SetWindowLongW
wsprintfW
ScreenToClient
IsDialogMessageW
CallWindowProcW

gdi32

GetTextMetricsW
SelectObject

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoTaskMemFree

Exports

Exports

Init
Select
Show

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 578B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

Password: infected

fc0224e99e736751432961db63a41b76

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 851B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 610B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UAC.dll
.dll windows:4 windows x86 arch:x86

Password: infected

0ef725341a4aecf8398c0e2132f38049

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetLastError
GetCurrentProcessId
GetCommandLineW
GetProcAddress
CreateThread
GlobalFree
LoadLibraryA
OpenProcess
GlobalAlloc
CreateFileMappingW
Sleep
MapViewOfFile
GetModuleHandleW
UnmapViewOfFile
CreateEventW
SetCurrentDirectoryW
GetVersionExW
GetExitCodeProcess
lstrcatW
LocalFree
GetPrivateProfileStringW
FormatMessageW
GetPrivateProfileIntW
CreateProcessW
CloseHandle
GetLastError
DuplicateHandle
GetCurrentThreadId
lstrlenW
SetEvent
WaitForSingleObject
lstrcmpiW
GetExitCodeThread
GetModuleFileNameW

user32

SetWindowPos
GetClientRect
GetWindowThreadProcessId
SetWindowLongW
DefWindowProcW
GetDlgItem
CallWindowProcW
CallNextHookEx
GetClassNameW
PeekMessageW
DestroyWindow
SendMessageW
SetForegroundWindow
IsWindowVisible
MsgWaitForMultipleObjects
LoadStringW
EndDialog
EnableWindow
DialogBoxParamW
LoadImageW
MessageBoxW
GetWindowLongW
DispatchMessageW
ShowWindow
wsprintfW
CreateDialogParamW
GetWindowRect
IsDialogMessageW
FindWindowExW
CharNextW
CreateWindowExW
LoadIconW
PostMessageW
SetWindowsHookExW
UnhookWindowsHookEx
TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW
QueryServiceStatus
CloseServiceHandle
OpenProcessToken
OpenSCManagerW
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
EqualSid

ole32

CoInitialize

Exports

Exports

_

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

Password: infected

e1c0bd3d5b9f3f5cec7ea773ff66ac6e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentProcess
GlobalAlloc
GetCurrentThread
GetModuleHandleW
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynW

advapi32

OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 694B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 673B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

Password: infected

e2ee55bddad4241d619d6a8a38e2d869

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc

user32

DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
GetDlgItem
GetSysColor
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW

gdi32

SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 630B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsis_appid.dll
.dll windows:5 windows x86 arch:x86

486440cfe9a90cc06a50c4146cd7dcef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

SHStrDupW

kernel32

GlobalFree
GlobalAlloc
lstrcpyW

shell32

SHGetPropertyStoreFromParsingName

ole32

PropVariantClear

Exports

Exports

set_appid

Sections

.text
Size: 512B - Virtual size: 377B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 459B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R0
.dll regsvr32 windows:6 windows x86 arch:x86

266a29e29055c14fbb62718c8d05fe2e

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/02/2016, 00:00

Not After

13/02/2019, 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/02/2016, 00:00

Not After

13/02/2019, 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bb:65:25:bf:92:81:09:70:33:4f:c5:ad:ef:59:48:fb:24:f0:56:f7:46:32:bf:48:f4:a1:b6:a5:f4:77:c9:5b
Signer

Actual PE Digest

bb:65:25:bf:92:81:09:70:33:4f:c5:ad:ef:59:48:fb:24:f0:56:f7:46:32:bf:48:f4:a1:b6:a5:f4:77:c9:5b

Digest Algorithm

sha256

PE Digest Matches

true

93:f7:91:3e:23:af:73:ac:fe:c4:90:f4:9a:8c:99:8c:1f:49:3e:da
Signer

Actual PE Digest

93:f7:91:3e:23:af:73:ac:fe:c4:90:f4:9a:8c:99:8c:1f:49:3e:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegCreateKeyExW
RegCreateKeyW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW

kernel32

CloseHandle
CreateMutexW
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
MapViewOfFile
OpenFileMappingW
QueryPerformanceCounter
ReleaseMutex
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
free
fwrite
malloc
memcmp
strlen
strncmp
_unlock
_wcsicmp
abort
vfprintf
wcslen
wcsncmp
wcsncpy
wcsrchr
calloc

ole32

StringFromGUID2

shell32

SHChangeNotify

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 948B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R2/NSIS.Library.RegTool.v3.$_91_.exe
.exe windows:4 windows x86 arch:x86

426e5d2f67c4cd53dec61c5a41b3a666

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetProcAddress
WaitForSingleObject
CloseHandle
CreateProcessW
GetSystemDirectoryW
FreeLibrary
LoadLibraryExW
lstrcmpiA
lstrlenA
GlobalAlloc
GetCommandLineW
WriteFile
SetFilePointer
lstrcpyA
ReadFile
GetFileSize
SetErrorMode
GetWindowsDirectoryW
GetShortPathNameW
lstrcpyW
MoveFileExW
GlobalFree
GetModuleHandleW
GetModuleFileNameW
CreateFileW
GetFileAttributesW
lstrcatW

oleaut32

LoadTypeLi
RegisterTypeLi

advapi32

RegCloseKey
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyW

user32

CharNextW
wsprintfW
CharNextA
wsprintfA

ole32

OleInitialize
OleUninitialize

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
AUTHORS
GPL.html
.html
NEWS
docs/fzdefaults.xml.example
.xml
filezilla.exe
.exe windows:6 windows x64 arch:x64

5490f2b179be3474543964af275d1e4e

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/02/2016, 00:00

Not After

13/02/2019, 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/02/2016, 00:00

Not After

13/02/2019, 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:ed:14:dd:8e:6b:c3:b9:c5:c4:14:d9:c9:c0:1a:9c:2e:c4:55:98:bb:02:c0:0e:64:c5:20:1b:ad:1d:69:53
Signer

Actual PE Digest

2d:ed:14:dd:8e:6b:c3:b9:c5:c4:14:d9:c9:c0:1a:9c:2e:c4:55:98:bb:02:c0:0e:64:c5:20:1b:ad:1d:69:53

Digest Algorithm

sha256

PE Digest Matches

true

9d:1c:08:b4:c6:77:3b:07:b9:e5:b9:3d:14:d4:0a:cb:1a:9f:e6:2a
Signer

Actual PE Digest

9d:1c:08:b4:c6:77:3b:07:b9:e5:b9:3d:14:d4:0a:cb:1a:9f:e6:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AdjustTokenPrivileges
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptGetProvParam
CryptReleaseContext
CryptSetHashParam
CryptSetProvParam
CryptSignHashA
GetUserNameW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW

comctl32

CreateUpDownControl
ImageList_Add
ImageList_AddMasked
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_Draw
ImageList_EndDrag
ImageList_GetIcon
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_GetImageInfo
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_SetDragCursorImage
InitCommonControls

comdlg32

ChooseFontW
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW

crypt32

CertCloseStore
CertDeleteCertificateFromStore
CertEnumCRLsInStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreA
PFXImportCertStore

gdi32

Arc
BitBlt
CloseEnhMetaFile
CombineRgn
CopyEnhMetaFileW
CreateBitmap
CreateBitmapIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateDIBitmap
CreateEnhMetaFileW
CreateFontIndirectW
CreateHatchBrush
CreateICW
CreatePalette
CreatePatternBrush
CreatePen
CreatePolygonRgn
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
DeleteEnhMetaFile
DeleteObject
Ellipse
EnumFontFamiliesExW
EqualRgn
ExcludeClipRect
ExtCreatePen
ExtCreateRegion
ExtFloodFill
ExtSelectClipRgn
ExtTextOutW
GdiFlush
GetBkColor
GetCharABCWidthsW
GetClipBox
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetEnhMetaFileHeader
GetEnhMetaFileW
GetMetaFileBitsEx
GetNearestPaletteIndex
GetObjectType
GetObjectW
GetOutlineTextMetricsW
GetPaletteEntries
GetPixel
GetRegionData
GetRgnBox
GetStockObject
GetSystemPaletteEntries
GetTextExtentExPointW
GetTextExtentPoint32W
GetTextMetricsW
GetWinMetaFileBits
LineTo
MaskBlt
MoveToEx
OffsetRgn
PatBlt
Pie
PlayEnhMetaFile
PolyPolygon
Polygon
Polyline
PtInRegion
RealizePalette
RectInRegion
Rectangle
RoundRect
SelectClipRgn
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetBrushOrgEx
SetLayout
SetMapMode
SetMetaFileBitsEx
SetPixel
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextColor
SetViewportExtEx
SetViewportOrgEx
SetWinMetaFileBits
SetWindowExtEx
SetWindowOrgEx
StretchBlt
StretchDIBits

kernel32

AreFileApisANSI
CloseHandle
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
CreatePipe
CreateProcessW
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
EnumResourceNamesW
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FillConsoleOutputCharacterW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FindResourceW
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeConsole
FreeLibrary
GetACP
GetCPInfo
GetCommandLineW
GetComputerNameW
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetDriveTypeW
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLocaleInfoW
GetLogicalDriveStringsW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProfileStringW
GetShortPathNameW
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathA
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetVersionExW
GetVolumeInformationW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatusEx
GlobalSize
GlobalUnlock
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionEx
IsBadReadPtr
IsBadStringPtrA
IsDBCSLeadByteEx
IsValidCodePage
IsValidLocale
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LocalFree
LockFile
LockFileEx
LockResource
MapViewOfFile
MoveFileExW
MulDiv
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleOutputCharacterA
ReadFile
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryW
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCursorPosition
SetCurrentDirectoryW
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetFileTime
SetLastError
SetNamedPipeHandleState
SetThreadExecutionState
SetThreadLocale
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepConditionVariableCS
SuspendThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
TzSpecificLocalTimeToSystemTime
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeConditionVariable
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile

mpr

WNetGetConnectionW

msvcrt

__C_specific_handler
___lc_codepage_func
__dllonexit
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_chdrive
_close
_commit
_ctime64
_endthreadex
_environ
_errno
_exit
_fdopen
_filelengthi64
_fileno
_findclose
_findfirst64
_fmode
_fstat64
_fullpath
_get_osfhandle
_getcwd
_getdrive
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_mktime64
_onexit
_open
_open_osfhandle
_putws
_setjmp
_snwprintf
_stat64
_strdup
_stricmp
fwprintf
_strnicmp
_telli64
_time64
_unlock
_waccess
_wchmod
_wcsdup
_wcsicmp
_wfopen
_wgetenv
_wmkdir
_wopen
_wperror
_wputenv
_wremove
_wrename
_write
_wrmdir
_wtoi
abort
atof
atoi
bsearch
calloc
clearerr
clock
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fgetwc
fopen
fprintf
fputc
fputs
fputwc
fputws
fread
free
frexp
fseek
fsetpos
ftell
fwprintf
fwrite
getc
getenv
getwc
isalnum
isalpha
islower
isspace
isupper
iswalnum
iswalpha
iswctype
iswdigit
iswprint
iswspace
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
putwc
qsort
raise
rand
realloc
remove
setlocale
setvbuf
signal
sprintf
srand
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtol
strtoul
strxfrm
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
wcschr
wcscmp
wcscoll
wcscpy
wcsftime
wcslen
wcsncpy
wcspbrk
wcsspn
wcsstr
wcstol
wcstoul
wcsxfrm
_time64
_findnext64
longjmp
_timezone
_write
_tzset
_strdup
_read
_getpid
_fileno
_fdopen
_close

netapi32

NetApiBufferFree
NetShareEnum

normaliz

IdnToAscii

ole32

CoCreateInstance
CoFreeUnusedLibraries
CoLockObjectExternal
CoTaskMemAlloc
CoTaskMemFree
DoDragDrop
OleFlushClipboard
OleGetClipboard
OleInitialize
OleIsCurrentClipboard
OleSetClipboard
OleUninitialize
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop

oleaut32

SysAllocString
SysFreeString
SysReAllocString
SysStringLen

powrprof

SetSuspendState

shell32

DragAcceptFiles
DragFinish
DragQueryFileW
DragQueryPoint
ExtractIconExW
ExtractIconW
SHBrowseForFolderW
SHFileOperationW
SHGetFileInfoW
SHGetFolderPathW
SHGetIconOverlayIndexW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW

user32

AdjustWindowRectEx
AppendMenuW
BeginDeferWindowPos
BeginPaint
BringWindowToTop
CallNextHookEx
CallWindowProcW
ChangeDisplaySettingsW
CheckMenuItem
CheckMenuRadioItem
ChildWindowFromPoint
ChildWindowFromPointEx
ClientToScreen
CloseClipboard
CopyRect
CreateAcceleratorTableW
CreateDialogIndirectParamW
CreateDialogParamW
CreateIconIndirect
CreateMenu
CreatePopupMenu
CreateWindowExW
DdeClientTransaction
DdeConnect
DdeCreateDataHandle
DdeCreateStringHandleW
DdeDisconnect
DdeFreeDataHandle
DdeFreeStringHandle
DdeGetData
DdeGetLastError
DdeInitializeW
DdeNameService
DdePostAdvise
DdeQueryStringW
DdeUninitialize
DefWindowProcW
DeferWindowPos
DestroyAcceleratorTable
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIconEx
DrawMenuBar
DrawStateW
DrawTextW
EmptyClipboard
EnableMenuItem
EnableScrollBar
EnableWindow
EndDeferWindowPos
EndDialog
EndMenu
EndPaint
EnumClipboardFormats
EnumDisplaySettingsW
EnumThreadWindows
EnumWindows
ExitWindowsEx
FillRect
FindWindowExW
FlashWindow
GetActiveWindow
GetAsyncKeyState
GetCapture
GetClassInfoW
GetClassNameW
GetClientRect
GetClipboardData
GetClipboardFormatNameW
GetCursorPos
GetDC
GetDesktopWindow
GetDialogBaseUnits
GetDlgItem
GetDoubleClickTime
GetFocus
GetIconInfo
GetKeyState
GetKeyboardState
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoW
GetMenuState
GetMessagePos
GetMessageTime
GetMessageW
GetParent
GetScrollInfo
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetUpdateRgn
GetWindow
GetWindowDC
GetWindowLongPtrW
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
HideCaret
InflateRect
InsertMenuItemW
InsertMenuW
InvalidateRect
IsClipboardFormatAvailable
IsDialogMessageW
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadAcceleratorsW
LoadBitmapW
LoadCursorFromFileW
LoadCursorW
LoadIconW
LoadImageW
MapVirtualKeyW
MapWindowPoints
MessageBeep
MessageBoxW
ModifyMenuW
MoveWindow
MsgWaitForMultipleObjects
OffsetRect
OpenClipboard
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
PtInRect
RedrawWindow
RegisterClassW
RegisterClipboardFormatW
RegisterHotKey
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemoveMenu
ScreenToClient
ScrollWindow
SendMessageW
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemInfoW
SetParent
SetRect
SetRectEmpty
SetScrollInfo
SetTimer
SetWindowLongPtrW
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowTextW
SetWindowsHookExW
ShowCaret
ShowCursor
ShowWindow
SystemParametersInfoW
ToUnicode
TrackPopupMenu
TranslateAcceleratorW
TranslateMessage
UnhookWindowsHookEx
UnionRect
UnregisterClassW
UnregisterHotKey
UpdateWindow
ValidateRect
ValidateRgn
VkKeyScanW
WaitForInputIdle
WindowFromPoint
keybd_event

winmm

PlaySoundW

ws2_32

WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAIoctl
WSASetEvent
WSAWaitForMultipleEvents
freeaddrinfo
getaddrinfo
getnameinfo

wsock32

WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
accept
bind
closesocket
connect
getpeername
getsockname
ioctlsocket
listen
ntohs
recv
select
send
setsockopt
socket

Sections

.text
Size: 9.8MB - Virtual size: 9.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 314KB - Virtual size: 313KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 659KB - Virtual size: 659KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 267KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fzputtygen.exe
.exe windows:6 windows x64 arch:x64

17340f3e86811cd4d0e91363f85f2e9f

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/02/2016, 00:00

Not After

13/02/2019, 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/02/2016, 00:00

Not After

13/02/2019, 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ae:82:17:7f:5e:2e:76:36:0d:b4:f5:b4:1e:cf:93:a3:9a:4d:35:a1:a1:7f:95:d5:6f:54:8e:40:4c:ad:d0:78
Signer

Actual PE Digest

ae:82:17:7f:5e:2e:76:36:0d:b4:f5:b4:1e:cf:93:a3:9a:4d:35:a1:a1:7f:95:d5:6f:54:8e:40:4c:ad:d0:78

Digest Algorithm

sha256

PE Digest Matches

true

6e:df:63:44:13:30:e1:5d:fb:d7:c1:40:af:b4:03:66:ff:b7:8c:55
Signer

Actual PE Digest

6e:df:63:44:13:30:e1:5d:fb:d7:c1:40:af:b4:03:66:ff:b7:8c:55

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

GetUserNameA
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA

kernel32

CloseHandle
CreateFileA
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
FindClose
FindFirstFileA
FindNextFileA
FormatMessageA
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetProcessTimes
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetThreadTimes
GetTickCount
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleMode
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile

msvcrt

__C_specific_handler
__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_exit
_fmode
_initterm
_lock
_onexit
_snwprintf
_unlock
_vsnprintf
_wfopen
abort
atoi
calloc
exit
fclose
fflush
fgetc
fgets
fprintf
fputc
fputs
fread
free
fwprintf
fwrite
getenv
isspace
isxdigit
malloc
memchr
memcmp
memcpy
memmove
memset
putchar
puts
raise
realloc
rewind
signal
sprintf
sscanf
strchr
strcmp
strcpy
strcspn
strlen
strncmp
strncpy
strspn
strstr
strtol
strtoul
tolower
ungetc
vfprintf
wcscpy
_strdup

user32

GetCapture
GetClipboardOwner
GetCursorPos
GetForegroundWindow
GetQueueStatus
MessageBoxW

Sections

.text
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fzsftp.exe
.exe windows:6 windows x64 arch:x64

e34add6eba0bd3c8ecd4a8c6c71ec481

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/02/2016, 00:00

Not After

13/02/2019, 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/02/2016, 00:00

Not After

13/02/2019, 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b1:8b:c9:82:29:af:15:29:d1:4a:8d:4c:10:91:dd:78:40:b1:d0:80:e0:4c:67:62:6e:87:df:59:4f:56:35:65
Signer

Actual PE Digest

b1:8b:c9:82:29:af:15:29:d1:4a:8d:4c:10:91:dd:78:40:b1:d0:80:e0:4c:67:62:6e:87:df:59:4f:56:35:65

Digest Algorithm

sha256

PE Digest Matches

true

e0:05:6f:b0:22:71:e3:4b:24:d4:b9:90:9c:1c:67:ff:4b:d1:e0:a3
Signer

Actual PE Digest

e0:05:6f:b0:22:71:e3:4b:24:d4:b9:90:9c:1c:67:ff:4b:d1:e0:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AllocateAndInitializeSid
CopySid
EqualSid
GetLengthSid
GetUserNameA
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner

kernel32

CloseHandle
ConnectNamedPipe
CreateDirectoryW
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileW
CreateMutexA
CreateNamedPipeA
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FormatMessageA
FreeLibrary
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetFileAttributesW
GetFileSize
GetFileTime
GetLastError
GetLocalTime
GetModuleFileNameW
GetModuleHandleA
GetOverlappedResult
GetProcAddress
GetProcessTimes
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetThreadTimes
GetTickCount
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalAlloc
LocalFree
MapViewOfFile
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
ReadFile
ReleaseMutex
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleMode
SetCurrentDirectoryW
SetEvent
SetFilePointer
SetFileTime
SetHandleInformation
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitNamedPipeA
WideCharToMultiByte
WriteFile

msvcrt

__C_specific_handler
__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_exit
_fmode
_initterm
_lock
_onexit
_snwprintf
_stricmp
_strnicmp
_time64
_unlock
_vsnprintf
_wfopen
abort
atoi
calloc
exit
fclose
fflush
fgetc
fgets
fopen
fprintf
fputc
fputs
fread
free
fwprintf
fwrite
getenv
isalnum
isprint
isspace
isxdigit
malloc
memchr
memcmp
memcpy
memmove
memset
printf
puts
qsort
raise
realloc
rewind
signal
sprintf
sscanf
strchr
strcmp
strcpy
strcspn
strftime
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtol
strtoul
system
tolower
ungetc
vfprintf
wcscpy
_strdup

user32

FindWindowA
GetCapture
GetClipboardOwner
GetCursorPos
GetForegroundWindow
GetQueueStatus
MessageBoxW
SendMessageA

Sections

.text
Size: 388KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fzstorj.exe
.exe windows:6 windows x64 arch:x64

b5431cfaf24e2b0a2cf51835da5b5399

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/02/2016, 00:00

Not After

13/02/2019, 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/02/2016, 00:00

Not After

13/02/2019, 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:08:82:ab:58:f4:00:0a:25:86:b2:65:73:71:65:bd:68:d1:12:f3:89:02:6b:a2:0a:77:43:08:11:0e:22:f1
Signer

Actual PE Digest

20:08:82:ab:58:f4:00:0a:25:86:b2:65:73:71:65:bd:68:d1:12:f3:89:02:6b:a2:0a:77:43:08:11:0e:22:f1

Digest Algorithm

sha256

PE Digest Matches

true

37:75:d3:56:05:c0:bb:d8:49:bd:dc:69:0f:6f:77:ca:cb:36:6d:21
Signer

Actual PE Digest

37:75:d3:56:05:c0:bb:d8:49:bd:dc:69:0f:6f:77:ca:cb:36:6d:21

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptGetProvParam
CryptReleaseContext
CryptSetHashParam
CryptSetProvParam
CryptSignHashA
GetUserNameW
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

crypt32

CertCloseStore
CertDeleteCertificateFromStore
CertEnumCRLsInStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreA
PFXImportCertStore

iphlpapi

GetAdaptersAddresses

kernel32

AssignProcessToJobObject
CancelIo
CloseHandle
ConnectNamedPipe
CreateDirectoryW
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreateIoCompletionPort
CreateJobObjectW
CreateNamedPipeA
CreateNamedPipeW
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateToolhelp32Snapshot
DeleteCriticalSection
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsA
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FreeLibrary
GetConsoleCursorInfo
GetConsoleMode
GetConsoleScreenBufferInfo
GetConsoleTitleW
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesW
GetFileInformationByHandle
GetFileType
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNamedPipeHandleStateA
GetNumberOfConsoleInputEvents
GetProcAddress
GetProcessIoCounters
GetProcessTimes
GetQueuedCompletionStatus
GetShortPathNameW
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTempPathW
GetTickCount
GetTimeZoneInformation
GlobalMemoryStatusEx
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionEx
IsDBCSLeadByteEx
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LocalFree
MapViewOfFileEx
MoveFileExW
MultiByteToWideChar
OpenProcess
PeekNamedPipe
PostQueuedCompletionStatus
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserWorkItem
RaiseException
ReadConsoleInputW
ReadConsoleW
ReadDirectoryChangesW
ReadFile
RegisterWaitForSingleObject
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
SetConsoleTitleW
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFilePointerEx
SetFileTime
SetHandleInformation
SetInformationJobObject
SetLastError
SetNamedPipeHandleState
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableCS
SleepEx
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
UnregisterWait
UnregisterWaitEx
VerSetConditionMask
VerifyVersionInfoA
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
VirtualUnlock
WaitForMultipleObjects
WaitForSingleObject
WaitNamedPipeW
WakeConditionVariable
WideCharToMultiByte
WriteConsoleInputW
WriteConsoleW
WriteFile

msvcrt

__C_specific_handler
___lc_codepage_func
__dllonexit
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__mb_cur_max
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_close
_errno
_exit
_findclose
_findfirst64
_fmode
_fstat64
_fullpath
_get_osfhandle
_gmtime64
_initterm
_lock
_lseeki64
_onexit
_open
_open_osfhandle
_read
_snwprintf
_stat64
_stricmp
_strnicmp
_sys_nerr
_time64
_unlock
_vsnprintf
_wchmod
_wcsicmp
_wcsnicmp
_wmkdir
_write
_wrmdir
abort
atoi
bsearch
calloc
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwprintf
fwrite
getc
getenv
isalnum
isalpha
islower
isspace
isupper
iswctype
isxdigit
localeconv
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
printf
putchar
puts
qsort
raise
realloc
rewind
setlocale
signal
sprintf
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strstr
strtok
strtol
strtoul
strxfrm
tolower
toupper
towlower
towupper
ungetc
vfprintf
wcschr
wcscoll
wcscpy
wcsftime
wcslen
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcstombs
wcsxfrm
vprintf
_time64
_findnext64
_write
_wcsrev
_wcsdup
_unlink
_umask
_strdup
_read
_open
_getpid
_fileno
_fdopen
_close

psapi

GetProcessMemoryInfo

user32

MapVirtualKeyW
MessageBoxW

userenv

GetUserProfileDirectoryW

ws2_32

WSACleanup
WSADuplicateSocketW
WSAGetLastError
WSAIoctl
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSASetLastError
WSASocketW
WSAStartup
__WSAFDIsSet
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohs
recv
select
send
setsockopt
shutdown
socket

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 652KB - Virtual size: 652KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 78KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
locales/an/filezilla.mo
locales/ar/filezilla.mo
locales/az/filezilla.mo
locales/bg_BG/filezilla.mo
locales/ca/filezilla.mo
locales/ca_ES@valencia/filezilla.mo
locales/co/filezilla.mo
locales/cs_CZ/filezilla.mo
locales/cy/filezilla.mo
locales/da/filezilla.mo
locales/de/filezilla.mo
locales/el/filezilla.mo
locales/es/filezilla.mo
locales/et/filezilla.mo
locales/eu/filezilla.mo
locales/fa_IR/filezilla.mo
locales/fi_FI/filezilla.mo
locales/fr/filezilla.mo
locales/gl_ES/filezilla.mo
locales/he_IL/filezilla.mo
locales/hr/filezilla.mo
locales/hu_HU/filezilla.mo
locales/hy/filezilla.mo
locales/id_ID/filezilla.mo
locales/is/filezilla.mo
locales/it/filezilla.mo
locales/ja_JP/filezilla.mo
locales/ka/filezilla.mo
locales/kab/filezilla.mo
locales/km_KH/filezilla.mo
locales/ko_KR/filezilla.mo
locales/ku/filezilla.mo
locales/ky/filezilla.mo
locales/lo_LA/filezilla.mo
locales/lt_LT/filezilla.mo
locales/lv_LV/filezilla.mo
locales/mk_MK/filezilla.mo
locales/nb_NO/filezilla.mo
locales/ne/filezilla.mo
locales/nl/filezilla.mo
locales/nn_NO/filezilla.mo
locales/oc/filezilla.mo
locales/pl_PL/filezilla.mo
locales/pt_BR/filezilla.mo
locales/pt_PT/filezilla.mo
locales/ro_RO/filezilla.mo
locales/ru/filezilla.mo
locales/sk_SK/filezilla.mo
locales/sl_SI/filezilla.mo
locales/sr/filezilla.mo
locales/sv/filezilla.mo
locales/th_TH/filezilla.mo
locales/tr/filezilla.mo
locales/uk_UA/filezilla.mo
locales/vi_VN/filezilla.mo
locales/zh_CN/filezilla.mo
locales/zh_TW/filezilla.mo
resources/16x16/filezilla.png
.png
resources/16x16/sort_down_dark.png
.png
resources/16x16/sort_down_light.png
.png
resources/16x16/sort_up_dark.png
.png
resources/16x16/sort_up_light.png
.png
resources/16x16/throbber.gif
.gif
resources/16x16/unknown.png
.png
resources/20x20/unknown.png
.png
resources/24x24/unknown.png
.png
resources/32x32/filezilla.png
.png
resources/480x480/filezilla.png
.png
resources/48x48/filezilla.png
.png
resources/blukis/16x16/ascii.png
.png
resources/blukis/16x16/auto.png
.png
resources/blukis/16x16/binary.png
.png
resources/blukis/16x16/bookmark.png
.png
resources/blukis/16x16/bookmarks.png
.png
resources/blukis/16x16/cancel.png
.png
resources/blukis/16x16/compare.png
.png
resources/blukis/16x16/disconnect.png
.png
resources/blukis/16x16/download.png
.png
resources/blukis/16x16/downloadadd.png
.png
resources/blukis/16x16/file.png
.png
resources/blukis/16x16/filter.png
.png
resources/blukis/16x16/find.png
.png
resources/blukis/16x16/folder.png
.png
resources/blukis/16x16/folderback.png
.png
resources/blukis/16x16/folderclosed.png
.png
resources/blukis/16x16/folderup.png
.png
resources/blukis/16x16/help.png
.png
resources/blukis/16x16/localtreeview.png
.png
resources/blukis/16x16/lock.png
.png
resources/blukis/16x16/logview.png
.png
resources/blukis/16x16/processqueue.png
.png
resources/blukis/16x16/queueview.png
.png
resources/blukis/16x16/reconnect.png
.png
resources/blukis/16x16/refresh.png
.png
resources/blukis/16x16/remotetreeview.png
.png
resources/blukis/16x16/server.png
.png
resources/blukis/16x16/showhidden.png
.png
resources/blukis/16x16/sitemanager.png
.png
resources/blukis/16x16/speedlimits.png
.png
resources/blukis/16x16/symlink.png
.png
resources/blukis/16x16/synchronize.png
.png
resources/blukis/16x16/upload.png
.png
resources/blukis/16x16/uploadadd.png
.png
resources/blukis/32x32/ascii.png
.png
resources/blukis/32x32/auto.png
.png
resources/blukis/32x32/binary.png
.png
resources/blukis/32x32/bookmark.png
.png
resources/blukis/32x32/bookmarks.png
.png
resources/blukis/32x32/cancel.png
.png
resources/blukis/32x32/compare.png
.png
resources/blukis/32x32/disconnect.png
.png
resources/blukis/32x32/download.png
.png
resources/blukis/32x32/downloadadd.png
.png
resources/blukis/32x32/file.png
.png
resources/blukis/32x32/filter.png
.png
resources/blukis/32x32/find.png
.png
resources/blukis/32x32/folder.png
.png
resources/blukis/32x32/folderback.png
.png
resources/blukis/32x32/folderclosed.png
.png
resources/blukis/32x32/folderup.png
.png
resources/blukis/32x32/help.png
.png
resources/blukis/32x32/localtreeview.png
.png
resources/blukis/32x32/lock.png
.png
resources/blukis/32x32/logview.png
.png
resources/blukis/32x32/processqueue.png
.png
resources/blukis/32x32/queueview.png
.png
resources/blukis/32x32/reconnect.png
.png
resources/blukis/32x32/refresh.png
.png
resources/blukis/32x32/remotetreeview.png
.png
resources/blukis/32x32/server.png
.png
resources/blukis/32x32/showhidden.png
.png
resources/blukis/32x32/sitemanager.png
.png
resources/blukis/32x32/speedlimits.png
.png
resources/blukis/32x32/symlink.png
.png
resources/blukis/32x32/synchronize.png
.png
resources/blukis/32x32/upload.png
.png
resources/blukis/32x32/uploadadd.png
.png
resources/blukis/48x48/ascii.png
.png
resources/blukis/48x48/auto.png
.png
resources/blukis/48x48/binary.png
.png
resources/blukis/48x48/bookmark.png
.png
resources/blukis/48x48/bookmarks.png
.png
resources/blukis/48x48/cancel.png
.png
resources/blukis/48x48/compare.png
.png
resources/blukis/48x48/disconnect.png
.png
resources/blukis/48x48/download.png
.png
resources/blukis/48x48/downloadadd.png
.png
resources/blukis/48x48/file.png
.png
resources/blukis/48x48/filter.png
.png
resources/blukis/48x48/find.png
.png
resources/blukis/48x48/folder.png
.png
resources/blukis/48x48/folderback.png
.png
resources/blukis/48x48/folderclosed.png
.png
resources/blukis/48x48/folderup.png
.png
resources/blukis/48x48/help.png
.png
resources/blukis/48x48/localtreeview.png
.png
resources/blukis/48x48/lock.png
.png
resources/blukis/48x48/logview.png
.png
resources/blukis/48x48/processqueue.png
.png
resources/blukis/48x48/queueview.png
.png
resources/blukis/48x48/reconnect.png
.png
resources/blukis/48x48/refresh.png
.png
resources/blukis/48x48/remotetreeview.png
.png
resources/blukis/48x48/server.png
.png
resources/blukis/48x48/showhidden.png
.png
resources/blukis/48x48/sitemanager.png
.png
resources/blukis/48x48/speedlimits.png
.png
resources/blukis/48x48/symlink.png
.png
resources/blukis/48x48/synchronize.png
.png
resources/blukis/48x48/upload.png
.png
resources/blukis/48x48/uploadadd.png
.png
resources/blukis/theme.xml
.xml
resources/classic/16x16/ascii.png
.png
resources/classic/16x16/auto.png
.png
resources/classic/16x16/binary.png
.png
resources/classic/16x16/bookmark.png
.png
resources/classic/16x16/cancel.png
.png
resources/classic/16x16/compare.png
.png
resources/classic/16x16/disconnect.png
.png
resources/classic/16x16/download.png
.png
resources/classic/16x16/downloadadd.png
.png
resources/classic/16x16/file.png
.png
resources/classic/16x16/filter.png
.png
resources/classic/16x16/find.png
.png
resources/classic/16x16/folder.png
.png
resources/classic/16x16/folderclosed.png
.png
resources/classic/16x16/localtreeview.png
.png
resources/classic/16x16/lock.png
.png
resources/classic/16x16/logview.png
.png
resources/classic/16x16/processqueue.png
.png
resources/classic/16x16/queueview.png
.png
resources/classic/16x16/reconnect.png
.png
resources/classic/16x16/refresh.png
.png
resources/classic/16x16/remotetreeview.png
.png
resources/classic/16x16/server.png
.png
resources/classic/16x16/sitemanager.png
.png
resources/classic/16x16/speedlimits.png
.png
resources/classic/16x16/symlink.png
.png
resources/classic/16x16/synchronize.png
.png
resources/classic/16x16/upload.png
.png
resources/classic/16x16/uploadadd.png
.png
resources/classic/theme.xml
.xml
resources/cyril/16x16/ascii.png
.png
resources/cyril/16x16/auto.png
.png
resources/cyril/16x16/binary.png
.png
resources/cyril/16x16/bookmark.png
.png
resources/cyril/16x16/cancel.png
.png
resources/cyril/16x16/compare.png
.png
resources/cyril/16x16/disconnect.png
.png
resources/cyril/16x16/download.png
.png
resources/cyril/16x16/downloadadd.png
.png
resources/cyril/16x16/file.png
.png
resources/cyril/16x16/folder.png
.png
resources/cyril/16x16/folderback.png
.png
resources/cyril/16x16/folderclosed.png
.png
resources/cyril/16x16/folderup.png
.png
resources/cyril/16x16/help.png
.png
resources/cyril/16x16/localtreeview.png
.png
resources/cyril/16x16/logview.png
.png
resources/cyril/16x16/processqueue.png
.png
resources/cyril/16x16/queueview.png
.png
resources/cyril/16x16/reconnect.png
.png
resources/cyril/16x16/refresh.png
.png
resources/cyril/16x16/remotetreeview.png
.png
resources/cyril/16x16/server.png
.png
resources/cyril/16x16/showhidden.png
.png
resources/cyril/16x16/sitemanager.png
.png
resources/cyril/16x16/speedlimits.png
.png
resources/cyril/16x16/synchronize.png
.png
resources/cyril/16x16/upload.png
.png
resources/cyril/16x16/uploadadd.png
.png
resources/cyril/theme.xml
.xml
resources/default/480x480/ascii.png
.png
resources/default/480x480/auto.png
.png
resources/default/480x480/binary.png
.png
resources/default/480x480/bookmark.png
.png
resources/default/480x480/bookmarks.png
.png
resources/default/480x480/cancel.png
.png
resources/default/480x480/close.png
.png
resources/default/480x480/compare.png
.png
resources/default/480x480/disconnect.png
.png
resources/default/480x480/download.png
.png
resources/default/480x480/downloadadd.png
.png
resources/default/480x480/file.png
.png
resources/default/480x480/filter.png
.png
resources/default/480x480/find.png
.png
resources/default/480x480/folder.png
.png
resources/default/480x480/folderback.png
.png
resources/default/480x480/folderclosed.png
.png
resources/default/480x480/folderup.png
.png
resources/default/480x480/help.png
.png
resources/default/480x480/localtreeview.png
.png
resources/default/480x480/lock.png
.png
resources/default/480x480/logview.png
.png
resources/default/480x480/processqueue.png
.png
resources/default/480x480/queueview.png
.png
resources/default/480x480/reconnect.png
.png
resources/default/480x480/refresh.png
.png
resources/default/480x480/remotetreeview.png
.png
resources/default/480x480/server.png
.png
resources/default/480x480/showhidden.png
.png
resources/default/480x480/sitemanager.png
.png
resources/default/480x480/speedlimits.png
.png
resources/default/480x480/symlink.png
.png
resources/default/480x480/synchronize.png
.png
resources/default/480x480/synctransfer.png
.png
resources/default/480x480/upload.png
.png
resources/default/480x480/uploadadd.png
.png
resources/default/theme.xml
.xml
resources/defaultfilters.xml
.xml
resources/dropdown.png
.png
resources/finished.wav
resources/flatzilla/16x16/ascii.png
.png
resources/flatzilla/16x16/auto.png
.png
resources/flatzilla/16x16/binary.png
.png
resources/flatzilla/16x16/bookmark.png
.png
resources/flatzilla/16x16/cancel.png
.png
resources/flatzilla/16x16/compare.png
.png
resources/flatzilla/16x16/disconnect.png
.png
resources/flatzilla/16x16/download.png
.png
resources/flatzilla/16x16/downloadadd.png
.png
resources/flatzilla/16x16/file.png
.png
resources/flatzilla/16x16/filter.png
.png
resources/flatzilla/16x16/find.png
.png
resources/flatzilla/16x16/folder.png
.png
resources/flatzilla/16x16/folderclosed.png
.png
resources/flatzilla/16x16/help.png
.png
resources/flatzilla/16x16/leds.png
.png
resources/flatzilla/16x16/localtreeview.png
.png
resources/flatzilla/16x16/lock.png
.png
resources/flatzilla/16x16/logview.png
.png
resources/flatzilla/16x16/processqueue.png
.png
resources/flatzilla/16x16/queueview.png
.png
resources/flatzilla/16x16/reconnect.png
.png
resources/flatzilla/16x16/refresh.png
.png
resources/flatzilla/16x16/remotetreeview.png
.png
resources/flatzilla/16x16/server.png
.png
resources/flatzilla/16x16/sitemanager.png
.png
resources/flatzilla/16x16/speedlimits.png
.png
resources/flatzilla/16x16/synchronize.png
.png
resources/flatzilla/16x16/upload.png
.png
resources/flatzilla/16x16/uploadadd.png
.png
resources/flatzilla/24x24/ascii.png
.png
resources/flatzilla/24x24/auto.png
.png
resources/flatzilla/24x24/binary.png
.png
resources/flatzilla/24x24/bookmark.png
.png
resources/flatzilla/24x24/cancel.png
.png
resources/flatzilla/24x24/compare.png
.png
resources/flatzilla/24x24/disconnect.png
.png
resources/flatzilla/24x24/download.png
.png
resources/flatzilla/24x24/downloadadd.png
.png
resources/flatzilla/24x24/file.png
.png
resources/flatzilla/24x24/filter.png
.png
resources/flatzilla/24x24/find.png
.png
resources/flatzilla/24x24/folder.png
.png
resources/flatzilla/24x24/folderclosed.png
.png
resources/flatzilla/24x24/help.png
.png
resources/flatzilla/24x24/leds.png
.png
resources/flatzilla/24x24/localtreeview.png
.png
resources/flatzilla/24x24/lock.png
.png
resources/flatzilla/24x24/logview.png
.png
resources/flatzilla/24x24/processqueue.png
.png
resources/flatzilla/24x24/queueview.png
.png
resources/flatzilla/24x24/reconnect.png
.png
resources/flatzilla/24x24/refresh.png
.png
resources/flatzilla/24x24/remotetreeview.png
.png
resources/flatzilla/24x24/server.png
.png
resources/flatzilla/24x24/sitemanager.png
.png
resources/flatzilla/24x24/speedlimits.png
.png
resources/flatzilla/24x24/synchronize.png
.png
resources/flatzilla/24x24/upload.png
.png
resources/flatzilla/24x24/uploadadd.png
.png
resources/flatzilla/32x32/ascii.png
.png
resources/flatzilla/32x32/auto.png
.png
resources/flatzilla/32x32/binary.png
.png
resources/flatzilla/32x32/bookmark.png
.png
resources/flatzilla/32x32/cancel.png
.png
resources/flatzilla/32x32/compare.png
.png
resources/flatzilla/32x32/disconnect.png
.png
resources/flatzilla/32x32/download.png
.png
resources/flatzilla/32x32/downloadadd.png
.png
resources/flatzilla/32x32/file.png
.png
resources/flatzilla/32x32/filter.png
.png
resources/flatzilla/32x32/find.png
.png
resources/flatzilla/32x32/folder.png
.png
resources/flatzilla/32x32/folderclosed.png
.png
resources/flatzilla/32x32/help.png
.png
resources/flatzilla/32x32/leds.png
.png
resources/flatzilla/32x32/localtreeview.png
.png
resources/flatzilla/32x32/lock.png
.png
resources/flatzilla/32x32/logview.png
.png
resources/flatzilla/32x32/processqueue.png
.png
resources/flatzilla/32x32/queueview.png
.png
resources/flatzilla/32x32/reconnect.png
.png
resources/flatzilla/32x32/refresh.png
.png
resources/flatzilla/32x32/remotetreeview.png
.png
resources/flatzilla/32x32/server.png
.png
resources/flatzilla/32x32/sitemanager.png
.png
resources/flatzilla/32x32/speedlimits.png
.png
resources/flatzilla/32x32/synchronize.png
.png
resources/flatzilla/32x32/upload.png
.png
resources/flatzilla/32x32/uploadadd.png
.png
resources/flatzilla/48x48/ascii.png
.png
resources/flatzilla/48x48/auto.png
.png
resources/flatzilla/48x48/binary.png
.png
resources/flatzilla/48x48/bookmark.png
.png
resources/flatzilla/48x48/cancel.png
.png
resources/flatzilla/48x48/compare.png
.png
resources/flatzilla/48x48/disconnect.png
.png
resources/flatzilla/48x48/download.png
.png
resources/flatzilla/48x48/downloadadd.png
.png
resources/flatzilla/48x48/file.png
.png
resources/flatzilla/48x48/filter.png
.png
resources/flatzilla/48x48/find.png
.png
resources/flatzilla/48x48/folder.png
.png
resources/flatzilla/48x48/folderclosed.png
.png
resources/flatzilla/48x48/help.png
.png
resources/flatzilla/48x48/leds.png
.png
resources/flatzilla/48x48/localtreeview.png
.png
resources/flatzilla/48x48/lock.png
.png
resources/flatzilla/48x48/logview.png
.png
resources/flatzilla/48x48/processqueue.png
.png
resources/flatzilla/48x48/queueview.png
.png
resources/flatzilla/48x48/reconnect.png
.png
resources/flatzilla/48x48/refresh.png
.png
resources/flatzilla/48x48/remotetreeview.png
.png
resources/flatzilla/48x48/server.png
.png
resources/flatzilla/48x48/sitemanager.png
.png
resources/flatzilla/48x48/speedlimits.png
.png
resources/flatzilla/48x48/synchronize.png
.png
resources/flatzilla/48x48/upload.png
.png
resources/flatzilla/48x48/uploadadd.png
.png
resources/flatzilla/theme.xml
.xml
resources/leds.png
.png
resources/lone/16x16/ascii.png
.png
resources/lone/16x16/auto.png
.png
resources/lone/16x16/binary.png
.png
resources/lone/16x16/bookmark.png
.png
resources/lone/16x16/cancel.png
.png
resources/lone/16x16/compare.png
.png
resources/lone/16x16/disconnect.png
.png
resources/lone/16x16/download.png
.png
resources/lone/16x16/downloadadd.png
.png
resources/lone/16x16/file.png
.png
resources/lone/16x16/filter.png
.png
resources/lone/16x16/folder.png
.png
resources/lone/16x16/folderback.png
.png
resources/lone/16x16/folderclosed.png
.png
resources/lone/16x16/folderup.png
.png
resources/lone/16x16/help.png
.png
resources/lone/16x16/localtreeview.png
.png
resources/lone/16x16/lock.png
.png
resources/lone/16x16/logview.png
.png
resources/lone/16x16/processqueue.png
.png
resources/lone/16x16/queueview.png
.png
resources/lone/16x16/reconnect.png
.png
resources/lone/16x16/refresh.png
.png
resources/lone/16x16/remotetreeview.png
.png
resources/lone/16x16/server.png
.png
resources/lone/16x16/showhidden.png
.png
resources/lone/16x16/sitemanager.png
.png
resources/lone/16x16/speedlimits.png
.png
resources/lone/16x16/synchronize.png
.png
resources/lone/16x16/upload.png
.png
resources/lone/16x16/uploadadd.png
.png
resources/lone/32x32/ascii.png
.png
resources/lone/32x32/auto.png
.png
resources/lone/32x32/binary.png
.png
resources/lone/32x32/bookmark.png
.png
resources/lone/32x32/cancel.png
.png
resources/lone/32x32/compare.png
.png
resources/lone/32x32/disconnect.png
.png
resources/lone/32x32/download.png
.png
resources/lone/32x32/downloadadd.png
.png
resources/lone/32x32/file.png
.png
resources/lone/32x32/filter.png
.png
resources/lone/32x32/folder.png
.png
resources/lone/32x32/folderback.png
.png
resources/lone/32x32/folderclosed.png
.png
resources/lone/32x32/folderup.png
.png
resources/lone/32x32/help.png
.png
resources/lone/32x32/localtreeview.png
.png
resources/lone/32x32/lock.png
.png
resources/lone/32x32/logview.png
.png
resources/lone/32x32/processqueue.png
.png
resources/lone/32x32/queueview.png
.png
resources/lone/32x32/reconnect.png
.png
resources/lone/32x32/refresh.png
.png
resources/lone/32x32/remotetreeview.png
.png
resources/lone/32x32/showhidden.png
.png
resources/lone/32x32/sitemanager.png
.png
resources/lone/32x32/speedlimits.png
.png
resources/lone/32x32/synchronize.png
.png
resources/lone/32x32/upload.png
.png
resources/lone/32x32/uploadadd.png
.png
resources/lone/48x48/ascii.png
.png
resources/lone/48x48/auto.png
.png
resources/lone/48x48/binary.png
.png
resources/lone/48x48/bookmark.png
.png
resources/lone/48x48/cancel.png
.png
resources/lone/48x48/compare.png
.png
resources/lone/48x48/disconnect.png
.png
resources/lone/48x48/download.png
.png
resources/lone/48x48/downloadadd.png
.png
resources/lone/48x48/file.png
.png
resources/lone/48x48/filter.png
.png
resources/lone/48x48/folder.png
.png
resources/lone/48x48/folderback.png
.png
resources/lone/48x48/folderclosed.png
.png
resources/lone/48x48/folderup.png
.png
resources/lone/48x48/help.png
.png
resources/lone/48x48/localtreeview.png
.png
resources/lone/48x48/lock.png
.png
resources/lone/48x48/logview.png
.png
resources/lone/48x48/processqueue.png
.png
resources/lone/48x48/queueview.png
.png
resources/lone/48x48/reconnect.png
.png
resources/lone/48x48/refresh.png
.png
resources/lone/48x48/remotetreeview.png
.png
resources/lone/48x48/showhidden.png
.png
resources/lone/48x48/sitemanager.png
.png
resources/lone/48x48/speedlimits.png
.png
resources/lone/48x48/synchronize.png
.png
resources/lone/48x48/upload.png
.png
resources/lone/48x48/uploadadd.png
.png
resources/lone/theme.xml
.xml
resources/minimal/16x16/ascii.png
.png
resources/minimal/16x16/auto.png
.png
resources/minimal/16x16/binary.png
.png
resources/minimal/16x16/bookmark.png
.png
resources/minimal/16x16/bookmarks.png
.png
resources/minimal/16x16/cancel.png
.png
resources/minimal/16x16/compare.png
.png
resources/minimal/16x16/disconnect.png
.png
resources/minimal/16x16/download.png
.png
resources/minimal/16x16/downloadadd.png
.png
resources/minimal/16x16/file.png
.png
resources/minimal/16x16/filter.png
.png
resources/minimal/16x16/find.png
.png
resources/minimal/16x16/folder.png
.png
resources/minimal/16x16/folderback.png
.png
resources/minimal/16x16/folderclosed.png
.png
resources/minimal/16x16/folderup.png
.png
resources/minimal/16x16/help.png
.png
resources/minimal/16x16/localtreeview.png
.png
resources/minimal/16x16/lock.png
.png
resources/minimal/16x16/logview.png
.png
resources/minimal/16x16/processqueue.png
.png
resources/minimal/16x16/queueview.png
.png
resources/minimal/16x16/reconnect.png
.png
resources/minimal/16x16/refresh.png
.png
resources/minimal/16x16/remotetreeview.png
.png
resources/minimal/16x16/server.png
.png
resources/minimal/16x16/showhidden.png
.png
resources/minimal/16x16/sitemanager.png
.png
resources/minimal/16x16/speedlimits.png
.png
resources/minimal/16x16/synchronize.png
.png
resources/minimal/16x16/upload.png
.png
resources/minimal/16x16/uploadadd.png
.png
resources/minimal/32x32/file.png
.png
resources/minimal/theme.xml
.xml
resources/opencrystal/16x16/ascii.png
.png
resources/opencrystal/16x16/auto.png
.png
resources/opencrystal/16x16/binary.png
.png
resources/opencrystal/16x16/bookmark.png
.png
resources/opencrystal/16x16/cancel.png
.png
resources/opencrystal/16x16/compare.png
.png
resources/opencrystal/16x16/disconnect.png
.png
resources/opencrystal/16x16/download.png
.png
resources/opencrystal/16x16/downloadadd.png
.png
resources/opencrystal/16x16/file.png
.png
resources/opencrystal/16x16/filter.png
.png
resources/opencrystal/16x16/find.png
.png
resources/opencrystal/16x16/folder.png
.png
resources/opencrystal/16x16/folderback.png
.png
resources/opencrystal/16x16/folderclosed.png
.png
resources/opencrystal/16x16/folderup.png
.png
resources/opencrystal/16x16/help.png
.png
resources/opencrystal/16x16/localtreeview.png
.png
resources/opencrystal/16x16/lock.png
.png
resources/opencrystal/16x16/logview.png
.png
resources/opencrystal/16x16/processqueue.png
.png
resources/opencrystal/16x16/queueview.png
.png
resources/opencrystal/16x16/reconnect.png
.png
resources/opencrystal/16x16/refresh.png
.png
resources/opencrystal/16x16/remotetreeview.png
.png
resources/opencrystal/16x16/server.png
.png
resources/opencrystal/16x16/showhidden.png
.png
resources/opencrystal/16x16/sitemanager.png
.png
resources/opencrystal/16x16/speedlimits.png
.png
resources/opencrystal/16x16/synchronize.png
.png
resources/opencrystal/16x16/upload.png
.png
resources/opencrystal/16x16/uploadadd.png
.png
resources/opencrystal/20x20/server.png
.png
resources/opencrystal/24x24/server.png
.png
resources/opencrystal/32x32/ascii.png
.png
resources/opencrystal/32x32/auto.png
.png
resources/opencrystal/32x32/binary.png
.png
resources/opencrystal/32x32/bookmark.png
.png
resources/opencrystal/32x32/cancel.png
.png
resources/opencrystal/32x32/compare.png
.png
resources/opencrystal/32x32/disconnect.png
.png
resources/opencrystal/32x32/download.png
.png
resources/opencrystal/32x32/downloadadd.png
.png
resources/opencrystal/32x32/file.png
.png
resources/opencrystal/32x32/filter.png
.png
resources/opencrystal/32x32/find.png
.png
resources/opencrystal/32x32/folder.png
.png
resources/opencrystal/32x32/folderback.png
.png
resources/opencrystal/32x32/folderclosed.png
.png
resources/opencrystal/32x32/folderup.png
.png
resources/opencrystal/32x32/help.png
.png
resources/opencrystal/32x32/localtreeview.png
.png
resources/opencrystal/32x32/lock.png
.png
resources/opencrystal/32x32/logview.png
.png
resources/opencrystal/32x32/processqueue.png
.png
resources/opencrystal/32x32/queueview.png
.png
resources/opencrystal/32x32/reconnect.png
.png
resources/opencrystal/32x32/refresh.png
.png
resources/opencrystal/32x32/remotetreeview.png
.png
resources/opencrystal/32x32/showhidden.png
.png
resources/opencrystal/32x32/sitemanager.png
.png
resources/opencrystal/32x32/speedlimits.png
.png
resources/opencrystal/32x32/synchronize.png
.png
resources/opencrystal/32x32/upload.png
.png
resources/opencrystal/32x32/uploadadd.png
.png
resources/opencrystal/48x48/ascii.png
.png
resources/opencrystal/48x48/auto.png
.png
resources/opencrystal/48x48/binary.png
.png
resources/opencrystal/48x48/bookmark.png
.png
resources/opencrystal/48x48/cancel.png
.png
resources/opencrystal/48x48/compare.png
.png
resources/opencrystal/48x48/disconnect.png
.png
resources/opencrystal/48x48/download.png
.png
resources/opencrystal/48x48/downloadadd.png
.png
resources/opencrystal/48x48/file.png
.png
resources/opencrystal/48x48/filter.png
.png
resources/opencrystal/48x48/find.png
.png
resources/opencrystal/48x48/folder.png
.png
resources/opencrystal/48x48/folderback.png
.png
resources/opencrystal/48x48/folderclosed.png
.png
resources/opencrystal/48x48/folderup.png
.png
resources/opencrystal/48x48/help.png
.png
resources/opencrystal/48x48/localtreeview.png
.png
resources/opencrystal/48x48/lock.png
.png
resources/opencrystal/48x48/logview.png
.png
resources/opencrystal/48x48/processqueue.png
.png
resources/opencrystal/48x48/queueview.png
.png
resources/opencrystal/48x48/reconnect.png
.png
resources/opencrystal/48x48/refresh.png
.png
resources/opencrystal/48x48/remotetreeview.png
.png
resources/opencrystal/48x48/showhidden.png
.png
resources/opencrystal/48x48/sitemanager.png
.png
resources/opencrystal/48x48/speedlimits.png
.png
resources/opencrystal/48x48/synchronize.png
.png
resources/opencrystal/48x48/upload.png
.png
resources/opencrystal/48x48/uploadadd.png
.png
resources/opencrystal/theme.xml
.xml
resources/sun/48x48/ascii.png
.png
resources/sun/48x48/auto.png
.png
resources/sun/48x48/binary.png
.png
resources/sun/48x48/bookmark.png
.png
resources/sun/48x48/cancel.png
.png
resources/sun/48x48/compare.png
.png
resources/sun/48x48/disconnect.png
.png
resources/sun/48x48/download.png
.png
resources/sun/48x48/downloadadd.png
.png
resources/sun/48x48/file.png
.png
resources/sun/48x48/filter.png
.png
resources/sun/48x48/find.png
.png
resources/sun/48x48/folder.png
.png
resources/sun/48x48/folderback.png
.png
resources/sun/48x48/folderclosed.png
.png
resources/sun/48x48/folderup.png
.png
resources/sun/48x48/help.png
.png
resources/sun/48x48/localtreeview.png
.png
resources/sun/48x48/lock.png
.png
resources/sun/48x48/logview.png
.png
resources/sun/48x48/processqueue.png
.png
resources/sun/48x48/queueview.png
.png
resources/sun/48x48/reconnect.png
.png
resources/sun/48x48/refresh.png
.png
resources/sun/48x48/remotetreeview.png
.png
resources/sun/48x48/showhidden.png
.png
resources/sun/48x48/sitemanager.png
.png
resources/sun/48x48/speedlimits.png
.png
resources/sun/48x48/synchronize.png
.png
resources/sun/48x48/upload.png
.png
resources/sun/48x48/uploadadd.png
.png
resources/sun/theme.xml
.xml
resources/tango/16x16/ascii.png
.png
resources/tango/16x16/auto.png
.png
resources/tango/16x16/binary.png
.png
resources/tango/16x16/bookmark.png
.png
resources/tango/16x16/cancel.png
.png
resources/tango/16x16/compare.png
.png
resources/tango/16x16/disconnect.png
.png
resources/tango/16x16/download.png
.png
resources/tango/16x16/downloadadd.png
.png
resources/tango/16x16/file.png
.png
resources/tango/16x16/filter.png
.png
resources/tango/16x16/find.png
.png
resources/tango/16x16/folder.png
.png
resources/tango/16x16/folderclosed.png
.png
resources/tango/16x16/localtreeview.png
.png
resources/tango/16x16/lock.png
.png
resources/tango/16x16/logview.png
.png
resources/tango/16x16/processqueue.png
.png
resources/tango/16x16/queueview.png
.png
resources/tango/16x16/reconnect.png
.png
resources/tango/16x16/refresh.png
.png
resources/tango/16x16/remotetreeview.png
.png
resources/tango/16x16/server.png
.png
resources/tango/16x16/sitemanager.png
.png
resources/tango/16x16/synchronize.png
.png
resources/tango/16x16/unknown.png
.png
resources/tango/16x16/upload.png
.png
resources/tango/16x16/uploadadd.png
.png
resources/tango/32x32/ascii.png
.png
resources/tango/32x32/auto.png
.png
resources/tango/32x32/binary.png
.png
resources/tango/32x32/bookmark.png
.png
resources/tango/32x32/cancel.png
.png
resources/tango/32x32/compare.png
.png
resources/tango/32x32/disconnect.png
.png
resources/tango/32x32/download.png
.png
resources/tango/32x32/downloadadd.png
.png
resources/tango/32x32/file.png
.png
resources/tango/32x32/filter.png
.png
resources/tango/32x32/find.png
.png
resources/tango/32x32/folder.png
.png
resources/tango/32x32/folderclosed.png
.png
resources/tango/32x32/localtreeview.png
.png
resources/tango/32x32/lock.png
.png
resources/tango/32x32/logview.png
.png
resources/tango/32x32/processqueue.png
.png
resources/tango/32x32/queueview.png
.png
resources/tango/32x32/reconnect.png
.png
resources/tango/32x32/refresh.png
.png
resources/tango/32x32/remotetreeview.png
.png
resources/tango/32x32/server.png
.png
resources/tango/32x32/sitemanager.png
.png
resources/tango/32x32/synchronize.png
.png
resources/tango/32x32/unknown.png
.png
resources/tango/32x32/upload.png
.png
resources/tango/32x32/uploadadd.png
.png
resources/tango/48x48/ascii.png
.png
resources/tango/48x48/auto.png
.png
resources/tango/48x48/binary.png
.png
resources/tango/48x48/bookmark.png
.png
resources/tango/48x48/cancel.png
.png
resources/tango/48x48/compare.png
.png
resources/tango/48x48/disconnect.png
.png
resources/tango/48x48/download.png
.png
resources/tango/48x48/downloadadd.png
.png
resources/tango/48x48/file.png
.png
resources/tango/48x48/filter.png
.png
resources/tango/48x48/find.png
.png
resources/tango/48x48/folder.png
.png
resources/tango/48x48/folderclosed.png
.png
resources/tango/48x48/localtreeview.png
.png
resources/tango/48x48/lock.png
.png
resources/tango/48x48/logview.png
.png
resources/tango/48x48/processqueue.png
.png
resources/tango/48x48/queueview.png
.png
resources/tango/48x48/reconnect.png
.png
resources/tango/48x48/refresh.png
.png
resources/tango/48x48/remotetreeview.png
.png
resources/tango/48x48/server.png
.png
resources/tango/48x48/sitemanager.png
.png
resources/tango/48x48/synchronize.png
.png
resources/tango/48x48/unknown.png
.png
resources/tango/48x48/upload.png
.png
resources/tango/48x48/uploadadd.png
.png
resources/tango/theme.xml
.xml
resources/xrc/certificate.xrc
.xml
resources/xrc/dialogs.xrc
.xml
resources/xrc/inputdialog.xrc
.xml
resources/xrc/menus.xrc
.xml
resources/xrc/netconfwizard.xrc
.xml
resources/xrc/settings.xrc
.xml
resources/xrc/sitemanager.xrc
.xml
resources/xrc/storj.xrc
.xml
resources/xrc/update.xrc
.xml

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

4ea4df5d94204fc550be1874e1b77ea7

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6fCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6fCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

94:54:51:c6:c5:25:f2:ab:9b:99:13:df:a8:63:0a:e9:7e:9a:6c:0b:0d:4b:d6:d3:1b:4f:49:90:21:49:a8:32Signer

6d:b7:47:db:cc:e3:fa:85:43:c3:a0:00:0e:cd:cd:67:94:c2:9c:75Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 252KB

.rsrc Size: 41KB - Virtual size: 40KB

Password: infected

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 985KB - Virtual size: 984KB

DATA Size: 1KB - Virtual size: 1KB

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.edata Size: 1024B - Virtual size: 600B

.reloc Size: 4KB - Virtual size: 3KB

.rsrc Size: 3KB - Virtual size: 3KB

Password: infected

735e27ae3d7df8c0487e4353d04f6f28

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

comctl32

wininet

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 15KB

.data Size: 3KB - Virtual size: 21KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

94:54:51:c6:c5:25:f2:ab:9b:99:13:df:a8:63:0a:e9:7e:9a:6c:0b:0d:4b:d6:d3:1b:4f:49:90:21:49:a8:32
Signer

6d:b7:47:db:cc:e3:fa:85:43:c3:a0:00:0e:cd:cd:67:94:c2:9c:75
Signer

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 252KB

.rsrc
Size: 41KB - Virtual size: 40KB

CODE
Size: 985KB - Virtual size: 984KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.edata
Size: 1024B - Virtual size: 600B

.reloc
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 3KB

.text
Size: 15KB - Virtual size: 15KB

.data
Size: 3KB - Virtual size: 21KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 296B

.reloc
Size: 1024B - Virtual size: 578B

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 851B

.data
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 610B

.text
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 100B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 1024B - Virtual size: 694B

.rdata
Size: 1024B - Virtual size: 673B

.data
Size: 512B - Virtual size: 144B

.reloc
Size: 512B - Virtual size: 240B