a07539359433b9d0bad2a6d2965346fd

Sharing

Copy URL

Twitter E-mail

General

Target

a07539359433b9d0bad2a6d2965346fd
Size

7.0MB
MD5

a07539359433b9d0bad2a6d2965346fd
SHA1

3ab462a96d82d60ac9c687c17c2f95ec28c5e677
SHA256

be68c54bf25595d493a529c7f64ea38629b44f07c4551c208752b0b57060e2ae
SHA512

eca913d9f56824744328a6504f5baa537f9a445628e0bf3db58fec7956d130c6b38dde1e02bf7187ef425e8afc868c2a13c9bb32fa35097411e71da1e5ba2077
SSDEEP

196608:Aj9ODz6tHPNMseDMuS7VFKPDlWwlVVd7Pdw:A/bMscMNCblVb6

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/tweaker.exe	upx
static1/unpack001/usbhdd.exe	upx

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/AnvirHook65.dll
unpack001/CoreTemp.exe
unpack001/CoreTemp64.exe
unpack001/ROIntegration.dll
unpack001/VirusTotalUpload.exe
unpack002/out.upx
unpack003/out.upx

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

a07539359433b9d0bad2a6d2965346fd
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07-06-2005 08:09

Not After

30-05-2020 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:a3:e1:47:8e:3a:2f:89:75:21:24:09:d1:92:88:0e
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27-09-2011 00:00

Not After

26-09-2014 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=29 Altaiskaya ul.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

dc:fc:11:29:10:85:86:c3:94:d0:2c:d0:bb:01:6b:e0:7c:dd:64:81
Signer

Actual PE Digest

dc:fc:11:29:10:85:86:c3:94:d0:2c:d0:bb:01:6b:e0:7c:dd:64:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/AnVir.exe
.exe windows:5 windows x86 arch:x86

7437979d52f22ddb30327daa1adb110d

Code Sign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07-06-2005 08:09

Not After

30-05-2020 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:a3:e1:47:8e:3a:2f:89:75:21:24:09:d1:92:88:0e
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27-09-2011 00:00

Not After

26-09-2014 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=29 Altaiskaya ul.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

67:3f:a4:b6:a6:7f:30:bd:64:1a:21:24:79:b5:a9:4e:40:bb:82:21
Signer

Actual PE Digest

67:3f:a4:b6:a6:7f:30:bd:64:1a:21:24:79:b5:a9:4e:40:bb:82:21

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

Shell_NotifyIconA
SHGetDesktopFolder
SHBrowseForFolderA
SHGetMalloc
ShellExecuteExA
SHGetPathFromIDListA
SHFileOperationA
SHGetFileInfoA
SHGetSpecialFolderPathA
ShellExecuteA

version

GetFileVersionInfoA
VerQueryValueA

shlwapi

PathFindOnPathA
PathCanonicalizeA
StrFormatByteSizeW

msi

ord172
ord216

kernel32

SetErrorMode
OpenProcess
SetFilePointer
lstrcpynW
ReadFile
LockResource
GetCurrentProcessId
MulDiv
SetProcessAffinityMask
GetProcessAffinityMask
GlobalFree
GlobalReAlloc
FindNextFileA
FindClose
FindFirstFileA
SetFileTime
MoveFileA
CopyFileA
GetSystemPowerStatus
HeapFree
GetProcessHeap
CreateProcessA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetSystemDirectoryA
SetPriorityClass
GetPriorityClass
TlsGetValue
TlsSetValue
SuspendThread
SetProcessWorkingSetSize
GetProcessTimes
TlsAlloc
QueryDosDeviceA
DuplicateHandle
GetFileType
VirtualFree
VirtualAlloc
GetTempPathA
FileTimeToDosDateTime
GetFileInformationByHandle
GetLogicalDriveStringsA
RemoveDirectoryA
CreateEventA
SetEvent
GetDiskFreeSpaceExA
GetLogicalDrives
DeviceIoControl
GetExitCodeProcess
GetEnvironmentStrings
FreeEnvironmentStringsA
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetStdHandle
ExitProcess
HeapSize
HeapCreate
TlsFree
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetCommandLineA
GetTimeZoneInformation
HeapReAlloc
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
CreateThread
ExitThread
GetSystemInfo
GetModuleHandleW
VirtualProtect
RtlUnwind
IsProcessorFeaturePresent
HeapAlloc
InterlockedCompareExchange
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocaleInfoA
GetDateFormatA
ExpandEnvironmentStringsA
GetLongPathNameA
GetFileTime
GetFileSize
LoadLibraryA
LocalFree
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GlobalAlloc
GlobalLock
GlobalUnlock
DeleteFileA
SetFileAttributesA
GetFileAttributesA
CreateFileA
TerminateThread
SetThreadPriority
ResumeThread
SetEndOfFile
InitializeCriticalSectionAndSpinCount
WriteFile
CreateDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStructA
GetPrivateProfileStructA
SystemTimeToFileTime
GetLocalTime
FormatMessageA
GetSystemTime
lstrcatA
IsBadWritePtr
VirtualQuery
SetUnhandledExceptionFilter
OpenMutexA
WaitForSingleObject
CloseHandle
CreateMutexA
IsBadStringPtrA
lstrcpynA
lstrcmpA
GetModuleFileNameA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
SetLastError
CompareStringA
lstrcpyA
IsDBCSLeadByte
lstrcmpiA
GetModuleHandleA
GetProcAddress
InterlockedIncrement
GetLastError
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
lstrlenA
InterlockedDecrement
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
RaiseException
GetTickCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
CreateFileMappingA

user32

BeginDeferWindowPos
IsChild
AdjustWindowRectEx
GetAsyncKeyState
IntersectRect
DragDetect
GetDlgItemTextA
GetMenuState
GetWindowPlacement
GetScrollPos
GetDialogBaseUnits
DeleteMenu
GetTopWindow
DrawAnimatedRects
SendDlgItemMessageA
ChildWindowFromPoint
DialogBoxIndirectParamA
EnumWindows
CreateIconIndirect
GetGuiResources
FindWindowExA
SetScrollPos
SetScrollInfo
SetClassLongA
GetScrollRange
ScrollWindowEx
GetKeyboardLayoutList
WaitForInputIdle
GetDlgItemInt
SetDlgItemInt
FlashWindow
GetMenuStringA
GetNextDlgTabItem
LockWindowUpdate
EqualRect
SetParent
IsDlgButtonChecked
CheckDlgButton
GetDCEx
LoadBitmapA
RegisterWindowMessageA
GetMessagePos
WindowFromPoint
GetSysColorBrush
FrameRect
DrawFrameControl
GetWindowThreadProcessId
GetForegroundWindow
GetMenuItemID
DrawIconEx
SetWindowsHookExA
UnhookWindowsHookEx
DestroyIcon
DrawEdge
DrawStateA
CopyRect
CallNextHookEx
MessageBeep
GetWindowDC
IsRectEmpty
SystemParametersInfoA
AppendMenuA
ModifyMenuA
MonitorFromPoint
LoadStringW
PostQuitMessage
SetMenuDefaultItem
TranslateAcceleratorA
ExitWindowsEx
KillTimer
UnregisterHotKey
RegisterHotKey
ClientToScreen
IsZoomed
IsIconic
SetMenu
GetMenu
CharLowerBuffA
GetKeyState
IsMenu
GetMenuItemInfoA
LoadIconA
SetMenuItemInfoA
MoveWindow
CreateDialogParamA
IsDialogMessageA
ShowWindowAsync
GetMenuItemCount
RedrawWindow
DeferWindowPos
BringWindowToTop
InsertMenuItemA
RemoveMenu
InsertMenuA
CharUpperA
CharLowerA
CreatePopupMenu
TrackPopupMenuEx
TrackPopupMenu
DestroyMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SendMessageTimeoutA
GetClassLongA
GetShellWindow
SetDlgItemTextA
EnableWindow
SetTimer
EndDialog
MessageBoxA
wsprintfA
SetForegroundWindow
GetActiveWindow
EnumChildWindows
GetSystemMetrics
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
GetDlgItem
LoadMenuA
LoadAcceleratorsA
InflateRect
CharUpperBuffA
IsCharAlphaNumericA
DialogBoxParamA
GetClassNameA
OffsetRect
GetCapture
ReleaseCapture
ReleaseDC
GetDC
EndPaint
BeginPaint
GetSysColor
GetFocus
GetCursorPos
SetCursor
DrawFocusRect
FillRect
DrawTextA
PtInRect
CallWindowProcA
SetWindowPos
IsWindow
GetDlgCtrlID
GetParent
SetFocus
SetCapture
IsWindowEnabled
InvalidateRect
UpdateWindow
ScreenToClient
GetClientRect
SendMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
CreateWindowExA
GetWindowLongA
GetClassInfoExA
LoadCursorA
LoadImageA
RegisterClassExA
DestroyWindow
SetRectEmpty
CharNextA
DefWindowProcA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
LoadStringA
ShowWindow
SetWindowLongA
wvsprintfA
FindWindowA
PostMessageA
EndDeferWindowPos
SetRect
IsWindowVisible
GetDesktopWindow
GetSubMenu
UnregisterClassA

gdi32

CreateDIBSection
CreateDCA
SetViewportOrgEx
LPtoDP
DPtoLP
GetClipBox
SetWindowOrgEx
RectVisible
RoundRect
ExtTextOutA
ExcludeClipRect
TextOutW
LineTo
MoveToEx
CreateCompatibleDC
SetBkColor
CreateSolidBrush
GetTextMetricsA
CreatePatternBrush
CreateBitmap
PatBlt
SetBrushOrgEx
CreateCompatibleBitmap
BitBlt
Polygon
CreatePen
Rectangle
GetDeviceCaps
GetTextExtentPoint32A
RestoreDC
SaveDC
GetStockObject
CreateFontIndirectA
DeleteDC
GetObjectA
SetTextColor
SetBkMode
SelectObject
DeleteObject
GetCurrentObject

comdlg32

CommDlgExtendedError
GetSaveFileNameA
FindTextA
GetOpenFileNameA

advapi32

RegEnumKeyExA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
GetSecurityInfo
LookupAccountSidA
GetSecurityDescriptorSacl
SetSecurityInfo
RegQueryInfoKeyA
CloseServiceHandle
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExA
RegCloseKey
RegDeleteValueA
OpenServiceA
OpenSCManagerA
CreateServiceA
RegEnumValueA
QueryServiceConfigA
GetServiceDisplayNameA
LockServiceDatabase
ChangeServiceConfigA
UnlockServiceDatabase
ControlService
StartServiceA
DeleteService
RegEnumKeyA
LookupPrivilegeValueA

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CoTaskMemAlloc

oleaut32

SysFreeString
VariantClear
VarUI4FromStr

comctl32

InitCommonControlsEx
ImageList_Create
ImageList_DrawIndirect
ImageList_AddMasked
ord17
CreatePropertySheetPageA
DestroyPropertySheetPage
ImageList_Remove
ImageList_ReplaceIcon
ImageList_LoadImageA
ImageList_Destroy
ImageList_GetImageCount
PropertySheetA
ImageList_GetIcon
ImageList_Draw
ImageList_DrawEx
ImageList_GetIconSize
_TrackMouseEvent

crypt32

CertFreeCertificateContext

Sections

.text
Size: 988KB - Virtual size: 988KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.3MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AnVir.exe
.exe windows:5 windows x86 arch:x86

7437979d52f22ddb30327daa1adb110d

Code Sign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07-06-2005 08:09

Not After

30-05-2020 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:a3:e1:47:8e:3a:2f:89:75:21:24:09:d1:92:88:0e
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27-09-2011 00:00

Not After

26-09-2014 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=29 Altaiskaya ul.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

67:3f:a4:b6:a6:7f:30:bd:64:1a:21:24:79:b5:a9:4e:40:bb:82:21
Signer

Actual PE Digest

67:3f:a4:b6:a6:7f:30:bd:64:1a:21:24:79:b5:a9:4e:40:bb:82:21

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

Shell_NotifyIconA
SHGetDesktopFolder
SHBrowseForFolderA
SHGetMalloc
ShellExecuteExA
SHGetPathFromIDListA
SHFileOperationA
SHGetFileInfoA
SHGetSpecialFolderPathA
ShellExecuteA

version

GetFileVersionInfoA
VerQueryValueA

shlwapi

PathFindOnPathA
PathCanonicalizeA
StrFormatByteSizeW

msi

ord172
ord216

kernel32

SetErrorMode
OpenProcess
SetFilePointer
lstrcpynW
ReadFile
LockResource
GetCurrentProcessId
MulDiv
SetProcessAffinityMask
GetProcessAffinityMask
GlobalFree
GlobalReAlloc
FindNextFileA
FindClose
FindFirstFileA
SetFileTime
MoveFileA
CopyFileA
GetSystemPowerStatus
HeapFree
GetProcessHeap
CreateProcessA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetSystemDirectoryA
SetPriorityClass
GetPriorityClass
TlsGetValue
TlsSetValue
SuspendThread
SetProcessWorkingSetSize
GetProcessTimes
TlsAlloc
QueryDosDeviceA
DuplicateHandle
GetFileType
VirtualFree
VirtualAlloc
GetTempPathA
FileTimeToDosDateTime
GetFileInformationByHandle
GetLogicalDriveStringsA
RemoveDirectoryA
CreateEventA
SetEvent
GetDiskFreeSpaceExA
GetLogicalDrives
DeviceIoControl
GetExitCodeProcess
GetEnvironmentStrings
FreeEnvironmentStringsA
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetStdHandle
ExitProcess
HeapSize
HeapCreate
TlsFree
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetCommandLineA
GetTimeZoneInformation
HeapReAlloc
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
CreateThread
ExitThread
GetSystemInfo
GetModuleHandleW
VirtualProtect
RtlUnwind
IsProcessorFeaturePresent
HeapAlloc
InterlockedCompareExchange
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocaleInfoA
GetDateFormatA
ExpandEnvironmentStringsA
GetLongPathNameA
GetFileTime
GetFileSize
LoadLibraryA
LocalFree
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GlobalAlloc
GlobalLock
GlobalUnlock
DeleteFileA
SetFileAttributesA
GetFileAttributesA
CreateFileA
TerminateThread
SetThreadPriority
ResumeThread
SetEndOfFile
InitializeCriticalSectionAndSpinCount
WriteFile
CreateDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStructA
GetPrivateProfileStructA
SystemTimeToFileTime
GetLocalTime
FormatMessageA
GetSystemTime
lstrcatA
IsBadWritePtr
VirtualQuery
SetUnhandledExceptionFilter
OpenMutexA
WaitForSingleObject
CloseHandle
CreateMutexA
IsBadStringPtrA
lstrcpynA
lstrcmpA
GetModuleFileNameA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
SetLastError
CompareStringA
lstrcpyA
IsDBCSLeadByte
lstrcmpiA
GetModuleHandleA
GetProcAddress
InterlockedIncrement
GetLastError
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
lstrlenA
InterlockedDecrement
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
RaiseException
GetTickCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
CreateFileMappingA

user32

BeginDeferWindowPos
IsChild
AdjustWindowRectEx
GetAsyncKeyState
IntersectRect
DragDetect
GetDlgItemTextA
GetMenuState
GetWindowPlacement
GetScrollPos
GetDialogBaseUnits
DeleteMenu
GetTopWindow
DrawAnimatedRects
SendDlgItemMessageA
ChildWindowFromPoint
DialogBoxIndirectParamA
EnumWindows
CreateIconIndirect
GetGuiResources
FindWindowExA
SetScrollPos
SetScrollInfo
SetClassLongA
GetScrollRange
ScrollWindowEx
GetKeyboardLayoutList
WaitForInputIdle
GetDlgItemInt
SetDlgItemInt
FlashWindow
GetMenuStringA
GetNextDlgTabItem
LockWindowUpdate
EqualRect
SetParent
IsDlgButtonChecked
CheckDlgButton
GetDCEx
LoadBitmapA
RegisterWindowMessageA
GetMessagePos
WindowFromPoint
GetSysColorBrush
FrameRect
DrawFrameControl
GetWindowThreadProcessId
GetForegroundWindow
GetMenuItemID
DrawIconEx
SetWindowsHookExA
UnhookWindowsHookEx
DestroyIcon
DrawEdge
DrawStateA
CopyRect
CallNextHookEx
MessageBeep
GetWindowDC
IsRectEmpty
SystemParametersInfoA
AppendMenuA
ModifyMenuA
MonitorFromPoint
LoadStringW
PostQuitMessage
SetMenuDefaultItem
TranslateAcceleratorA
ExitWindowsEx
KillTimer
UnregisterHotKey
RegisterHotKey
ClientToScreen
IsZoomed
IsIconic
SetMenu
GetMenu
CharLowerBuffA
GetKeyState
IsMenu
GetMenuItemInfoA
LoadIconA
SetMenuItemInfoA
MoveWindow
CreateDialogParamA
IsDialogMessageA
ShowWindowAsync
GetMenuItemCount
RedrawWindow
DeferWindowPos
BringWindowToTop
InsertMenuItemA
RemoveMenu
InsertMenuA
CharUpperA
CharLowerA
CreatePopupMenu
TrackPopupMenuEx
TrackPopupMenu
DestroyMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SendMessageTimeoutA
GetClassLongA
GetShellWindow
SetDlgItemTextA
EnableWindow
SetTimer
EndDialog
MessageBoxA
wsprintfA
SetForegroundWindow
GetActiveWindow
EnumChildWindows
GetSystemMetrics
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
GetDlgItem
LoadMenuA
LoadAcceleratorsA
InflateRect
CharUpperBuffA
IsCharAlphaNumericA
DialogBoxParamA
GetClassNameA
OffsetRect
GetCapture
ReleaseCapture
ReleaseDC
GetDC
EndPaint
BeginPaint
GetSysColor
GetFocus
GetCursorPos
SetCursor
DrawFocusRect
FillRect
DrawTextA
PtInRect
CallWindowProcA
SetWindowPos
IsWindow
GetDlgCtrlID
GetParent
SetFocus
SetCapture
IsWindowEnabled
InvalidateRect
UpdateWindow
ScreenToClient
GetClientRect
SendMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
CreateWindowExA
GetWindowLongA
GetClassInfoExA
LoadCursorA
LoadImageA
RegisterClassExA
DestroyWindow
SetRectEmpty
CharNextA
DefWindowProcA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
LoadStringA
ShowWindow
SetWindowLongA
wvsprintfA
FindWindowA
PostMessageA
EndDeferWindowPos
SetRect
IsWindowVisible
GetDesktopWindow
GetSubMenu
UnregisterClassA

gdi32

CreateDIBSection
CreateDCA
SetViewportOrgEx
LPtoDP
DPtoLP
GetClipBox
SetWindowOrgEx
RectVisible
RoundRect
ExtTextOutA
ExcludeClipRect
TextOutW
LineTo
MoveToEx
CreateCompatibleDC
SetBkColor
CreateSolidBrush
GetTextMetricsA
CreatePatternBrush
CreateBitmap
PatBlt
SetBrushOrgEx
CreateCompatibleBitmap
BitBlt
Polygon
CreatePen
Rectangle
GetDeviceCaps
GetTextExtentPoint32A
RestoreDC
SaveDC
GetStockObject
CreateFontIndirectA
DeleteDC
GetObjectA
SetTextColor
SetBkMode
SelectObject
DeleteObject
GetCurrentObject

comdlg32

CommDlgExtendedError
GetSaveFileNameA
FindTextA
GetOpenFileNameA

advapi32

RegEnumKeyExA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
GetSecurityInfo
LookupAccountSidA
GetSecurityDescriptorSacl
SetSecurityInfo
RegQueryInfoKeyA
CloseServiceHandle
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExA
RegCloseKey
RegDeleteValueA
OpenServiceA
OpenSCManagerA
CreateServiceA
RegEnumValueA
QueryServiceConfigA
GetServiceDisplayNameA
LockServiceDatabase
ChangeServiceConfigA
UnlockServiceDatabase
ControlService
StartServiceA
DeleteService
RegEnumKeyA
LookupPrivilegeValueA

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CoTaskMemAlloc

oleaut32

SysFreeString
VariantClear
VarUI4FromStr

comctl32

InitCommonControlsEx
ImageList_Create
ImageList_DrawIndirect
ImageList_AddMasked
ord17
CreatePropertySheetPageA
DestroyPropertySheetPage
ImageList_Remove
ImageList_ReplaceIcon
ImageList_LoadImageA
ImageList_Destroy
ImageList_GetImageCount
PropertySheetA
ImageList_GetIcon
ImageList_Draw
ImageList_DrawEx
ImageList_GetIconSize
_TrackMouseEvent

crypt32

CertFreeCertificateContext

Sections

.text
Size: 988KB - Virtual size: 988KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.3MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AnvirHook65.dll
.dll windows:5 windows x86 arch:x86

a5fdfd0ecf8debe8deb6a28c01eab76f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

comctl32

ImageList_ReplaceIcon

shell32

SHGetMalloc
SHGetDesktopFolder
SHGetPathFromIDListA

msimg32

TransparentBlt

kernel32

lstrcmpA
GetCurrentDirectoryA
MultiByteToWideChar
GetProcAddress
WideCharToMultiByte
lstrlenW
GetVersionExA
OpenProcess
GetFileAttributesA
SetPriorityClass
GetPriorityClass
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RaiseException
WriteFile
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetTickCount
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
HeapSize
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapDestroy
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCommandLineA
GetCurrentThreadId
HeapAlloc
HeapReAlloc
RtlUnwind
HeapFree
GetLastError
lstrcatA
Sleep
GetCurrentProcessId
LoadLibraryA
UnmapViewOfFile
GetModuleFileNameA
lstrlenA
lstrcpyA
OpenFileMappingA
MapViewOfFile
CloseHandle
GetStdHandle

user32

LoadBitmapA
GetDC
DrawFrameControl
DrawIconEx
CopyRect
InflateRect
CheckMenuItem
DeleteMenu
IsMenu
GetMenuState
GetMenuItemID
GetSystemMenu
GetKeyState
GetSystemMetrics
GetWindowPlacement
GetWindowThreadProcessId
SendInput
LoadIconA
LoadImageA
SetWindowTextA
SetActiveWindow
TrackPopupMenuEx
RedrawWindow
InsertMenuA
InsertMenuItemA
wsprintfA
AppendMenuA
CheckMenuRadioItem
GetWindowTextA
FindWindowExA
GetDlgCtrlID
GetWindowTextLengthA
GetDlgItem
GetClassNameA
EnumWindows
SetTimer
SetCapture
ReleaseCapture
ShowWindowAsync
IsWindowVisible
ShowWindow
RegisterClassA
KillTimer
FillRect
DefWindowProcA
SetWindowPos
SetWindowLongW
SetWindowLongA
ReleaseDC
GetWindowDC
EndPaint
BeginPaint
GetCursorPos
InvalidateRect
UpdateWindow
CallWindowProcW
CallWindowProcA
CreatePopupMenu
TrackPopupMenu
DestroyMenu
ClientToScreen
GetParent
ScreenToClient
DestroyWindow
CreateWindowExA
GetWindowRect
GetClientRect
OffsetRect
PtInRect
SendMessageA
GetWindowLongA
IsWindow
PostMessageA
SendMessageTimeoutA
GetMenuItemInfoA
IsWindowUnicode
SetMenuItemInfoA
RemoveMenu

gdi32

SelectObject
SetWindowOrgEx
CreateCompatibleBitmap
GetClipBox
BitBlt
DeleteObject
DeleteDC
DPtoLP
LPtoDP
CreateSolidBrush
GetStockObject
Polyline
CreatePen
StretchBlt
GetObjectA
GetPixel
CreateCompatibleDC

ole32

CoTaskMemFree

Exports

Exports

AddTitleIcons
ExtendSaveDialogs
ExtendSystemMenu

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoreTemp.exe
.exe windows:4 windows x86 arch:x86

1b83aafaf44ef3a84befd41fd11cd69e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_AddMasked
ImageList_GetIcon
ImageList_Destroy
ImageList_Create
ord17

powrprof

SetSuspendState

gdiplus

GdipAlloc
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
GdipFree
GdipLoadImageFromFile

kernel32

Sleep
FindFirstFileW
DeviceIoControl
SetLastError
GetFileSize
TerminateThread
CreateThread
GetTickCount
GetProcessAffinityMask
QueryPerformanceCounter
QueryPerformanceFrequency
SetThreadPriority
SetPriorityClass
GetCurrentThread
ReadFile
GetModuleFileNameA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
SetStdHandle
LoadLibraryA
InitializeCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointer
GetCurrentProcessId
GetCommandLineW
GetCommandLineA
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
RaiseException
GetDateFormatA
GetTimeFormatA
MultiByteToWideChar
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetStdHandle
ExitProcess
GetModuleHandleA
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
CreateMutexW
WaitForSingleObject
CreateFileMappingW
FreeLibrary
MapViewOfFile
CreateFileW
WriteFile
DeleteFileW
OpenMutexW
GetLastError
ReleaseMutex
CloseHandle
lstrcpynW
GetModuleHandleW
GetVersionExW
GetCurrentProcess
LoadLibraryW
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
GetTimeZoneInformation
GetLocalTime
GetModuleFileNameW
MulDiv
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetProcessHeap
RtlUnwind
WideCharToMultiByte
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetProcAddress

user32

DefWindowProcW
GetSystemMetrics
ReleaseDC
GetDC
CreateWindowExW
CallWindowProcW
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
ShowWindow
SendNotifyMessageW
SendMessageW
DestroyIcon
LoadStringW
LoadBitmapW
GetWindowTextW
ExitWindowsEx
DrawTextExW
ScreenToClient
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
IsDialogMessageW
RegisterWindowMessageW
GetSubMenu
GetCursorPos
TrackPopupMenu
PostQuitMessage
DialogBoxParamW
FillRect
InvalidateRect
GetWindowRect
RegisterClassExW
DestroyWindow
PostMessageW
SetFocus
GetMenu
GetMenuState
CheckMenuItem
SetTimer
KillTimer
EnableWindow
AdjustWindowRect
EnumChildWindows
LoadIconW
GetDlgItem
EndDialog
SetWindowTextW
SetWindowLongW
SetWindowPos
MessageBoxW
SetForegroundWindow
UpdateWindow
GetClientRect

gdi32

CreateBitmap
DeleteDC
CreateBrushIndirect
SetTextAlign
TextOutW
CreateFontW
CreateFontIndirectW
CreateDIBSection
CreateSolidBrush
CreateCompatibleDC
SelectObject
BitBlt
DeleteObject
SetTextColor
SetBkColor
GetDeviceCaps

comdlg32

ChooseColorW
GetSaveFileNameW
ChooseFontW
GetOpenFileNameW

advapi32

RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceW
StartServiceW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ControlService
DeleteService
RegCloseKey

shell32

Shell_NotifyIconW
ShellExecuteW

Sections

.text
Size: 232KB - Virtual size: 229KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CoreTemp64.exe
.exe windows:4 windows x64 arch:x64

3171898f7ae62cc76c0dbeacd0d7b98e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

ImageList_AddMasked
ImageList_GetIcon
ImageList_Destroy
ImageList_Create
ord17

powrprof

SetSuspendState

gdiplus

GdipAlloc
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
GdipFree
GdipLoadImageFromFile

kernel32

DeviceIoControl
FreeLibrary
SetLastError
LoadLibraryW
GetFileSize
TerminateThread
CreateThread
GetTickCount
__C_specific_handler
GetProcessAffinityMask
QueryPerformanceCounter
QueryPerformanceFrequency
SetThreadPriority
SetPriorityClass
GetCurrentThread
ReadFile
GetModuleFileNameA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
HeapReAlloc
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
SetStdHandle
InitializeCriticalSection
LoadLibraryA
GetConsoleMode
GetConsoleCP
SetFilePointer
GetCurrentProcessId
GetCommandLineW
GetCommandLineA
GetStartupInfoA
GetFileType
SetHandleCount
DeleteCriticalSection
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
RtlPcToFileHeader
RaiseException
GetTimeFormatA
GetDateFormatA
MultiByteToWideChar
FlsAlloc
GetCurrentThreadId
FlsFree
TlsFree
FlsSetValue
FlsGetValue
IsValidCodePage
GetOEMCP
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
GetStdHandle
ExitProcess
GetModuleHandleA
FindFirstFileW
Sleep
GetCurrentProcess
GetVersionExW
CreateMutexW
WaitForSingleObject
CreateFileMappingW
MapViewOfFile
CreateFileW
WriteFile
DeleteFileW
OpenMutexW
GetLastError
ReleaseMutex
CloseHandle
lstrcpynW
GetModuleHandleW
RtlVirtualUnwind
HeapCreate
HeapSetInformation
GetTimeZoneInformation
GetLocalTime
GetModuleFileNameW
MulDiv
RtlCaptureContext
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetProcessHeap
RtlUnwindEx
RtlLookupFunctionEntry
WideCharToMultiByte
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetProcAddress

user32

DefWindowProcW
GetSystemMetrics
ReleaseDC
GetDC
CreateWindowExW
CallWindowProcW
GetSysColor
GetWindowLongPtrW
SetCursor
LoadCursorW
ShowWindow
SendNotifyMessageW
SendMessageW
DestroyIcon
LoadStringW
LoadBitmapW
GetWindowTextW
ExitWindowsEx
DrawTextExW
ScreenToClient
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
RegisterWindowMessageW
GetSubMenu
GetCursorPos
TrackPopupMenu
PostQuitMessage
DialogBoxParamW
FillRect
InvalidateRect
PostMessageW
GetWindowRect
DestroyWindow
SetFocus
RegisterClassExW
GetMenu
GetMenuState
CheckMenuItem
SetWindowLongW
SetTimer
KillTimer
EnableWindow
GetWindowLongW
AdjustWindowRect
EnumChildWindows
LoadIconW
GetDlgItem
EndDialog
SetWindowTextW
SetWindowLongPtrW
SetWindowPos
MessageBoxW
SetForegroundWindow
UpdateWindow
GetClientRect

gdi32

CreateBitmap
DeleteDC
CreateBrushIndirect
SetTextAlign
TextOutW
CreateFontW
CreateFontIndirectW
CreateDIBSection
CreateSolidBrush
CreateCompatibleDC
SelectObject
BitBlt
DeleteObject
SetTextColor
SetBkColor
GetDeviceCaps

comdlg32

ChooseColorW
GetSaveFileNameW
ChooseFontW
GetOpenFileNameW

advapi32

RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceW
StartServiceW
OpenSCManagerW
OpenServiceW
ControlService
DeleteService
CloseServiceHandle
RegCloseKey

shell32

Shell_NotifyIconW
ShellExecuteW

Sections

.text
Size: 294KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ROIntegration.dll
.dll windows:4 windows x86 arch:x86

6b1998184a50752e1291a7108da9b18a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW

kernel32

CloseHandle
CompareStringW
CreateEventW
CreateFileA
CreateFileW
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
EnumCalendarInfoW
ExitProcess
ExitThread
FindClose
FindFirstFileW
FindResourceW
FormatMessageW
FreeEnvironmentStringsA
FreeLibrary
FreeResource
GetACP
GetCPInfo
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceW
GetEnvironmentStrings
GetExitCodeThread
GetFileAttributesA
GetFileAttributesW
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDefaultLangID
GetSystemInfo
GetThreadLocale
GetTickCount
GetUserDefaultLCID
GetUserDefaultLangID
GetVersion
GetVersionExA
GetVersionExW
GlobalAddAtomW
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomW
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
IsDBCSLeadByteEx
IsDebuggerPresent
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LockResource
MulDiv
MultiByteToWideChar
RaiseException
ReadFile
ResetEvent
ResumeThread
RtlUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetHandleCount
SetLastError
SetThreadLocale
SignalObjectAndWait
SizeofResource
Sleep
SwitchToThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
VirtualQueryEx
WaitForMultipleObjectsEx
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcpyW
lstrcpynW
lstrlenW

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW

comctl32

FlatSB_GetScrollInfo
FlatSB_GetScrollPos
FlatSB_SetScrollInfo
FlatSB_SetScrollPos
FlatSB_SetScrollProp
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawEx
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetDragImage
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Read
ImageList_Remove
ImageList_SetBkColor
ImageList_SetIconSize
ImageList_SetImageCount
ImageList_Write
InitializeFlatSB
_TrackMouseEvent

gdi32

BitBlt
CopyEnhMetaFileW
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateDIBitmap
CreateFontIndirectW
CreateHalftonePalette
CreatePalette
CreatePenIndirect
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteEnhMetaFile
DeleteObject
ExcludeClipRect
FrameRgn
GetBitmapBits
GetBrushOrgEx
GetClipBox
GetCurrentPositionEx
GetDCOrgEx
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetEnhMetaFileBits
GetEnhMetaFileHeader
GetEnhMetaFilePaletteEntries
GetObjectW
GetPaletteEntries
GetPixel
GetRgnBox
GetStockObject
GetSystemPaletteEntries
GetTextExtentPoint32W
GetTextExtentPointW
GetTextMetricsW
GetWinMetaFileBits
GetWindowOrgEx
IntersectClipRect
LineTo
MaskBlt
MoveToEx
PatBlt
PlayEnhMetaFile
RealizePalette
RectVisible
Rectangle
RestoreDC
SaveDC
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetBrushOrgEx
SetDIBColorTable
SetEnhMetaFileBits
SetPixel
SetROP2
SetStretchBltMode
SetTextColor
SetViewportOrgEx
SetWinMetaFileBits
SetWindowOrgEx
StretchBlt
UnrealizeObject

msimg32

AlphaBlend

shell32

ShellExecuteW

user32

ActivateKeyboardLayout
AdjustWindowRectEx
BeginPaint
CallNextHookEx
CallWindowProcW
CharLowerBuffW
CharLowerW
CharNextW
CharUpperBuffW
CheckMenuItem
ClientToScreen
CloseClipboard
CreateIcon
CreateMenu
CreatePopupMenu
CreateWindowExW
DefFrameProcW
DefMDIChildProcW
DefWindowProcW
DeleteMenu
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageA
DispatchMessageW
DrawEdge
DrawFrameControl
DrawIcon
DrawIconEx
DrawMenuBar
DrawTextExW
DrawTextW
EmptyClipboard
EnableMenuItem
EnableScrollBar
EnableWindow
EndPaint
EnumChildWindows
EnumThreadWindows
EnumWindows
FillRect
FindWindowExW
FindWindowW
FrameRect
GetActiveWindow
GetCapture
GetClassInfoW
GetClassLongW
GetClientRect
GetClipboardData
GetCursor
GetCursorPos
GetDC
GetDCEx
GetDesktopWindow
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyNameTextW
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutNameW
GetKeyboardState
GetKeyboardType
GetLastActivePopup
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoW
GetMenuState
GetMenuStringW
GetMessagePos
GetParent
GetPropW
GetScrollInfo
GetScrollPos
GetScrollRange
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowDC
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextW
GetWindowThreadProcessId
InflateRect
InsertMenuItemW
InsertMenuW
IntersectRect
InvalidateRect
IsChild
IsDialogMessageA
IsDialogMessageW
IsIconic
IsWindow
IsWindowEnabled
IsWindowUnicode
IsWindowVisible
IsZoomed
KillTimer
LoadBitmapW
LoadCursorW
LoadIconW
LoadKeyboardLayoutW
LoadStringW
MapVirtualKeyW
MapWindowPoints
MessageBeep
MessageBoxA
MessageBoxW
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
OffsetRect
OpenClipboard
PeekMessageA
PeekMessageW
PostMessageW
PostQuitMessage
RedrawWindow
RegisterClassW
RegisterClipboardFormatW
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropW
ScreenToClient
ScrollWindow
SendMessageA
SendMessageW
SetActiveWindow
SetCapture
SetClassLongW
SetClipboardData
SetCursor
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemInfoW
SetParent
SetPropW
SetRect
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowsHookExW
ShowOwnedPopups
ShowScrollBar
ShowWindow
SystemParametersInfoW
TrackPopupMenu
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnregisterClassW
UpdateWindow
WaitMessage
WindowFromPoint
wsprintfA

ole32

CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
OleInitialize
OleUninitialize

oleaut32

GetErrorInfo
SafeArrayCreate
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SysAllocStringLen
SysFreeString
SysReAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantInit

Exports

Exports

@@Simplefunctions@Finalize
@@Simplefunctions@Initialize
IsNeededVersionOfROInstalled
OpenDiskCleanupTool
OpenManualCleanupTool
OpenRegOrganizer
OpenRegistryCleanupTool
OpenRegistryOptimizationTool
Test
___CPPdebugHook

Sections

.text
Size: 564KB - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 47KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
VirusTotalUpload.exe
.exe windows:5 windows x86 arch:x86

227974be97287d72a0c2564c9510f5b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetReadFile
InternetCrackUrlW
InternetConnectW
InternetOpenW
HttpEndRequestW
InternetWriteFile
HttpSendRequestExW
InternetCloseHandle
HttpOpenRequestW
HttpQueryInfoW
HttpSendRequestW

comctl32

InitCommonControlsEx

psapi

GetModuleFileNameExW

kernel32

GetTempFileNameW
WriteFile
CreateFileW
GetTempPathW
GetLastError
CloseHandle
LocalFree
ExitProcess
GetModuleFileNameW
GetModuleHandleW
OpenProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
CreateThread
GetFullPathNameW
GetTickCount
GetFileAttributesW
ReadFile
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
FlushFileBuffers
SetStdHandle
LCMapStringW
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
LoadLibraryA
MultiByteToWideChar
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetFilePointer
WriteConsoleW
GetConsoleOutputCP
SetEndOfFile
GetDriveTypeA
GetProcessHeap
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFileSizeEx
SetUnhandledExceptionFilter
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleHandleA
IsDebuggerPresent
GetSystemTimeAsFileTime
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
HeapFree
HeapAlloc
GetStartupInfoW
RaiseException
RtlUnwind
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
Sleep
HeapSize
EnterCriticalSection
LeaveCriticalSection
GetCurrentDirectoryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc

user32

SendMessageW
MessageBoxW
CharToOemW
SendDlgItemMessageW
SetWindowTextW
CheckDlgButton
IsDlgButtonChecked
EnableWindow
SetTimer
GetWindowRect
SetForegroundWindow
DialogBoxParamW
GetDC
LoadImageW
GetDlgItem
EndDialog
GetDlgItemTextW
SetDlgItemTextW
MapWindowPoints
MoveWindow
ReleaseDC

gdi32

SelectObject
GetTextMetricsW

comdlg32

CommDlgExtendedError
GetOpenFileNameW

advapi32

CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
CryptHashData

shell32

DragQueryFileW
DragFinish
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
CommandLineToArgvW

ole32

CoInitialize
CoTaskMemFree
CoUninitialize

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
portable.txt
reg-organizer-setup.exe
.exe windows:5 windows x86 arch:x86

483f0c4259a9148c34961abbda6146c1

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

18:14:85:92:b1:6c:7b:aa:18:35:84:a9:a8:75:c5:76
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

21-06-2010 00:00

Not After

20-06-2012 23:59

Subject

CN=Konstantin Polyakov,O=Konstantin Polyakov,POSTALCODE=620137,STREET=Behtereva Str.\,3-65,L=Ekaterinburg,ST=N/A,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b0:dd:49:64:e2:4d:8a:0e:63:fd:35:bc:db:cd:09:ef:8c:53:8d:e7
Signer

Actual PE Digest

b0:dd:49:64:e2:4d:8a:0e:63:fd:35:bc:db:cd:09:ef:8c:53:8d:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

user32

GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW

kernel32

GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
LeaveCriticalSection
InitializeCriticalSection
GetWindowsDirectoryW
GetVersionExW
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
EnterCriticalSection
DeleteFileW
DeleteCriticalSection
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CompareStringW
CloseHandle
Sleep

comctl32

InitCommonControls

Sections

.text
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 21KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tweaker.exe
.exe windows:4 windows x86 arch:x86

Code Sign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07-06-2005 08:09

Not After

30-05-2020 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:a3:e1:47:8e:3a:2f:89:75:21:24:09:d1:92:88:0e
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27-09-2011 00:00

Not After

26-09-2014 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=29 Altaiskaya ul.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

83:4a:a3:92:ea:e5:6b:d2:89:2c:30:f7:94:1b:45:fa:4e:d1:c6:4f
Signer

Actual PE Digest

83:4a:a3:92:ea:e5:6b:d2:89:2c:30:f7:94:1b:45:fa:4e:d1:c6:4f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 704KB - Virtual size: 708KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

@$xp$14Jpeg@TJPEGData
@$xp$15Jpeg@TJPEGImage
@$xp$15Jpeg@TJPEGScale
@$xp$21Jpeg@TJPEGPerformance
@$xp$21Jpeg@TJPEGPixelFormat
@$xp$22Jpeg@TJPEGQualityRange
@@Consol@Finalize
@@Consol@Initialize
@@Main@Finalize
@@Main@Initialize
@@Placesbar@Finalize
@@Placesbar@Initialize
@@Psw@Finalize
@@Psw@Initialize
@@Splash@Finalize
@@Splash@Initialize
@@Unlock@Finalize
@@Unlock@Initialize
@Jconsts@Finalization$qqrv
@Jconsts@_sChangeJPGSize
@Jconsts@_sJPEGError
@Jconsts@_sJPEGImageFile
@Jconsts@initialization$qqrv
@Jpeg@Finalization$qqrv
@Jpeg@JPEGDefaults
@Jpeg@TJPEGData@
@Jpeg@TJPEGData@$bdtr$qqrv
@Jpeg@TJPEGData@FreeHandle$qqrv
@Jpeg@TJPEGImage@
@Jpeg@TJPEGImage@$bctr$qqrv
@Jpeg@TJPEGImage@$bdtr$qqrv
@Jpeg@TJPEGImage@Assign$qqrp19Classes@TPersistent
@Jpeg@TJPEGImage@AssignTo$qqrp19Classes@TPersistent
@Jpeg@TJPEGImage@CalcOutputDimensions$qqrv
@Jpeg@TJPEGImage@Changed$qqrp14System@TObject
@Jpeg@TJPEGImage@Compress$qqrv
@Jpeg@TJPEGImage@DIBNeeded$qqrv
@Jpeg@TJPEGImage@Draw$qqrp16Graphics@TCanvasrx11Types@TRect
@Jpeg@TJPEGImage@Equals$qqrp17Graphics@TGraphic
@Jpeg@TJPEGImage@FreeBitmap$qqrv
@Jpeg@TJPEGImage@GetBitmap$qqrv
@Jpeg@TJPEGImage@GetEmpty$qqrv
@Jpeg@TJPEGImage@GetGrayscale$qqrv
@Jpeg@TJPEGImage@GetHeight$qqrv
@Jpeg@TJPEGImage@GetPalette$qqrv
@Jpeg@TJPEGImage@GetWidth$qqrv
@Jpeg@TJPEGImage@JPEGNeeded$qqrv
@Jpeg@TJPEGImage@LoadFromClipboardFormat$qqrusuip10HPALETTE__
@Jpeg@TJPEGImage@LoadFromStream$qqrp15Classes@TStream
@Jpeg@TJPEGImage@NewBitmap$qqrv
@Jpeg@TJPEGImage@NewImage$qqrv
@Jpeg@TJPEGImage@ReadData$qqrp15Classes@TStream
@Jpeg@TJPEGImage@ReadStream$qqrip15Classes@TStream
@Jpeg@TJPEGImage@SaveToClipboardFormat$qqrrusruirp10HPALETTE__
@Jpeg@TJPEGImage@SaveToStream$qqrp15Classes@TStream
@Jpeg@TJPEGImage@SetGrayscale$qqro
@Jpeg@TJPEGImage@SetHeight$qqri
@Jpeg@TJPEGImage@SetPalette$qqrp10HPALETTE__
@Jpeg@TJPEGImage@SetPerformance$qqr21Jpeg@TJPEGPerformance
@Jpeg@TJPEGImage@SetPixelFormat$qqr21Jpeg@TJPEGPixelFormat
@Jpeg@TJPEGImage@SetScale$qqr15Jpeg@TJPEGScale
@Jpeg@TJPEGImage@SetSmoothing$qqro
@Jpeg@TJPEGImage@SetWidth$qqri
@Jpeg@TJPEGImage@WriteData$qqrp15Classes@TStream
@Jpeg@initialization$qqrv
__GetExceptDLLinfo
___CPPdebugHook
_frmConsol
_frmEnterPassword
_frmMain
_frmPlacesBar
_frmSplash
_frmUnlock

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 151KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 614KB - Virtual size: 616KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tweaker_en.lng
tweaker_it.lng
tweaker_ja.lng
tweaker_ko.lng
tweaker_license.txt
tweaker_pl.lng
uninstall.exe.nsis
usbhdd.exe
.exe windows:4 windows x86 arch:x86

Code Sign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07-06-2005 08:09

Not After

30-05-2020 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:a3:e1:47:8e:3a:2f:89:75:21:24:09:d1:92:88:0e
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27-09-2011 00:00

Not After

26-09-2014 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=29 Altaiskaya ul.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:a6:e7:20:de:97:3d:d6:84:a2:93:e7:b4:bb:20:30:41:d2:c7:ed
Signer

Actual PE Digest

03:a6:e7:20:de:97:3d:d6:84:a2:93:e7:b4:bb:20:30:41:d2:c7:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 128KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 80KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 120KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Code Sign

01Certificate

Key Usages

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

6b:a3:e1:47:8e:3a:2f:89:75:21:24:09:d1:92:88:0eCertificate

Extended Key Usages

Key Usages

dc:fc:11:29:10:85:86:c3:94:d0:2c:d0:bb:01:6b:e0:7c:dd:64:81Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 88KB

.rsrc Size: 26KB - Virtual size: 25KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 572B

7437979d52f22ddb30327daa1adb110d

Code Sign

01Certificate

Key Usages

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

01
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

6b:a3:e1:47:8e:3a:2f:89:75:21:24:09:d1:92:88:0e
Certificate

dc:fc:11:29:10:85:86:c3:94:d0:2c:d0:bb:01:6b:e0:7c:dd:64:81
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 88KB

.rsrc
Size: 26KB - Virtual size: 25KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 572B

01
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

6b:a3:e1:47:8e:3a:2f:89:75:21:24:09:d1:92:88:0e
Certificate

67:3f:a4:b6:a6:7f:30:bd:64:1a:21:24:79:b5:a9:4e:40:bb:82:21
Signer

.text
Size: 988KB - Virtual size: 988KB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 1.3MB - Virtual size: 1.4MB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

01
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

6b:a3:e1:47:8e:3a:2f:89:75:21:24:09:d1:92:88:0e
Certificate

67:3f:a4:b6:a6:7f:30:bd:64:1a:21:24:79:b5:a9:4e:40:bb:82:21
Signer

.text
Size: 988KB - Virtual size: 988KB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 1.3MB - Virtual size: 1.4MB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB