windirstat1_1_2_setup[.]exe

resource
windirstat1_1_2_setup.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$_5_
unpack001/Uninstall.exe
unpack002/$PLUGINSDIR/System.dll
unpack001/shfolder.dll
unpack001/wdsr0405.dll
unpack001/wdsr0407.dll
unpack001/wdsr040a.dll
unpack001/wdsr040b.dll
unpack001/wdsr040c.dll
unpack001/wdsr040e.dll
unpack001/wdsr0410.dll
unpack001/wdsr0413.dll
unpack001/wdsr0415.dll
unpack001/wdsr0419.dll
unpack001/wdsr0425.dll
unpack001/windirstat.exe

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_1

windirstat1_1_2_setup.exe

IMPHASH 97318da386948415d08cef4a9006d669
SHA256 370a27a30ee57247faddeb1f99a83933247e07c8760a07ed82e451e1cb5e5cdd
MD5 3abf1c149873e25d4e266225fbf37cbf
SHA1 6fa92dd2ca691c11dfbfc0a239e34369897a7fab
SHA512 b6d9672a580a02299bc370deb1fd99b5ca10ab86456385870cdae522c185ae51f8d390a7c50fcb5c7898523f52c834bb73515ffc6d0b0bcde210640e815ece9e
SSDEEP 12288:yCjeMsiGVBKvjxTNlZaLlcMj+wXZvQpd9nP2+ZMU2tYspZcMwr/GNd35:yCjeTZa7BTsxewXZUTP2HU2yawjY5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12901

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 7e08cb4ff81dbb0573c672301681e31b2042682e9a2204673f811455f823dd37
MD5 9b2ad0546fd834c01a3bdcbfbc95da7d
SHA1 4f92f5a6b269d969ba3340f1c1978d337992a62c
SHA512 5b374fe7cc8d6ff8b93cfcc8deae23f2313f8240c998d04d3e65c196b33c7d36a33930ffd481cdd6d30aa4c73dd2a1c6fe43791e9bf10bd71b33321a8e71c6b8
SSDEEP 192:v6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTKK72dwF7dBdcQOz:v6JaVh4I5rpPbTK+BdhO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 6692bd93bcd04146831652780c1170da79aa3784c3c070d95fb1580e339de6c5
MD5 4125926391466fdbe8a4730f2374b033
SHA1 fdd23034ada72d2537939ac6755d7f7c0e9b3f0e
SHA512 32a1cf96842454b3c3641316ee39051ae024bdce9e88ac236eadad531f2c0a08d46b77d525f7d994c9a5af4cc9a391d30ee92b9ec782b7fb9a42c76f0f52a008
SSDEEP 192:4O6dJA/ruAFEiUdWWE6hE5RYUdJfbub1algMO:RKAFERdlxhGRYUzqZal
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_5_

IMPHASH b3e2efb711bd309a22addde2f35c372c
SHA256 f12d0929055567eee4b5842b7e59c34585a03191447de682dc729ad19aa2314f
MD5 3f3dd4476249ae664e3365e5bb651601
SHA1 752e1687d58de3bef927d9ad24c0ed3da3754e17
SHA512 c9d38fa61fac0f48e8c2bc319c87df31f1ee49e8bc383ce348042480e1f0d0c28f198fbfa8cb6dd62f5767ae51ce8e67a7f527213fe1043987add465f1ba97df
SSDEEP 12288:5nKnA/rpVTNPjAuufoRqGKRsytFTkzpjSp+Km:InA/zTN7AvfJGAsuTkzu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

233129

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Projekte\!cvs\WinDirStat\windirstat\make\windirstat\Release\windirstat.pdb

kernel32

GetSystemInfo VirtualQuery GetStartupInfoA GetCommandLineA ExitThread CreateThread HeapReAlloc TerminateProcess HeapSize HeapDestroy HeapCreate VirtualFree IsBadWritePtr QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW VirtualAlloc LCMapStringW GetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetTimeZoneInformation IsBadReadPtr IsBadCodePtr SetStdHandle SetEnvironmentVariableA LocalFree HeapAlloc ExitProcess HeapFree RtlUnwind GetCurrentDirectoryA FindResourceExA LocalFileTimeToFileTime GetShortPathNameA CreateFileA DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile DeleteFileA MoveFileA SystemTimeToFileTime GetOEMCP GetCPInfo InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc TlsGetValue GlobalHandle GlobalReAlloc LocalAlloc GlobalFlags GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA GetPrivateProfileStringA WritePrivateProfileStringA GetPrivateProfileIntA VirtualProtect FindFirstFileA FileTimeToLocalFileTime FindNextFileA FindClose InterlockedDecrement GetDiskFreeSpaceA GetTempFileNameA GetFileTime SetFileTime lstrcmpA SetLastError MulDiv GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcatA lstrcmpW CreateEventA SuspendThread SetEvent WaitForSingleObject SetThreadPriority GlobalFree GetFullPathNameA GetModuleFileNameA ResumeThread GetUserDefaultLangID GetCurrentProcess GetStringTypeExA CompareStringW CompareStringA lstrlenW lstrcmpiA GetVersion RaiseException LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection SearchPathA FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetUserDefaultLCID GetWindowsDirectoryA GetFileAttributesA GetProfileIntA GlobalAlloc GlobalLock lstrcpyA GlobalUnlock GetDriveTypeA GetTickCount GetCurrentThreadId GetSystemDirectoryA FileTimeToSystemTime GetDateFormatA GetTimeFormatA GetEnvironmentVariableA GetLogicalDrives SetErrorMode GetVolumeInformationA GetDiskFreeSpaceExA lstrlenA CreateProcessA CloseHandle FreeResource GetLastError lstrcpynA MultiByteToWideChar WideCharToMultiByte FormatMessageA FindResourceA LoadResource LockResource SizeofResource GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange LCMapStringA

user32

GetNextDlgGroupItem SetWindowContextHelpId ShowOwnedPopups GetSystemMenu IsRectEmpty SetParent IsZoomed MapDialogRect GetAsyncKeyState DestroyCursor SetCursorPos GetMenuItemInfoA DestroyMenu UnpackDDElParam ReuseDDElParam SetCursor LoadAcceleratorsA InsertMenuItemA CreatePopupMenu SetRectEmpty SetMenu TranslateAcceleratorA wsprintfA EndPaint BeginPaint GetWindowDC GrayStringA DrawTextExA DrawTextA TabbedTextOutA FillRect GetMenuStringA InsertMenuA ShowWindow MoveWindow SetWindowTextA IsDialogMessageA WinHelpA GetClassLongA GetClassInfoExA GetClassNameA SetPropA GetPropA RemovePropA SendDlgItemMessageA SetFocus IsChild GetWindowTextLengthA GetWindowTextA GetForegroundWindow GetLastActivePopup GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints MessageBoxA TrackPopupMenuEx TrackPopupMenu SetScrollPos GetScrollPos GetMenu PostMessageA GetMenuItemID InvalidateRgn EqualRect SetWindowPlacement GetDlgCtrlID DefWindowProcA CallWindowProcA SetWindowLongA SetWindowPos IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindow SetMenuItemBitmaps GetMenuState CheckMenuItem GetMenuCheckMarkDimensions SetWindowsHookExA CallNextHookEx IsWindowVisible GetKeyState ValidateRect SendMessageA GetWindowRect GetClientRect HideCaret EnableWindow IsWindow InflateRect DrawEdge ClientToScreen ScreenToClient InvalidateRect GetParent GetSysColor OffsetRect CreateWindowExA ReleaseDC GetDC GetActiveWindow SetActiveWindow GetSystemMetrics CreateDialogIndirectParamA DestroyWindow GetWindowLongA GetDlgItem IsWindowEnabled GetNextDlgTabItem EndDialog GetMessageA ReleaseCapture SetCapture CopyAcceleratorTableA CharNextA DestroyIcon GetDCEx WindowFromPoint FindWindowA SetRect GetCapture LoadStringA LockWindowUpdate UnregisterClassA CharUpperA RegisterWindowMessageA SetForegroundWindow UpdateWindow BringWindowToTop DrawFocusRect GetFocus LoadBitmapA CopyRect SetClipboardData EmptyClipboard OpenClipboard RemoveMenu GetMenuItemCount EnableMenuItem MessageBeep GetSysColorBrush AdjustWindowRectEx RegisterClipboardFormatA DeleteMenu SetMenuDefaultItem GetSubMenu ModifyMenuA LoadMenuA RedrawWindow GetDesktopWindow PostQuitMessage DispatchMessageA TranslateMessage PeekMessageA MsgWaitForMultipleObjects PtInRect SetTimer KillTimer RegisterClassA GetClassInfoA GetCursorPos PostThreadMessageA LoadCursorA LoadIconA EndDeferWindowPos DeferWindowPos BeginDeferWindowPos CloseClipboard AppendMenuA

gdi32

CreateFontIndirectA SetRectRgn CombineRgn GetMapMode GetTextExtentPoint32A StretchDIBits GetCharWidthA CreateFontA GetTextMetricsA EnumFontFamiliesExA GetBkColor GetTextColor GetRgnBox CreateSolidBrush CreatePen GetStockObject CreatePatternBrush DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible CreateRectRgn GetWindowExtEx GetViewportExtEx CreateCompatibleBitmap SelectClipRgn DeleteObject MoveToEx LineTo IntersectClipRect ExcludeClipRect SetMapMode SetBkMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox CreateBitmap PatBlt CreateRectRgnIndirect Ellipse GetDeviceCaps Pie GetPixel GetObjectA SetPixel BitBlt Rectangle CreateCompatibleDC

comdlg32

GetOpenFileNameA GetSaveFileNameA GetFileTitleA ChooseColorA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

GetUserNameA RegOpenKeyExA RegQueryValueExA RegSetValueA RegOpenKeyA SetFileSecurityA GetFileSecurityA RegCreateKeyExA RegSetValueExA RegDeleteValueA RegDeleteKeyA RegEnumKeyA RegQueryValueA RegCreateKeyA RegCloseKey

shell32

DragFinish ShellExecuteExA SHGetSpecialFolderLocation SHGetDesktopFolder SHFileOperationA ExtractIconA DragQueryFileA ShellExecuteA SHBrowseForFolderA SHGetFileInfoA

comctl32

ImageList_Draw ImageList_GetIcon ImageList_SetBkColor ImageList_AddMasked ImageList_GetImageCount ImageList_GetImageInfo ImageList_Duplicate ord8 ord17 ImageList_Destroy PropertySheetA DestroyPropertySheetPage ImageList_ReplaceIcon CreatePropertySheetPageA

shlwapi

PathFindFileNameA PathStripToRootA PathFindExtensionA PathIsUNCA

oledlg

ord8

ole32

OleInitialize CoFreeUnusedLibraries OleUninitialize CLSIDFromString CLSIDFromProgID CoTaskMemAlloc CoTaskMemFree CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject CreateILockBytesOnHGlobal

oleaut32

SysFreeString SysAllocStringLen VariantClear VariantChangeType VariantInit SysStringLen SysAllocStringByteLen VariantCopy SafeArrayDestroy SystemTimeToVariantTime SysAllocString OleCreateFontIndirect

Uninstall.exe

IMPHASH 97318da386948415d08cef4a9006d669
SHA256 afc864cfce79b2a6add491a27ea672d958233ed7a97a2cbbce60100d2fa1e670
MD5 a127e6118b9dd2f9d5a7cc4d697a0105
SHA1 9ac17d4dcf0884ceafacf10c42209c0942dfe7a8
SHA512 0e57d2856c02c55d477d9b3cc1d4bf5ffa3650d4b20be18b0a9e614d19143aee325c4cd92ff31bbddf6e93cd3ebeb47d8727de6e25faa366341cc71117122065
SSDEEP 768:tnCHBjSfD0RDSjiN+WWrHcRtf55M4z54q+F5871mJMOUlNu0ZBA9U:MHFSfARDSW0HefHbmJZUlNu0bP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12901

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 6692bd93bcd04146831652780c1170da79aa3784c3c070d95fb1580e339de6c5
MD5 4125926391466fdbe8a4730f2374b033
SHA1 fdd23034ada72d2537939ac6755d7f7c0e9b3f0e
SHA512 32a1cf96842454b3c3641316ee39051ae024bdce9e88ac236eadad531f2c0a08d46b77d525f7d994c9a5af4cc9a391d30ee92b9ec782b7fb9a42c76f0f52a008
SSDEEP 192:4O6dJA/ruAFEiUdWWE6hE5RYUdJfbub1algMO:RKAFERdlxhGRYUzqZal
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shfolder.dll

IMPHASH a8568b57714f17bea2cb443650a1c951
SHA256 e69da5febb5a2932cbe731e32a5d7f6615bb987a119ef2cedead4555d86144e8
MD5 33c369a535290299ed5e5167cea37fdc
SHA1 4ea387cb55cada35de02738dfb324ab830d416f4
SHA512 581f2bf315c90e200fd621477d0192c6b3b4c51575b9d9f8c85114783c4425a7de221898055aa275068e4c6c5fb0458eb13a66b4512cc7499e7cc7843aaf9e78
SSDEEP 384:kqXjRYAhfBALfdpju122HoSHigH2euwsHTGHVb+d3HmnH+aHjHqLHxmoqQG0CHuz:kWjRLhZAL7juAL4+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

4292

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wdsh0407.chm

SHA256 181a23a56b7649d5e1c882786de531fedfb9e80a58c96ad92871f72a626eac14
MD5 64aa305e920630d0f813691f4187c496
SHA1 4bbc9397c16de7cd9869252632fe038b8f8ad384
SHA512 fde86a9a5b55756371af0d4bbb7a0b542b9765503657368540a651d153f84359fdb75522331b7672a0c242c107765e5c0ce717f60b18ff8b1bd2ef5aee44351d
SSDEEP 1536:EN2/oYDyp7DUWsbIxXXVP2sQoizOut88vS:O2wYDyuWsUxHVP2sQoizJ88q
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

wdsh040e.chm

SHA256 8e54bc2dd576d4bfe241e37305a525d80fd9839ed0de2e34abedf49c7f23f5cf
MD5 bc90b966e06c5c20486815809606c77d
SHA1 12d7ba627d77187c1a41b552ab3c6556ba4a4823
SHA512 26047532e3d6c495dc6a7b0c8d0479018227c189f1c0228ea83a209b5422ac88188c9e9cb7422ec02fc8c9dbc0ac3ce2588a62d8648fde616b9cd61b85a155b9
SSDEEP 1536:V6iw3SziWVuxJ16cuZ4GMFtoEOq6YShAvLpAE/Q:IiJ2uux/6cuZVG/6lhOqYQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

wdsh0415.chm

SHA256 bab7db85927f846a6ac584d5fc3fb522e812fc1e505e333728f85efd16b50238
MD5 de97a75cfa6d6cbf91ba68c0c90695c1
SHA1 5932fd0fadb6ef284605e2410b5045dcc131ac93
SHA512 7714be7430c309d2b63dfd1e90446925f417ee500b06350f595d43b9c0db121339151ea7e0440922dd6c11534e23572da3d2c9d31dc21c808a8a840ec8e0f172
SSDEEP 768:kb69pw0scpr+Mo4OiKvc7DqL1hjzZwAsGHJLg9KM9G/b0/P3eubAHOjDIhR7Iop/:kb6Xw07XXq9umATqMeWAHqvYnFHt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

wdsr0405.dll

SHA256 7463df064c98cdb501b2310dcac878f9210a303d50d79431152e3031ae1a224a
MD5 8eee4f1cde4b0cfd0365456040e05364
SHA1 b38200f4a3af27a59ec08fde2c6aaac4727dffbf
SHA512 17da577977c6766dc56ee08726ae77f4cbbf83da1037c976d8ca36c7149bee56fd691ab735fc4a12721d86860fddc39ff99bb74aa515de96bd2da0596fbd33ab
SSDEEP 768:yOWz6n36MwlqZT5nNAPxIkRXIafTGO6kRfw/WZaKCam:yVSBNoSkRXIafqjkRf4QCam
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wdsr0407.dll

SHA256 7867b69c5deff7f949e58eb3ff1b266e66ad3fd252c52334927114e7c53ce27b
MD5 619767bb217f6d1754e018926753e89f
SHA1 cb731df1d74ceec090cb55fb76e9dfd6e4337400
SHA512 8bb7c717206a3b86bf4c5d46d0a838373ae557708040656f9c2cb47db5f38165bb9160545d2f6d9200b9ff59160292f88044abd997bcc01e46b40a4dcf58318a
SSDEEP 768:QniT9wgpxcn37TFb0FuIa955yo7evokJrOLoZaKCam:QnbgpsLt4uIa95h7evokJr4OCam
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wdsr040a.dll

SHA256 75ca96992380e5b8e323310a01c8a68805ad76223197d2bdaecc03817d233dea
MD5 cf69ec4f622ab3efc0d59c94c7861d3c
SHA1 8baa748295cb941e1693e4c2a298343fbfc5c048
SHA512 dcc99395fed596e6ef7a959731254093e73fa006a14b0ecbe6f780a9d8236428d9e90024e016d5f1bdbf323e1fe01ffa3727c9d09a8666ef2745dc56462ed6cf
SSDEEP 384:jH6u7Vn2KDadkOKDVdS9Ew5eNC1GF8wcgnSLIdOpAv18/pIaqSivHxACkwYcwiZY:HxKQ8wcgnSQOi16IaavWiZaKCam
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wdsr040b.dll

SHA256 d7fb9404282ca467e0f3e80734a388885c219269d3e9ee78bb66ee9201803ae4
MD5 4a5a97171af49b09f1c68ba7a9bdae34
SHA1 a6ed7e9ed8a4d9b462378571346fba1d40f1c75a
SHA512 51a0f250cbd115f532970a291ef477de89cff786df28ee8729d35f68c8cb0f018a58e9edbaf758ff11172b68952f8fe3b74ff8ca6e8e62a482712126ddd40323
SSDEEP 768:ne1K36pwrqnfPAY5IaBNqhN+3ATwZaKCam:ne1oAQY5IaGqXCam
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wdsr040c.dll

SHA256 acd0c6b92acb5793a94e820c4d418bd6114c97fe2b9788de73879b8bf220a717
MD5 ed8a32ce3b4edbd63b6ed2b6d5ff5d5a
SHA1 ebb687857dff99fecc532e254445a8f3abb89e6c
SHA512 8b3d9a9d0c684c4b1563abf9c65e511e0b42ac0161e9d4ea811fbee2beed05ece24450f4c997294ebb8330f2ead6688041c8ba528889205ec93ffb50fc8671e9
SSDEEP 768:uQWoYnbSwuHmnfPhckTBfIamFUseyqTj4e1ZaKCam:uxNHx9lfIa1Cam
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wdsr040e.dll

SHA256 3bb682f3088fac19c4d53b3766a3793630ea19d2be33cb0f26f7f9e5972dc221
MD5 08b9dbd8b49783f4d04f9ed4b1ecefa7
SHA1 76852aae0722e20e21e67b2fb27f2ff70d5a1f87
SHA512 429201eef6b9c40d3330345ce2765e8038f488d90bcbf2b315d365f370d00ba2be7b245492b42dadbc220ce464f9b64b1985d4f958e4c9d26aacbd8b854b9c0b
SSDEEP 1536:jxuBkbqIfOtIa6BJjQ8wDl3Di5c2m5CuCam:NuBKqIfOtIa6BJjQ8wDl3Di5c2m5CJD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wdsr0410.dll

SHA256 e9c30274fcdeaa43acaeba3eac86628107ef60dbea723ececa97008b80f40fba
MD5 fc6f4868c21cc2b2c58882b3956462c5
SHA1 2aceeaa4bd9557880cffa3603cd25c51e9ce5a1c
SHA512 34990a37f943a3953cc638ba56cd6251f2609eb3b5befa11c888b1d1902ae3724b6e8141706caa616b63245ce9dd75fa3ff2bb63d6e2f53a496692e280647ffe
SSDEEP 768:sHqiKwZ/nujjVfHZEIaGgDqBlDZaKCam:sH7du3tHZEIaGgGCam
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wdsr0413.dll

SHA256 b76f0d27ee66d4bdeb0b12ca7ef8773a563d57a0167ecf151c74837209a86e0c
MD5 7d7e18f5cdeb3502e9e7aefb49b2aec2
SHA1 e5e3f4ca6105546e0ed3d057680fca9c07317ab4
SHA512 b19a2f273ded1596b9684c50d6261631256ca6666160beabf4abb607845a9d0e743cb98906ab80f99d595c92c80ffccdd7397922bc084e05d91d38879836734b
SSDEEP 1536:4107oYuDSkKxxNpIaetXYaSAN/sPXNCam:tcYup6xNpIaetoaSANEPXQD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wdsr0415.dll

SHA256 f47cdc2d1ff1c77e3f4e008862d2cf632dc3db5145fa6d2886a0d066c0811eb9
MD5 b42cd5ebbc8170865a6d1375044aaaac
SHA1 95ede895c956e97b9be0295066cc671e3e69be06
SHA512 33a4910e17a64446cdfc95145c0a347e4d541f9d88c082eedaf672f4e1cf208ab43ce267d9cf9733d49c4373610e9ac84a4cc96ce71be742868d04bc9d8fdce3
SSDEEP 768:903q1wAPnLAdtO45vIaQnvvdBqqJZaKCam:90rstovIaQnb7Cam
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wdsr0419.dll

SHA256 43b0d07767c8fb8aadcaa976bec7f748bbc2591085feb500eb1a453ccd4b982f
MD5 4b8486682deabddcffbb4bea3e38c4ff
SHA1 bc006cf4eb5e5f39be1d824de9eb17de433506c2
SHA512 14a6cbfe32854ea263f02fa8494ab5499acae0ffa32b77dec24bfc9f96e91a8772297a2e538f3504f81e9ac6336b9b66c075b76e16207d08e25126e9d7260d8e
SSDEEP 1536:l/sdmd9Kzcv2Nm/UWrsIan9f9PTmCCam:dsdmdIzcv2Nm/UWrsIan9f97mlD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wdsr0425.dll

SHA256 7ff8234e53b3c7328b179fd6a7223eebea8f73802afaf7fb06ee9ca2b279b8e7
MD5 d8e5d81fdaa2524ecf7d1233e2f7b4af
SHA1 d40835cc04730d6fd510fe2ab7bdbfa8cb20c31f
SHA512 c0e1c81bbae262c4596017123d8bc9a66e31a213ef9f3aeb5594a22d087d8ff1dcd0d8f4fcce114c69ccff499f850b9f4938218762e44a3ba99626092d7b3d70
SSDEEP 384:aHfvvS1TOKDadkOKDVdS9Ew5eNC1Gb4XRwnZsiEApsxyIG/pIaqSeUnzphxj/t3M:oqY+SRwnZsjA+4IwIaPfrdzZaKCam
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

windirstat.chm

SHA256 1e87c07744054709d271337d8ce06929429b334d70875605cb68ecc4c6610cd1
MD5 1bddb8a0e0f9cd90a5b3936ec2c2c4cf
SHA1 c8302168fb532fe03e76cb8a82aa53b49ee0bc44
SHA512 b857de9026b3eab13f4dbc464e6403835e3a61e5e9e3566735bf1ddd8dedc4ecf08807b27207bd8b385250b71ea234b301dd49e6f3c90f1270ae03868c035472
SSDEEP 768:bGA4nw8h2r+N1m0WUrKI/vjf6NDxFfC/0L7qM+ZE+ox4nnW99vpuhzK10gim:bGAT62r+N1uUll/YQZFy4nQ/uxK1Gm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

windirstat.exe

IMPHASH 7c6d8e50d7c0e8326fce0f8eecb79276
SHA256 cc3ee246f2710dc9ba9e2a88e3192b88f1db4caa2eefb8641642a33df04e585c
MD5 24cd9a82fcfc658dd3ae7ba25c958ffb
SHA1 26e14a532e1e050eb20755a0b7a5fea99dd80588
SHA512 4de675be1f7d618d133ef24765a027840473e0c5bc93550d5e5fdbf078edc74c2241e6e3cd8753517e2954c7f09b9909028de7b727294d723fb5700658c7979d
SSDEEP 12288:o5UnhjOmG0fJO6egoEQFauJsfmhR5ju0phsQkPaUynbiljjQt6pgw/HuADm:qUnxUjJVhRZdpmQkYyjjQtSgK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

225930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Projekte\!cvs\WinDirStat\windirstat\make\windirstat\UnicodeRelease\windirstat.pdb

kernel32

GetSystemInfo VirtualQuery TerminateProcess HeapSize GetStdHandle GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree IsBadWritePtr QueryPerformanceCounter GetCurrentProcessId VirtualAlloc SetUnhandledExceptionFilter LCMapStringA LCMapStringW GetTimeZoneInformation GetOEMCP GetCPInfo IsBadReadPtr IsBadCodePtr GetStringTypeA GetStringTypeW GetDriveTypeA SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA HeapReAlloc HeapAlloc CreateThread ExitThread ExitProcess HeapFree RtlUnwind GetStartupInfoW GetCurrentDirectoryW FindResourceExW LocalFileTimeToFileTime GetShortPathNameW CreateFileW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetStringTypeExW DeleteFileW MoveFileW SystemTimeToFileTime InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc TlsGetValue GlobalHandle GlobalReAlloc LocalAlloc GlobalFlags lstrcmpiW GetCurrentThread lstrcmpiA ConvertDefaultLocale EnumResourceLanguagesW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileIntW VirtualProtect FindFirstFileW FileTimeToLocalFileTime FindNextFileW FindClose GetVersion GlobalGetAtomNameW InterlockedDecrement GetDiskFreeSpaceW GetTempFileNameW GetFileTime SetFileTime lstrcmpA SetLastError MulDiv GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom GetModuleHandleA lstrcatW lstrcmpW GetVersionExA CreateEventW SuspendThread SetEvent WaitForSingleObject SetThreadPriority GlobalFree LoadLibraryA GetFullPathNameW GetModuleFileNameW ResumeThread GetUserDefaultLangID GetCurrentProcess RaiseException LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection SearchPathW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW GetUserDefaultLCID GetWindowsDirectoryW GetFileAttributesW WideCharToMultiByte GetProfileIntW GlobalAlloc GlobalLock lstrcpyW GlobalUnlock GetDriveTypeW GetTickCount GetCurrentThreadId GetSystemDirectoryW FileTimeToSystemTime GetDateFormatW GetTimeFormatW GetEnvironmentVariableW GetLogicalDrives SetErrorMode GetVolumeInformationW GetLocaleInfoW GetDiskFreeSpaceExW lstrlenW CreateProcessW CloseHandle FreeResource GetLastError lstrcpynW lstrlenA FormatMessageW FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar GetVersionExW GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange GetSystemTimeAsFileTime LocalFree

user32

GetSysColorBrush RegisterClipboardFormatW SetWindowContextHelpId ShowOwnedPopups GetSystemMenu IsRectEmpty SetParent IsZoomed MapDialogRect GetAsyncKeyState DestroyCursor SetCursorPos SystemParametersInfoW GetMenuItemInfoW DestroyMenu UnpackDDElParam ReuseDDElParam SetCursor LoadAcceleratorsW InsertMenuItemW CreatePopupMenu SetRectEmpty SetMenu TranslateAcceleratorW wsprintfW EndPaint BeginPaint GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW FillRect GetMenuStringW InsertMenuW ShowWindow MoveWindow SetWindowTextW IsDialogMessageW WinHelpW CreateWindowExW GetClassInfoExW GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SendDlgItemMessageW SendDlgItemMessageA SetFocus IsChild GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetLastActivePopup GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints MessageBoxW TrackPopupMenuEx TrackPopupMenu SetScrollPos GetMenu PostMessageW GetMenuItemID AdjustWindowRectEx EqualRect SetWindowPlacement GetDlgCtrlID DefWindowProcW CallWindowProcW SetWindowLongW SetWindowPos IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindow SetMenuItemBitmaps GetMenuState CheckMenuItem GetMenuCheckMarkDimensions SetWindowsHookExW CallNextHookEx IsWindowVisible GetKeyState ValidateRect ReleaseDC GetDC GetActiveWindow SetActiveWindow GetSystemMetrics CreateDialogIndirectParamW DestroyWindow GetWindowLongW GetDlgItem IsWindowEnabled GetNextDlgTabItem EndDialog GetMessageW ReleaseCapture SetCapture GetCapture LoadStringW LockWindowUpdate UnregisterClassW RegisterWindowMessageW SetForegroundWindow UpdateWindow BringWindowToTop DrawFocusRect GetFocus LoadBitmapW GetNextDlgGroupItem InvalidateRgn CopyAcceleratorTableW CharNextW DestroyIcon GetDCEx WindowFromPoint FindWindowW CopyRect SetClipboardData EmptyClipboard OpenClipboard RemoveMenu GetMenuItemCount EnableMenuItem AppendMenuW CloseClipboard BeginDeferWindowPos DeferWindowPos EndDeferWindowPos LoadIconW LoadCursorW PostThreadMessageW GetCursorPos GetClassInfoW RegisterClassW KillTimer SetTimer PtInRect MsgWaitForMultipleObjects CharUpperW SetRect MessageBeep PeekMessageW TranslateMessage DispatchMessageW PostQuitMessage GetDesktopWindow RedrawWindow LoadMenuW ModifyMenuW GetSubMenu SetMenuDefaultItem DeleteMenu OffsetRect GetSysColor GetParent InvalidateRect ScreenToClient ClientToScreen DrawEdge InflateRect IsWindow EnableWindow HideCaret GetClientRect GetWindowRect SendMessageW GetScrollPos

gdi32

GetMapMode GetTextExtentPoint32W StretchDIBits GetCharWidthW CreateFontW GetTextMetricsW EnumFontFamiliesExW GetBkColor GetTextColor GetRgnBox CombineRgn CreateRectRgn SelectClipRgn DeleteObject MoveToEx LineTo IntersectClipRect ExcludeClipRect SetRectRgn CreateFontIndirectW CreateSolidBrush CreatePen GetStockObject CreatePatternBrush DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible GetWindowExtEx CreateCompatibleBitmap SetMapMode SetBkMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox CreateBitmap PatBlt CreateRectRgnIndirect Ellipse GetDeviceCaps Pie GetPixel GetObjectW SetPixel BitBlt Rectangle CreateCompatibleDC GetViewportExtEx

comdlg32

GetOpenFileNameW GetSaveFileNameW GetFileTitleW ChooseColorW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

GetUserNameW RegOpenKeyExW RegQueryValueExW RegQueryValueExA RegOpenKeyExA RegSetValueW RegOpenKeyW SetFileSecurityW GetFileSecurityW RegCreateKeyExW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegEnumKeyW RegQueryValueW RegCreateKeyW RegCloseKey

shell32

DragFinish ShellExecuteExW SHGetSpecialFolderLocation SHGetDesktopFolder SHFileOperationW ExtractIconW DragQueryFileW ShellExecuteW SHBrowseForFolderW SHGetFileInfoW

comctl32

ImageList_ReplaceIcon ImageList_GetIcon ImageList_GetImageCount ImageList_Draw ImageList_SetBkColor ImageList_GetImageInfo ImageList_Duplicate ord8 ord17 ImageList_Destroy PropertySheetW DestroyPropertySheetPage ImageList_AddMasked CreatePropertySheetPageW

shlwapi

PathFindFileNameW PathStripToRootW PathFindExtensionW PathIsUNCW

oledlg

OleUIBusyW

ole32

OleInitialize CoFreeUnusedLibraries OleUninitialize CLSIDFromString CLSIDFromProgID CoTaskMemAlloc CoTaskMemFree CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject CreateILockBytesOnHGlobal

oleaut32

OleCreateFontIndirect SysAllocString SystemTimeToVariantTime SafeArrayDestroy VariantCopy SysStringLen VariantInit VariantChangeType VariantClear SysAllocStringLen SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

windirstat1_1_2_setup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$_5_

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic

Uninstall.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

shfolder.dll

kernel32

advapi32

generic

wdsh0407.chm

wdsh040e.chm

wdsh0415.chm

wdsr0405.dll

generic

wdsr0407.dll

generic

wdsr040a.dll

generic

wdsr040b.dll

generic

wdsr040c.dll

generic

wdsr040e.dll

generic

wdsr0410.dll

generic