kis13[.]0[.]0[.]3370EN_3104[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

kis13.0.0.3370EN_3104.exe
Size

144.2MB
MD5

7f29656ede0b3633f637649e8cbb66d5
SHA1

a30fd5b2643eb453318b8af8292ea43dc52244b7
SHA256

70faaae20047323c8efc230555fb8304ca1db25ab31afb3a21d8437d8cd2900c
SHA512

025edd74c1f6c307d1ef9446e576f2592bc8cc6a3a4fd2850255bbafad2365724ea40052bcbee9030a05d4c3c203f8ccc6f3d93c9c86c7790338a17eaf5b2ad0
SSDEEP

3145728:Qi10vJU9LeYhs4vwJzVRIXSD4CD6hnH0bFmTYW+gxeSpF:vou77v0zV/D4td0p9Wb

Score

3^/10

Malware Config

Signatures

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack002/Bases/bsshlp.kdl
unpack008/arkmon.kdl
unpack008/kavsys.kdl
unpack008/kjim.kdl
unpack008/klavemu.kdl
unpack008/mark.kdl
unpack008/pbs.kdl
unpack008/qscan.kdl
unpack002/Bases/klavasyswatch.dll
unpack002/Bases/sys_critical_obj.dll

Files

kis13.0.0.3370EN_3104.exe
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:e5:a7:75:12:03:00:fb:34:19:45:8b:40:d4:08:34
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/02/2012, 00:00

Not After

07/03/2013, 23:59

Subject

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:d1:cb:38:61:d9:6b:fe:83:ac:5e:dd:c2:c3:b1:5a:d5:de:de:e6
Signer

Actual PE Digest

03:d1:cb:38:61:d9:6b:fe:83:ac:5e:dd:c2:c3:b1:5a:d5:de:de:e6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 580KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
corebases.cab
.cab
Bases/Apu/log0
.iso
out.iso
.iso
apu.dat
apu.set
apu.stt
apu0001.dat
apu0002.dat
apu0003.dat
apu0004.dat
apu0005.dat
apu0006.dat
apu0007.dat
apu0008.dat
apu0009.dat
apu0010.dat
apu0011.dat
apu0012.dat
apu0013.dat
apu0014.dat
apu0015.dat
apu0016.dat
apu0017.dat
apu0018.dat
apu0019.dat
apu0020.dat
apu0021.dat
apu0022.dat
apu0023.dat
apu0024.dat
apu0025.dat
apu0026.dat
apu0027.dat
apu0028.dat
apu0029.dat
apu0030.dat
apu0031.dat
apu0032.dat
apu0033.dat
apu0034.dat
apu0035.dat
apu0036.dat
apu0037.dat
apu0038.dat
apu0039.dat
apu0040.dat
apu0041.dat
index.bin
Bases/Stat/ah.stt
Bases/Stat/apu.stt
Bases/Stat/ssa.stt
Bases/Stat/sw2.stt
Bases/Stat/wmuf.stt
Bases/Wmuf/log0
.iso
out.iso
.iso
index.bin
wmuf.set
wmuf.stt
wmuf0000.dat
wmuf0001.dat
wmuf0002.dat
wmuf0003.dat
wmuf0004.dat
wmuf0005.dat
wmuf0006.dat
wmuf0007.dat
wmuf0008.dat
wmuf0009.dat
wmuf0010.dat
wmuf0011.dat
wmuf0012.dat
wmuf0013.dat
wmuf0014.dat
wmuf0015.dat
wmuf0016.dat
wmuf0017.dat
wmuf0018.dat
wmuf0019.dat
wmuf0020.dat
wmuf0021.dat
wmuf0022.dat
wmuf0023.dat
wmuf0024.dat
wmuf0025.dat
wmuf0026.dat
wmuf0027.dat
.ps1
wmuf0028.dat
wmuf0029.dat
wmuf0030.dat
wmuf0031.dat
wmuf0032.dat
wmuf0033.dat
wmuf0034.dat
wmuf0035.dat
wmuf0036.dat
wmuf0037.dat
wmuf0038.dat
wmuf0039.dat
wmuf0040.dat
wmuf0041.dat
wmuf0042.dat
wmuf0043.dat
wmuf0044.dat
wmuf0045.dat
wmuf0046.dat
wmuf0047.dat
wmuf0048.dat
wmuf0049.dat
wmuf0050.dat
wmuf0051.dat
wmuf0052.dat
wmuf0053.dat
wmuf0054.dat
wmuf0055.dat
wmuf0056.dat
wmuf0057.dat
wmuf0058.dat
wmuf0059.dat
wmuf0060.dat
wmuf0061.dat
wmuf0062.dat
wmuf0063.dat
Bases/ah-0607g.xml
Bases/appcat.xms
Bases/apu-0607g.xml
Bases/ark-0607g.xml
Bases/arkmon32.dat
Bases/arkmon64.dat
Bases/backup.avz
Bases/bl0001.dat
Bases/bl0002.dat
Bases/bl0003.dat
Bases/bl0004.dat
Bases/bl0005.dat
Bases/bl0006.dat
Bases/bl0007.dat
Bases/bl0008.dat
Bases/bl0009.dat
Bases/bl0010.dat
Bases/bl0011.dat
Bases/bl0012.dat
Bases/bl0013.dat
Bases/bl0014.dat
Bases/bl0015.dat
Bases/bl0016.dat
Bases/bl0017.dat
Bases/bl0018.dat
Bases/bl0019.dat
Bases/bl0020.dat
Bases/bl0021.dat
Bases/bl0022.dat
Bases/blst2-0607g.xml
Bases/bsshlp.kdl
.dll windows:5 windows x86 arch:x86

cea869a7343193d9494104ee1907a749

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

O:\out_Win32\Release\bsshlp.pdb

Imports

kernel32

HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
GetProcessHeap
Sleep
GetCurrentProcess
InterlockedCompareExchange
GetCurrentThread
OpenProcess
CreateFileW
GetLastError
DeviceIoControl
CloseHandle
GetSystemTimeAsFileTime
GetVersionExW
FreeLibrary
LoadLibraryW
GetProcAddress
GetSystemInfo
InitializeCriticalSection
SetStdHandle
WriteConsoleW
DecodePointer
EncodePointer
WideCharToMultiByte
MultiByteToWideChar
SwitchToThread
GetCurrentThreadId
GetModuleFileNameW
GetThreadTimes
HeapReAlloc
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
IsProcessorFeaturePresent
GetStringTypeW
WriteFile
GetStdHandle
GetLocaleInfoW
RaiseException
InitializeSListHead
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapCreate
HeapDestroy
HeapSize
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
RtlUnwind
InterlockedExchange
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
CompareStringW

user32

CharLowerBuffW
CharLowerBuffA
GetSystemMetrics

psapi

GetModuleBaseNameW
GetProcessImageFileNameW

Exports

Exports

KLAV_Bsshlp_Factory
KLAV_Get_BSS_Helpers_Ex

Sections

.text
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bases/bt.avz
Bases/emu-0607g.xml
Bases/fwpresets.xms
Bases/geosec.xms
Bases/geowl.dat
Bases/info-0607g.xml
Bases/kav13-0607g.xml
Bases/kdb-i386-0607g.xml
Bases/keylogger.avz
Bases/klava/log0
.iso
out.iso
.iso
arkmon.kdl
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 21KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pklav
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
arkmon32.dat
arkmon64.dat
avengine.dll
.dll windows:4 windows x86 arch:x86

73bfe36177254de53f1f4aef1e003a9e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:e5:a7:75:12:03:00:fb:34:19:45:8b:40:d4:08:34
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/02/2012, 00:00

Not After

07/03/2013, 23:59

Subject

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:3e:7a:ef:69:a2:14:3c:40:f0:a3:5a:03:39:01:39:93:c2:77:da
Signer

Actual PE Digest

2c:3e:7a:ef:69:a2:14:3c:40:f0:a3:5a:03:39:01:39:93:c2:77:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\build\projects\avengine\src\out_win32\releases\avengine.pdb

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

psapi

GetModuleInformation
GetModuleBaseNameW
EnumProcessModules

kernel32

UnmapViewOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
TlsGetValue
TlsSetValue
HeapAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GetModuleFileNameA
GetCurrentProcess
GetLastError
FreeLibrary
LoadLibraryW
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
TlsFree
InterlockedIncrement
InterlockedDecrement
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
TlsAlloc
CreateEventW
Sleep
InterlockedExchange
HeapDestroy
HeapCreate
DuplicateHandle
GetCurrentThread
GetTickCount
GetThreadTimes
GetCurrentThreadId
WaitForSingleObject
SetEvent
ResetEvent
ResumeThread
SetThreadContext
GetThreadContext
SuspendThread
OpenThread
HeapReAlloc
InterlockedCompareExchange
LoadLibraryA
FindFirstFileW
FindClose
CreateDirectoryW
FindNextFileW
DeleteFileW
RaiseException
GetModuleHandleA
DeviceIoControl
GetFullPathNameW
CreateFileA
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseMutex
PulseEvent
SignalObjectAndWait
CreateEventA
CreateMutexA
MapViewOfFile
CreateFileMappingA
SetErrorMode
GetVersionExA
ReadFile
SetFilePointer
WriteFile
GetFileSize
SetEndOfFile
FlushFileBuffers
CreateFileMappingW
FileTimeToLocalFileTime
GetUserDefaultLCID
GetSystemDefaultLCID
GetModuleHandleW
WideCharToMultiByte
MultiByteToWideChar
SearchPathA
GetFileAttributesA
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualQuery
ExitThread
CreateThread
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
SetLastError
GetStdHandle
GetACP
GetOEMCP
IsValidCodePage
HeapSize
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
EnumSystemLocalesA
IsValidLocale

user32

CharLowerBuffW
CharUpperBuffW

Exports

Exports

ekaCanUnloadModule
ekaGetObjectFactory

Sections

.text
Size: 292KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
avengine.esm
.xml
base001.kdc
base001c.kdc
base002.kdc
base002c.kdc
base003.kdc
base003c.kdc
base004.kdc
base004c.kdc
base005.kdc
base005c.kdc
base006.kdc
base006c.kdc
base007.kdc
base007c.kdc
base008.kdc
base008c.kdc
base009.kdc
base009c.kdc
base00ac.kdc
base00bc.kdc
base00cc.kdc
base00dc.kdc
base00ec.kdc
base00fc.kdc
base010.kdc
base010c.kdc
base011.kdc
base011c.kdc
base012.kdc
base012c.kdc
base013c.kdc
base014c.kdc
base015c.kdc
base016c.kdc
base017c.kdc
base018c.kdc
base019c.kdc
base01ac.kdc
base01bc.kdc
base01cc.kdc
base01dc.kdc
base01ec.kdc
base01fc.kdc
base020c.kdc
base021c.kdc
base022c.kdc
base023c.kdc
base024c.kdc
base025c.kdc
base026c.kdc
base027c.kdc
base028c.kdc
base029c.kdc
base02ac.kdc
base02bc.kdc
base02cc.kdc
base02dc.kdc
base02ec.kdc
base02fc.kdc
base030c.kdc
base031c.kdc
base032c.kdc
base033c.kdc
base034c.kdc
base035c.kdc
base036c.kdc
base037c.kdc
base038c.kdc
base039c.kdc
base03ac.kdc
base03bc.kdc
base03cc.kdc
base03dc.kdc
base03ec.kdc
base03fc.kdc
base040c.kdc
base041c.kdc
base042c.kdc
base043c.kdc
base044c.kdc
base045c.kdc
base046c.kdc
base047c.kdc
base048c.kdc
base049c.kdc
base04ac.kdc
base04bc.kdc
base04cc.kdc
base04dc.kdc
base04ec.kdc
base04fc.kdc
base050c.kdc
base051c.kdc
base052c.kdc
base053c.kdc
base054c.kdc
base055c.kdc
base056c.kdc
base057c.kdc
base058c.kdc
base059c.kdc
base05ac.kdc
base05bc.kdc
base05cc.kdc
base05dc.kdc
base05ec.kdc
base05fc.kdc
base060c.kdc
base061c.kdc
base062c.kdc
base063c.kdc
base064c.kdc
base065c.kdc
base066c.kdc
base067c.kdc
base068c.kdc
base069c.kdc
base06ac.kdc
base06bc.kdc
base06cc.kdc
base06dc.kdc
base06ec.kdc
base06fc.kdc
base070c.kdc
base071c.kdc
base072c.kdc
base073c.kdc
base074c.kdc
base075c.kdc
base076c.kdc
base077c.kdc
base078c.kdc
base079c.kdc
base07ac.kdc
base07bc.kdc
base07cc.kdc
base07dc.kdc
base07ec.kdc
base07fc.kdc
base080c.kdc
base081c.kdc
base082c.kdc
base083c.kdc
base084c.kdc
base085c.kdc
base086c.kdc
base087c.kdc
base088c.kdc
base089c.kdc
base08ac.kdc
base08bc.kdc
base08cc.kdc
base08dc.kdc
base08ec.kdc
base08fc.kdc
base090c.kdc
base091c.kdc
base092c.kdc
base093c.kdc
base094c.kdc
base095c.kdc
base096c.kdc
base097c.kdc
base098c.kdc
base099c.kdc
base09ac.kdc
base09bc.kdc
base09cc.kdc
base09dc.kdc
base09ec.kdc
base09fc.kdc
base0a0c.kdc
base0a1c.kdc
base0a2c.kdc
base0a3c.kdc
base0a4c.kdc
base0a5c.kdc
base0a6c.kdc
base0a7c.kdc
base0a8c.kdc
base0a9c.kdc
base0aac.kdc
base0abc.kdc
base0acc.kdc
base0adc.kdc
base0aec.kdc
base0afc.kdc
base0b0c.kdc
base0b1c.kdc
base0b2c.kdc
base0b3c.kdc
base0b4c.kdc
base0b5c.kdc
base0b6c.kdc
base0b7c.kdc
base0b8c.kdc
base0b9c.kdc
base0bac.kdc
base0bbc.kdc
base0bcc.kdc
base0bdc.kdc
base0bec.kdc
base0bfc.kdc
base0c0c.kdc
base0c1c.kdc
base0c2c.kdc
base0c3c.kdc
base0c4c.kdc
base0c5c.kdc
base0c6c.kdc
base0c7c.kdc
base0c8c.kdc
base0c9c.kdc
base0cac.kdc
base0cbc.kdc
base0ccc.kdc
base0cdc.kdc
base0cec.kdc
base0cfc.kdc
base0d0c.kdc
base0d1c.kdc
base0d2c.kdc
base0d3c.kdc
base0d4c.kdc
base0d5c.kdc
base0d6c.kdc
base0d7c.kdc
base0d8c.kdc
base0d9c.kdc
base0dac.kdc
base0dbc.kdc
base0dcc.kdc
base0ddc.kdc
base0dec.kdc
base0dfc.kdc
base0e0c.kdc
base0e1c.kdc
base0e2c.kdc
base0e3c.kdc
base0e4c.kdc
base0e5c.kdc
base0e6c.kdc
base0e7c.kdc
base0e8c.kdc
base0e9c.kdc
base0eac.kdc
base0ebc.kdc
base0ecc.kdc
base0edc.kdc
base0eec.kdc
base0efc.kdc
.ps1
base0f0c.kdc
base0f1c.kdc
base0f2c.kdc
base0f3c.kdc
base0f4c.kdc
base0f5c.kdc
base0f6c.kdc
base0f7c.kdc
base0f8c.kdc
base0f9c.kdc
base0fac.kdc
base0fbc.kdc
base0fcc.kdc
base0fdc.kdc
base0fec.kdc
base0ffc.kdc
base100c.kdc
base101c.kdc
base102c.kdc
base103c.kdc
base104c.kdc
base105c.kdc
base106c.kdc
base107c.kdc
base108c.kdc
base109c.kdc
base10ac.kdc
base10bc.kdc
base10cc.kdc
base10dc.kdc
base10ec.kdc
base10fc.kdc
base110c.kdc
base111c.kdc
base112c.kdc
base113c.kdc
base114c.kdc
base115c.kdc
base116c.kdc
base117c.kdc
base118c.kdc
base119c.kdc
base11ac.kdc
base11bc.kdc
base11cc.kdc
base11dc.kdc
base11ec.kdc
base11fc.kdc
base120c.kdc
base121c.kdc
base122c.kdc
base123c.kdc
base124c.kdc
base125c.kdc
base126c.kdc
base127c.kdc
base128c.kdc
base129c.kdc
base12ac.kdc
base12bc.kdc
base12cc.kdc
base12dc.kdc
base12ec.kdc
base12fc.kdc
base130c.kdc
base131c.kdc
base132c.kdc
base133c.kdc
base134c.kdc
base135c.kdc
base136c.kdc
base137c.kdc
base138c.kdc
base139c.kdc
base13ac.kdc
base13bc.kdc
base13cc.kdc
base13dc.kdc
base13ec.kdc
base13fc.kdc
base140c.kdc
base141c.kdc
base142c.kdc
base143c.kdc
base144c.kdc
base145c.kdc
base146c.kdc
base147c.kdc
base148c.kdc
base149c.kdc
base14ac.kdc
base14bc.kdc
base14cc.kdc
base14dc.kdc
base14ec.kdc
base14fc.kdc
base150c.kdc
base151c.kdc
base152c.kdc
base153c.kdc
base154c.kdc
base155c.kdc
base156c.kdc
base157c.kdc
base158c.kdc
base159c.kdc
base15ac.kdc
base15bc.kdc
base15cc.kdc
base15dc.kdc
base15ec.kdc
base15fc.kdc
base160c.kdc
base161c.kdc
base162c.kdc
base163c.kdc
base164c.kdc
base165c.kdc
base166c.kdc
base167c.kdc
base168c.kdc
base169c.kdc
base16ac.kdc
base16bc.kdc
base16cc.kdc
base16dc.kdc
base16ec.kdc
base16fc.kdc
base170c.kdc
base171c.kdc
base172c.kdc
base173c.kdc
base174c.kdc
base175c.kdc
base176c.kdc
base177c.kdc
base178c.kdc
base179c.kdc
base17ac.kdc
base17bc.kdc
base17cc.kdc
base17dc.kdc
base17ec.kdc
base17fc.kdc
base180c.kdc
base181c.kdc
base182c.kdc
base183c.kdc
base184c.kdc
base185c.kdc
base186c.kdc
base187c.kdc
base188c.kdc
base189c.kdc
base18ac.kdc
base18bc.kdc
base18cc.kdc
base18dc.kdc
base18ec.kdc
base18fc.kdc
base190c.kdc
base191c.kdc
base192c.kdc
base193c.kdc
base194c.kdc
base195c.kdc
base196c.kdc
base197c.kdc
base198c.kdc
base199c.kdc
base19ac.kdc
base19bc.kdc
base19cc.kdc
base19dc.kdc
base19ec.kdc
base19fc.kdc
base1a0c.kdc
base1a1c.kdc
base1a2c.kdc
base1a3c.kdc
base1a4c.kdc
base1a5c.kdc
base1a6c.kdc
base1a7c.kdc
base1a8c.kdc
base1a9c.kdc
base1aac.kdc
base1abc.kdc
base1acc.kdc
base1adc.kdc
base1aec.kdc
base1afc.kdc
base1b0c.kdc
base1b1c.kdc
base1b2c.kdc
base1b3c.kdc
base1b4c.kdc
base1b5c.kdc
base1b6c.kdc
base1b7c.kdc
base1b8c.kdc
base1b9c.kdc
base1bac.kdc
base1bbc.kdc
base1bcc.kdc
base1bdc.kdc
base1bec.kdc
base1bfc.kdc
base1c0c.kdc
base1c1c.kdc
base1c2c.kdc
base1c3c.kdc
base1c4c.kdc
.ps1
base1c5c.kdc
base1c6c.kdc
base1c7c.kdc
base1c8c.kdc
base1c9c.kdc
base1cac.kdc
base1cbc.kdc
base1ccc.kdc
base1cdc.kdc
base1cec.kdc
base1cfc.kdc
base1d0c.kdc
base1d1c.kdc
base1d2c.kdc
base1d3c.kdc
base1d4c.kdc
base1d5c.kdc
base1d6c.kdc
base1d7c.kdc
base1d8c.kdc
base1d9c.kdc
base1dac.kdc
base1dbc.kdc
base1dcc.kdc
base1ddc.kdc
base1dec.kdc
base1dfc.kdc
base1e0c.kdc
base1e1c.kdc
base1e2c.kdc
base1e3c.kdc
base1e4c.kdc
base1e5c.kdc
base1e6c.kdc
base1e7c.kdc
base1e8c.kdc
base1e9c.kdc
base1eac.kdc
base1ebc.kdc
base1ecc.kdc
base1edc.kdc
base1eec.kdc
base1efc.kdc
base1f0c.kdc
base1f1c.kdc
base1f2c.kdc
base1f3c.kdc
base1f4c.kdc
base1f5c.kdc
base1f6c.kdc
base1f7c.kdc
base1f8c.kdc
base1f9c.kdc
base1fac.kdc
base1fbc.kdc
base1fcc.kdc
base1fdc.kdc
base1fec.kdc
base1ffc.kdc
base200c.kdc
base201c.kdc
base202c.kdc
base203c.kdc
base204c.kdc
base205c.kdc
base206c.kdc
base207c.kdc
base208c.kdc
base209c.kdc
base20ac.kdc
base20bc.kdc
base20cc.kdc
base20dc.kdc
base20ec.kdc
base20fc.kdc
base210c.kdc
base211c.kdc
base212c.kdc
base213c.kdc
base214c.kdc
base215c.kdc
base216c.kdc
base217c.kdc
base218c.kdc
base219c.kdc
base21ac.kdc
base21bc.kdc
base21cc.kdc
base21dc.kdc
base21ec.kdc
base21fc.kdc
base220c.kdc
base221c.kdc
base222c.kdc
base223c.kdc
base224c.kdc
base225c.kdc
base226c.kdc
base227c.kdc
base228c.kdc
base229c.kdc
base22ac.kdc
base22bc.kdc
base22cc.kdc
base22dc.kdc
base22ec.kdc
base22fc.kdc
base230c.kdc
base231c.kdc
base232c.kdc
base233c.kdc
base234c.kdc
base235c.kdc
base236c.kdc
base237c.kdc
base238c.kdc
base239c.kdc
base23ac.kdc
base23bc.kdc
base23cc.kdc
base23dc.kdc
base23ec.kdc
base23fc.kdc
base240c.kdc
base241c.kdc
base242c.kdc
base243c.kdc
base244c.kdc
base245c.kdc
base246c.kdc
base247c.kdc
base248c.kdc
base249c.kdc
base24ac.kdc
base24bc.kdc
base24cc.kdc
base24dc.kdc
base24ec.kdc
base24fc.kdc
base250c.kdc
base251c.kdc
base252c.kdc
base253c.kdc
base254c.kdc
base255c.kdc
base256c.kdc
base257c.kdc
base258c.kdc
base259c.kdc
base25ac.kdc
base25bc.kdc
base25cc.kdc
base25dc.kdc
base25ec.kdc
base25fc.kdc
base260c.kdc
base261c.kdc
base262c.kdc
base263c.kdc
base264c.kdc
base265c.kdc
base266c.kdc
base267c.kdc
base268c.kdc
base269c.kdc
base26ac.kdc
base26bc.kdc
base26cc.kdc
base26dc.kdc
base26ec.kdc
base26fc.kdc
base270c.kdc
base271c.kdc
base272c.kdc
base273c.kdc
base274c.kdc
base275c.kdc
base276c.kdc
base277c.kdc
base278c.kdc
base279c.kdc
base27ac.kdc
base27bc.kdc
base27cc.kdc
base27dc.kdc
base27ec.kdc
base27fc.kdc
base280c.kdc
base281c.kdc
base282c.kdc
base283c.kdc
base284c.kdc
base285c.kdc
base286c.kdc
base287c.kdc
base288c.kdc
base289c.kdc
base28ac.kdc
base28bc.kdc
base28cc.kdc
base28dc.kdc
base28ec.kdc
base28fc.kdc
base290c.kdc
base291c.kdc
base292c.kdc
base293c.kdc
base294c.kdc
base295c.kdc
base296c.kdc
base297c.kdc
base298c.kdc
base299c.kdc
base29ac.kdc
base29bc.kdc
base29cc.kdc
base29dc.kdc
base29ec.kdc
base29fc.kdc
base2a0c.kdc
base2a1c.kdc
base2a2c.kdc
base2a3c.kdc
base2a4c.kdc
base2a5c.kdc
base2a6c.kdc
base2a7c.kdc
base2a8c.kdc
base2a9c.kdc
base2aac.kdc
base2abc.kdc
base2acc.kdc
base2adc.kdc
base2aec.kdc
base2afc.kdc
base2b0c.kdc
base2b1c.kdc
base2b2c.kdc
base2b3c.kdc
base2b4c.kdc
base2b5c.kdc
base2b6c.kdc
base2b7c.kdc
base2b8c.kdc
.ps1
base2b9c.kdc
base2bac.kdc
base2bbc.kdc
base2bcc.kdc
base2bdc.kdc
base2bec.kdc
base2bfc.kdc
base2c0c.kdc
base2c1c.kdc
base2c2c.kdc
base2c3c.kdc
base2c4c.kdc
base2c5c.kdc
base2c6c.kdc
base2c7c.kdc
base2c8c.kdc
base2c9c.kdc
base2cac.kdc
base2cbc.kdc
base2ccc.kdc
base2cdc.kdc
base2cec.kdc
base2cfc.kdc
base2d0c.kdc
base2d1c.kdc
base2d2c.kdc
base2d3c.kdc
base2d4c.kdc
base2d5c.kdc
base2d6c.kdc
base2d7c.kdc
base2d8c.kdc
base2d9c.kdc
base2dac.kdc
base2dbc.kdc
base2dcc.kdc
base2ddc.kdc
base2dec.kdc
base2dfc.kdc
base2e0c.kdc
base2e1c.kdc
base2e2c.kdc
base2e3c.kdc
base2e4c.kdc
base2e5c.kdc
base2e6c.kdc
base2e7c.kdc
base2e8c.kdc
base2e9c.kdc
base2eac.kdc
base2ebc.kdc
base2ecc.kdc
base2edc.kdc
base2eec.kdc
base2efc.kdc
base2f0c.kdc
base2f1c.kdc
base2f2c.kdc
base2f3c.kdc
base2f4c.kdc
base2f5c.kdc
base2f6c.kdc
base2f7c.kdc
base2f8c.kdc
base2f9c.kdc
base2fac.kdc
base2fbc.kdc
base2fcc.kdc
base2fdc.kdc
base2fec.kdc
base2ffc.kdc
base300c.kdc
base301c.kdc
base302c.kdc
base303c.kdc
base304c.kdc
base305c.kdc
base306c.kdc
base307c.kdc
base308c.kdc
base309c.kdc
base30ac.kdc
base30bc.kdc
base30cc.kdc
base30dc.kdc
base30ec.kdc
base30fc.kdc
base310c.kdc
base311c.kdc
base312c.kdc
base313c.kdc
base314c.kdc
base315c.kdc
base316c.kdc
base317c.kdc
base318c.kdc
base319c.kdc
base31ac.kdc
base31bc.kdc
base31cc.kdc
base31dc.kdc
base31ec.kdc
base31fc.kdc
base320c.kdc
base321c.kdc
base322c.kdc
base323c.kdc
base324c.kdc
base325c.kdc
base326c.kdc
base327c.kdc
base328c.kdc
base329c.kdc
base32ac.kdc
base32bc.kdc
base32cc.kdc
base32dc.kdc
base32ec.kdc
base32fc.kdc
base330c.kdc
base331c.kdc
base332c.kdc
base333c.kdc
base334c.kdc
base335c.kdc
base336c.kdc
base337c.kdc
base338c.kdc
base339c.kdc
base33ac.kdc
base33bc.kdc
base33cc.kdc
base33dc.kdc
base33ec.kdc
base33fc.kdc
base340c.kdc
base341c.kdc
base342c.kdc
base343c.kdc
base344c.kdc
base345c.kdc
base346c.kdc
base347c.kdc
base348c.kdc
base349c.kdc
base34ac.kdc
base34bc.kdc
base34cc.kdc
base34dc.kdc
base34ec.kdc
base34fc.kdc
base350c.kdc
base351c.kdc
base352c.kdc
base353c.kdc
base354c.kdc
base355c.kdc
base356c.kdc
base357c.kdc
base358c.kdc
base359c.kdc
base35ac.kdc
base35bc.kdc
base35cc.kdc
base35dc.kdc
base35ec.kdc
base35fc.kdc
base360c.kdc
base361c.kdc
base362c.kdc
base363c.kdc
base364c.kdc
base365c.kdc
base366c.kdc
base367c.kdc
base368c.kdc
base369c.kdc
base36ac.kdc
base36bc.kdc
base36cc.kdc
.ps1
base36dc.kdc
base36ec.kdc
base36fc.kdc
base370c.kdc
base371c.kdc
base372c.kdc
base373c.kdc
base374c.kdc
base375c.kdc
base376c.kdc
base377c.kdc
base378c.kdc
.ps1
base379c.kdc
base37ac.kdc
base37bc.kdc
base37cc.kdc
base37dc.kdc
base37ec.kdc
base37fc.kdc
base380c.kdc
base381c.kdc
base382c.kdc
base383c.kdc
base384c.kdc
base385c.kdc
base386c.kdc
base387c.kdc
base388c.kdc
base389c.kdc
base38ac.kdc
base38bc.kdc
base38cc.kdc
base38dc.kdc
base38ec.kdc
base38fc.kdc
base390c.kdc
base391c.kdc
base392c.kdc
base393c.kdc
base394c.kdc
base395c.kdc
base396c.kdc
base397c.kdc
base398c.kdc
base399c.kdc
base39ac.kdc
base39bc.kdc
base39cc.kdc
base39dc.kdc
base39ec.kdc
base39fc.kdc
base3a0c.kdc
base3a1c.kdc
base3a2c.kdc
base3a3c.kdc
base3a4c.kdc
base3a5c.kdc
base3a6c.kdc
base3a7c.kdc
base3a8c.kdc
base3a9c.kdc
base3aac.kdc
base3abc.kdc
base3acc.kdc
base3adc.kdc
base3aec.kdc
base3afc.kdc
base3b0c.kdc
base3b1c.kdc
base3b2c.kdc
base3b3c.kdc
base3b4c.kdc
base3b5c.kdc
base3b6c.kdc
base3b7c.kdc
base3b8c.kdc
base3b9c.kdc
base400c.kdc
base401c.kdc
base402c.kdc
base403c.kdc
base404c.kdc
base405c.kdc
base406c.kdc
base407c.kdc
base408c.kdc
base409c.kdc
base410c.kdc
base411c.kdc
base412c.kdc
base413c.kdc
base414c.kdc
base415c.kdc
base416c.kdc
base417c.kdc
base418c.kdc
base419c.kdc
base420c.kdc
base421c.kdc
base422c.kdc
base423c.kdc
base424c.kdc
base425c.kdc
base426c.kdc
base427c.kdc
base428c.kdc
base429c.kdc
base430c.kdc
base431c.kdc
base432c.kdc
base433c.kdc
base434c.kdc
base435c.kdc
base436c.kdc
base437c.kdc
base438c.kdc
base439c.kdc
base440c.kdc
base441c.kdc
base442c.kdc
base443c.kdc
base444c.kdc
base445c.kdc
base446c.kdc
base447c.kdc
base448c.kdc
base449c.kdc
base450c.kdc
base451c.kdc
base452c.kdc
base453c.kdc
base454c.kdc
base455c.kdc
base456c.kdc
base457c.kdc
base458c.kdc
base459c.kdc
base460c.kdc
base461c.kdc
base462c.kdc
base463c.kdc
base464c.kdc
base465c.kdc
base466c.kdc
base467c.kdc
base468c.kdc
base469c.kdc
base470c.kdc
base471c.kdc
base472c.kdc
base473c.kdc
base474c.kdc
base475c.kdc
base476c.kdc
base999.kdc
baseec7c.kdc
baseec8c.kdc
baseec9c.kdc
baseecac.kdc
baseecbc.kdc
baseeccc.kdc
baseecdc.kdc
baseecec.kdc
baseecfc.kdc
baseed0c.kdc
baseed1c.kdc
baseed2c.kdc
baseed3c.kdc
baseed4c.kdc
baseed5c.kdc
baseed6c.kdc
baseed7c.kdc
baseed8c.kdc
baseed9c.kdc
baseedac.kdc
baseedbc.kdc
baseedcc.kdc
baseeddc.kdc
baseedec.kdc
baseedfc.kdc
baseee0c.kdc
baseee1c.kdc
baseee2c.kdc
baseee3c.kdc
baseee4c.kdc
baseee5c.kdc
baseee6c.kdc
baseee7c.kdc
baseee8c.kdc
baseee9c.kdc
baseeeac.kdc
baseeebc.kdc
baseeecc.kdc
baseeedc.kdc
baseeeec.kdc
baseeefc.kdc
baseef0c.kdc
baseef1c.kdc
baseef2c.kdc
baseef3c.kdc
baseef4c.kdc
baseef5c.kdc
baseef6c.kdc
baseef7c.kdc
baseef8c.kdc
baseef9c.kdc
baseefac.kdc
baseefbc.kdc
baseefcc.kdc
baseefdc.kdc
baseefec.kdc
baseeffc.kdc
basef00c.kdc
basef01c.kdc
basef02c.kdc
basef03c.kdc
basef04c.kdc
basef05c.kdc
basef06c.kdc
basef07c.kdc
basef08c.kdc
basef09c.kdc
basef0ac.kdc
basef0bc.kdc
basef0cc.kdc
basef0dc.kdc
basef0ec.kdc
basef0fc.kdc
basef10c.kdc
basef11c.kdc
basef12c.kdc
basef13c.kdc
basef14c.kdc
basef15c.kdc
basef16c.kdc
basef17c.kdc
basef18c.kdc
basef19c.kdc
basef1ac.kdc
basef1bc.kdc
basef1cc.kdc
basef1dc.kdc
basef1ec.kdc
basef1fc.kdc
basef20c.kdc
basef21c.kdc
basef22c.kdc
basef23c.kdc
basef24c.kdc
basef25c.kdc
basef26c.kdc
basef27c.kdc
basef28c.kdc
basef29c.kdc
basef2ac.kdc
basef2bc.kdc
basef2cc.kdc
basef2dc.kdc
basef2ec.kdc
basef2fc.kdc
basef30c.kdc
basef31c.kdc
basef32c.kdc
basef33c.kdc
basef34c.kdc
basef35c.kdc
basef36c.kdc
basef37c.kdc
basef38c.kdc
basef39c.kdc
basef3ac.kdc
basef3bc.kdc
basef3cc.kdc
basef3dc.kdc
basef3ec.kdc
basef3fc.kdc
basef40c.kdc
basef41c.kdc
basef42c.kdc
basef43c.kdc
basef44c.kdc
basef45c.kdc
basef46c.kdc
basef47c.kdc
basef48c.kdc
basef49c.kdc
basef50c.kdc
basef51c.kdc
basef52c.kdc
basef53c.kdc
basef54c.kdc
basef55c.kdc
basef56c.kdc
basef57c.kdc
basef58c.kdc
basef59c.kdc
basef5ac.kdc
basef5bc.kdc
basef5cc.kdc
basef5dc.kdc
basef5ec.kdc
basef5fc.kdc
basef60c.kdc
basef61c.kdc
basef62c.kdc
basef63c.kdc
basef64c.kdc
basef65c.kdc
basef66c.kdc
basef67c.kdc
basef68c.kdc
basef69c.kdc
basef6ac.kdc
basef6bc.kdc
basef6cc.kdc
basef6dc.kdc
basef6ec.kdc
basef6fc.kdc
basef70c.kdc
basef71c.kdc
basef72c.kdc
basef73c.kdc
basef74c.kdc
basef75c.kdc
basef76c.kdc
basef77c.kdc
basef78c.kdc
ca001.kdc
ca002.kdc
ca003.kdc
chuka.kdc
compne.kdc
daily-ec.kdc
daily.kdc
dailyc.kdc
eicar.kdc
engine.kdc
ext001.kdc
ext001c.kdc
ext002c.kdc
ext003c.kdc
ext004c.kdc
ext005c.kdc
ext006c.kdc
ext007c.kdc
ext008c.kdc
ext009c.kdc
ext010c.kdc
ext011c.kdc
ext012c.kdc
ext013c.kdc
ext014c.kdc
ext015c.kdc
ext016c.kdc
ext017c.kdc
ext018c.kdc
ext019c.kdc
ext020c.kdc
ext021c.kdc
ext022c.kdc
ext023c.kdc
ext024c.kdc
ext025c.kdc
ext026c.kdc
ext027c.kdc
ext028c.kdc
ext029c.kdc
ext030c.kdc
ext161c.kdc
ext162c.kdc
ext163c.kdc
ext164c.kdc
ext165c.kdc
ext166c.kdc
ext167c.kdc
ext168c.kdc
ext169c.kdc
ext170c.kdc
ext171c.kdc
ext172c.kdc
ext173c.kdc
ext174c.kdc
ext175c.kdc
ext176c.kdc
ext177c.kdc
ext178c.kdc
ext179c.kdc
ext180c.kdc
ext181c.kdc
ext182c.kdc
ext183c.kdc
ext184c.kdc
ext185c.kdc
ext186c.kdc
ext187c.kdc
ext188c.kdc
ext189c.kdc
ext190c.kdc
ext191c.kdc
ext192c.kdc
ext193c.kdc
ext194c.kdc
ext195c.kdc
ext196c.kdc
ext197c.kdc
ext198c.kdc
ext199c.kdc
ext200c.kdc
ext201c.kdc
ext202c.kdc
ext999.kdc
fa.kdc
fa001.kdc
fa002.kdc
fa003.kdc
gen001.kdc
gen002.kdc
gen999.kdc
heur001.kdc
index.bin
kavbase.kdl
.dll windows:4 windows x86 arch:x86

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:e5:a7:75:12:03:00:fb:34:19:45:8b:40:d4:08:34
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/02/2012, 00:00

Not After

07/03/2013, 23:59

Subject

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:d6:a8:55:0b:83:8b:1f:72:96:88:a5:c5:2c:3a:69:f9:72:3d:7d
Signer

Actual PE Digest

6b:d6:a8:55:0b:83:8b:1f:72:96:88:a5:c5:2c:3a:69:f9:72:3d:7d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Build\Projects\KAVBASE\src\out_win32\releases\kavbase.pdb

Exports

Exports

KLAV_Engine_Create

Sections

.text
Size: 412KB - Virtual size: 410KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kavbase.mft
.vbs
kavsys.kdl
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 125KB - Virtual size: 308KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 17KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pklav
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kdb.stt
kernel.kdc
kimul32.dat
kimul64.dat
kjim.kdc
kjim.kdl
.dll windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 175KB - Virtual size: 472KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 55KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pklav
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kjim.mft
.vbs
klark32.dat
klark64.dat
klavemu.kdc
klavemu.kdl
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 782KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 348KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 29KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pklav
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
klavemu.mft
.vbs
klavemu01.kdc
klavemu02.kdc
klavemu03.kdc
klavemu04.kdc
klavemu05.kdc
klavemu06.kdc
klbg32.dat
klbg64.dat
krn001.kdc
krn002.kdc
krndos.kdc
krnengn.kdc
krnexe.kdc
krnexe32.kdc
krngen.kdc
krnjava.kdc
krnmacro.kdc
krnun001.kdc
krnun002.kdc
krnun003.kdc
mail.kdc
mark.kdc
mark.kdl
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 104KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 15KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pklav
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mark.mft
.vbs
mark32.dat
mark64.dat
mmheur01.kdc
noisetable.dat
ocr.kdc
pbs.ini
pbs.kdc
pbs.kdl
.dll windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 110KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 114KB - Virtual size: 652KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 116KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pklav
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pbs.mft
.vbs
qscan.esm
.xml
qscan.kdc
qscan.kdl
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 360KB - Virtual size: 896KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 47KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pklav
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qscan.mft
.vbs
smart.kdc
startup.ini
unp000.kdc
unp001.kdc
unp002.kdc
unp003.kdc
unp004.kdc
unp005.kdc
unp006.kdc
unp007.kdc
unp008.kdc
unp009.kdc
unp010.kdc
unp011.kdc
unp012.kdc
unp013.kdc
unp014.kdc
unp999.kdc
verdicts.ini
vlns.kdl
.dll windows:4 windows x86 arch:x86

54cc7c680844f3e95d9a5469a716c9b8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:a3:0b:cf:b2:e8:2a:d7:1f:54:1d:11:27:ab:d1:f6
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21/02/2011, 00:00

Not After

07/03/2012, 23:59

Subject

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3e:b2:bc:f1:f2:24:6f:f2:f2:d9:9a:9e:a7:0a:34:45:0d:c1:0e:e1
Signer

Actual PE Digest

3e:b2:bc:f1:f2:24:6f:f2:f2:d9:9a:9e:a7:0a:34:45:0d:c1:0e:e1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\build\projects\vlns\src\out_win32\release\vlns.pdb

Imports

kernel32

GetDriveTypeW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryA
MultiByteToWideChar
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CreateFileA
CloseHandle
FlushFileBuffers
RaiseException

Exports

Exports

KDC_Handler_Factory
KLAV_VLNS_CheckOS
KLAV_VLNS_Load
KLAV_VLNS_Process

Sections

.text
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vlns.mft
.vbs
vlns000.kdc
vlns001.kdc
vlns002.kdc
vlns003.kdc
vlns004.kdc
vlns005.kdc
vlns006.kdc
vlns007.kdc
vlns008.kdc
vlns009.kdc
vlns010.kdc
vlns011.kdc
vlns012.kdc
vlnsscn.kdc
Bases/klavasyswatch.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 856KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 48KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pklav
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Bases/klbg32.dat
Bases/klbg64.dat
Bases/klifppcfg-0607g.xml
Bases/klsrl.dat
Bases/ksn-0607g.xml
Bases/neural.avz
Bases/neurald.avz
Bases/neurale.avz
Bases/neuralm.avz
Bases/pdm-0607g.xml
Bases/pdm.kdl
.dll windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:a3:0b:cf:b2:e8:2a:d7:1f:54:1d:11:27:ab:d1:f6
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21/02/2011, 00:00

Not After

07/03/2012, 23:59

Subject

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:c9:d2:3e:40:df:90:79:c2:81:e8:9b:cb:43:07:c8:6d:f4:9c:89
Signer

Actual PE Digest

1c:c9:d2:3e:40:df:90:79:c2:81:e8:9b:cb:43:07:c8:6d:f4:9c:89

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Build\Projects\kavbase\src\out_win32\releases\pdm.pdb

Exports

Exports

KLAV_Engine_Create

Sections

.text
Size: 236KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bases/pdm00.kdc
Bases/pdm01.kdc
Bases/pdmkl.dat
Bases/ports.avz
Bases/prt.avz
Bases/qscan-0607g.xml
Bases/repair.avz
Bases/rootkit.avz
Bases/sa-res.avz
Bases/sa.avz
Bases/sco-i386-0607g.xml
Bases/scripts.avz
Bases/scu.avz
Bases/sr.avz
Bases/srdb.avz
Bases/ssa-0607g.xml
Bases/sw2-0607g.xml
Bases/sw2.esm
.xml
Bases/sw2.mft
.vbs
Bases/sys_critical_obj.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 80KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pklav
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Bases/sys_critical_obj.esm
.xml
Bases/syscheck.avz
Bases/sysipu.avz
Bases/trafmon.xms
Bases/tsw-auto.avz
Bases/tsw.avz
Bases/uds-0607g.xml
Bases/uds.dll
.dll windows:4 windows x86 arch:x86

4b398b9bb307356b22c0a02fdf8f4cb3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:e5:a7:75:12:03:00:fb:34:19:45:8b:40:d4:08:34
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/02/2012, 00:00

Not After

07/03/2013, 23:59

Subject

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:fc:95:a8:91:be:1e:73:8e:44:95:e0:ef:f9:c2:b0:40:2d:af:da
Signer

Actual PE Digest

2c:fc:95:a8:91:be:1e:73:8e:44:95:e0:ef:f9:c2:b0:40:2d:af:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\bs\449\binaries\win32\release\uds.pdb

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
DeleteCriticalSection
InterlockedIncrement
CreateEventW
CreateSemaphoreW
EnterCriticalSection
WaitForSingleObject
LeaveCriticalSection
GetLastError
CloseHandle
Sleep
CompareStringW
SetEvent
ReleaseSemaphore
InitializeCriticalSection
InterlockedDecrement
CreateFileW
ReadFile
GetFileSize
InterlockedExchange
WideCharToMultiByte
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetVersionExA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
HeapSize
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers

Exports

Exports

ekaCanUnloadModule
ekaGetObjectFactory

Sections

.text
Size: 160KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bases/uds.esm
.xml
Bases/upd-0607g.xml
Bases/vlns-0607g.xml
Bases/wa-0607g.xml
Bases/wmuf-0607g.xml
Data/klifpp.xms
Data/ksn_client3.xms
Data/ksn_helper.xms
Data/ksncliwin32keys.dat
Data/statcfg.xml
.xml
Data/sw2.xms
Data/u0607g.xml
Data/updcfg.xml
.xml
Data/wnstat2.xms
Dskm/ah-0607g.krg
Dskm/ah-0607g.pbv
Dskm/apu-0607g.krg
Dskm/apu-0607g.pbv
Dskm/ark-0607g.krg
Dskm/ark-0607g.pbv
Dskm/bb-0607g.krg
Dskm/bb-0607g.pbv
Dskm/blst2-0607g.krg
Dskm/blst2-0607g.pbv
Dskm/core-bin-0607g.pbv
Dskm/emu-0607g.krg
Dskm/emu-0607g.pbv
Dskm/info-0607g.krg
Dskm/info-0607g.pbv
Dskm/kdb-i386-0607g.krg
Dskm/kdb-i386-0607g.pbv
Dskm/kl-0607g.pbv
Dskm/klifppcfg-0607g.krg
Dskm/klifppcfg-0607g.pbv
Dskm/ksn-0607g.krg
Dskm/ksn-0607g.pbv
Dskm/qscan-0607g.krg
Dskm/qscan-0607g.pbv
Dskm/rm-0607g.krg
Dskm/rm-0607g.pbv
Dskm/sco-0607g.krg
Dskm/sco-0607g.pbv
Dskm/ssa-0607g.krg
Dskm/ssa-0607g.pbv
Dskm/sw2-0607g.krg
Dskm/sw2-0607g.pbv
Dskm/uds-0607g.krg
Dskm/uds-0607g.pbv
Dskm/upd-0607g.krg
Dskm/upd-0607g.pbv
Dskm/vlns-0607g.krg
Dskm/vlns-0607g.pbv
Dskm/wa-0607g.krg
Dskm/wa-0607g.pbv
Dskm/wmuf-0607g.krg
Dskm/wmuf-0607g.pbv
corebasesx64.cab
.cab
Bases/idsbase.kdz
.zip
corebasesx86.cab
.cab
ipm.cab
.cab
kavkis.cab
.cab
kavkis.msi
.msi
kleaner.cab
.cab
productbases.cab
.cab
setup.exe
.exe windows:5 windows x86 arch:x86

c56d217b8bec7b4c88001ae8297459f8

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:e5:a7:75:12:03:00:fb:34:19:45:8b:40:d4:08:34
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/02/2012, 00:00

Not After

07/03/2013, 23:59

Subject

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:e4:0c:52:d6:4b:ba:3b:55:9a:4a:25:ac:99:d5:47:42:62:ea:ed
Signer

Actual PE Digest

22:e4:0c:52:d6:4b:ba:3b:55:9a:4a:25:ac:99:d5:47:42:62:ea:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

R:\142\390\Binaries\Win32\ReleaseKIS\setup.pdb

Imports

msi

ord118
ord159
ord160
ord32
ord94
ord8
ord92
ord47
ord34
ord70
ord111
ord205
ord43
ord150
ord145
ord169
ord137
ord88
ord141
ord78

wininet

InternetCrackUrlW
HttpOpenRequestW
FtpOpenFileW
InternetWriteFile
InternetOpenUrlW
InternetReadFile
HttpSendRequestW
InternetErrorDlg
HttpQueryInfoW
InternetSetOptionW
InternetSetStatusCallbackW
InternetOpenW
InternetCloseHandle
InternetCreateUrlW
InternetConnectW

rpcrt4

UuidCreate
UuidFromStringW

kernel32

UnlockFile
GetVolumeInformationW
GetFullPathNameW
GetTempFileNameW
GetWindowsDirectoryW
GetNumberFormatW
GetFileAttributesExW
FileTimeToLocalFileTime
GetFileSizeEx
GetFileTime
SetErrorMode
GetProfileIntW
Sleep
SearchPathW
VirtualProtect
lstrcpyW
HeapSetInformation
GetStartupInfoW
DecodePointer
EncodePointer
VirtualAlloc
GetSystemInfo
VirtualQuery
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
RtlUnwind
HeapReAlloc
ExitProcess
ExitThread
CreateThread
HeapQueryInformation
HeapSize
SetStdHandle
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
GetStringTypeW
LCMapStringW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetEnvironmentVariableA
GetSystemDirectoryW
GlobalGetAtomNameW
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
WritePrivateProfileStringW
GetPrivateProfileIntW
ResumeThread
SetThreadPriority
lstrcmpA
GetCurrentThread
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
LoadLibraryExW
InterlockedExchange
GetThreadLocale
GlobalSize
FormatMessageW
MulDiv
FreeResource
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetModuleHandleW
CompareStringW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LockFile
CreateEventW
ReleaseMutex
CreateMutexW
RaiseException
SetLastError
ActivateActCtx
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
FileTimeToDosDateTime
SetFilePointer
GetFileSize
SystemTimeToFileTime
GetSystemTime
GetFileInformationByHandle
GetFileType
FileTimeToSystemTime
FindResourceW
SetProcessShutdownParameters
GetCommandLineW
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
GetDiskFreeSpaceExW
GetNativeSystemInfo
GetUserGeoID
GetGeoInfoW
GetModuleFileNameW
ExpandEnvironmentStringsW
WideCharToMultiByte
InterlockedCompareExchange
WaitNamedPipeW
FlushFileBuffers
ReadFile
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
FindResourceExW
SizeofResource
LockResource
LoadResource
LocalFree
GlobalAddAtomA
GlobalFindAtomA
GetModuleHandleA
EnumResourceLanguagesW
GetUserDefaultUILanguage
EnumResourceNamesW
GetTickCount
WriteFile
lstrlenA
lstrlenW
ResetEvent
MultiByteToWideChar
SetUnhandledExceptionFilter
OpenProcess
GetCurrentProcessId
GetLocalTime
ReleaseSemaphore
CreateSemaphoreA
DuplicateHandle
SetEndOfFile
SetFilePointerEx
CreateFileW
HeapAlloc
HeapFree
GetProcessHeap
InterlockedDecrement
GetCurrentProcess
GetVersionExW
RemoveDirectoryW
FindClose
FindNextFileW
MoveFileExW
DeleteFileW
FindFirstFileW
SetFileAttributesW
CreateDirectoryW
GetFileAttributesW
lstrcpynW
SetCurrentDirectoryW
GetCurrentDirectoryW
SetEvent
CreateEventA
CloseHandle
WaitForSingleObject
GetCurrentThreadId
GetPrivateProfileSectionNamesW
GetPrivateProfileStringW
CopyFileW
GetLastError
GetTempPathW
InterlockedIncrement
lstrcmpW
FreeLibrary
GetProcAddress
LoadLibraryW
lstrcmpiW
WaitForMultipleObjects
DeviceIoControl
AreFileApisANSI
FormatMessageA
OpenEventA
SetWaitableTimer
CreateWaitableTimerA
GetTimeFormatA
GetUserDefaultLCID
GetDateFormatA

user32

UnionRect
MonitorFromPoint
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
UnpackDDElParam
ReuseDDElParam
InsertMenuItemW
TranslateAcceleratorW
PostThreadMessageW
LoadImageW
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
GetMenuDefaultItem
LockWindowUpdate
BringWindowToTop
SetCursorPos
CreateAcceleratorTableW
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyW
ToUnicodeEx
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
DrawStateW
GetSystemMenu
SetClassLongW
GetAsyncKeyState
NotifyWinEvent
WindowFromPoint
CreatePopupMenu
DestroyAcceleratorTable
SetParent
IsZoomed
RegisterClipboardFormatW
CharUpperW
DestroyIcon
IsIconic
KillTimer
SetTimer
DeleteMenu
MessageBeep
GetNextDlgGroupItem
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
LoadCursorW
GetSysColorBrush
CopyImage
RealChildWindowFromPoint
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
InflateRect
SetCapture
InvalidateRgn
IntersectRect
SetRect
IsRectEmpty
CopyAcceleratorTableW
UnregisterClassW
ShowOwnedPopups
SetCursor
GetMessageW
TranslateMessage
GetCursorPos
PostQuitMessage
GetWindowThreadProcessId
LoadMenuW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
OffsetRect
CharNextW
UpdateLayeredWindow
GetMenuStringW
AppendMenuW
RemoveMenu
SetWindowContextHelpId
MapDialogRect
MoveWindow
SetWindowTextW
WaitMessage
CheckDlgButton
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
IsWindowEnabled
GetNextDlgTabItem
EndDialog
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
RedrawWindow
IsWindowVisible
ValidateRect
UpdateWindow
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
RegisterClassW
GetSysColor
AdjustWindowRectEx
GetParent
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
IsMenu
GetWindowRgn
DestroyCursor
DrawIcon
SubtractRect
MapVirtualKeyExW
GetKeyNameTextW
IsCharLowerW
GetDoubleClickTime
CharUpperBuffW
CopyIcon
CallWindowProcW
GetMenu
GetWindowLongW
SetWindowLongW
SetWindowPos
CopyRect
PtInRect
GetWindow
RegisterWindowMessageW
GetClientRect
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
GetUpdateRect
FrameRect
IsClipboardFormatAvailable
GetMenuState
SetMenuDefaultItem
UnhookWindowsHookEx
ShowWindow
MessageBoxA
GetClassInfoW
MessageBoxW
SetWindowRgn
SetFocus
GetFocus
TrackMouseEvent
EnableWindow
PostMessageW
InvalidateRect
GetSystemMetrics
GetWindowRect
SendMessageW
ReleaseCapture
LoadIconW
wsprintfW
CreateMenu
IsDialogMessageW
InsertMenuW

gdi32

CreateSolidBrush
CreateHatchBrush
CreateRectRgnIndirect
GetRgnBox
CreateFontIndirectW
GetTextExtentPoint32W
CreateDIBitmap
CreateCompatibleBitmap
GetTextMetricsW
EnumFontFamiliesW
GetTextCharsetInfo
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
CreateDIBSection
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
SetViewportExtEx
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
SetPixel
Rectangle
EnumFontFamiliesExW
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
CreatePen
SetPaletteEntries
GetTextFaceW
SetPixelV
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
SelectPalette
CreateCompatibleDC
CreateBitmap
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetTextColor
GetBkColor
GetStockObject
CreateDCW
CopyMetaFileW
ExtFloodFill
GetObjectType
GetDeviceCaps
GetObjectW
SetBkColor
SetTextColor
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
StretchBlt
CreateRoundRectRgn
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
DeleteObject
SetLayout
GetLayout
SetTextAlign
MoveToEx
ScaleViewportExtEx

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

InitiateSystemShutdownA
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptReleaseContext
CryptDestroyHash
GetTokenInformation
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
OpenProcessToken
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
ConvertSidToStringSidW
EqualSid
FreeSid
AllocateAndInitializeSid

shell32

DragQueryFileW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
ShellExecuteExW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHAppBarMessage
SHGetSpecialFolderLocation
DragFinish
SHGetDesktopFolder
SHGetFileInfoW

comctl32

ord17
ImageList_GetIconSize

shlwapi

SHDeleteKeyW
UrlIsW
UrlUnescapeW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW

ole32

CoCreateInstance
CoInitializeEx
CoCreateGuid
StringFromGUID2
CoUninitialize
CoTaskMemFree
CreateStreamOnHGlobal
CLSIDFromProgID
CLSIDFromString
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
CoGetClassObject
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoInitialize
StgOpenStorageOnILockBytes

oleaut32

SafeArrayCreate
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
OleCreateFontIndirect
LoadRegTypeLi
DispCallFunc
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
VariantCopy
VariantClear
SysAllocStringLen
SysStringLen
SysFreeString
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
VariantInit
SysAllocString

oledlg

OleUIBusyW

gdiplus

GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipDrawImageI
GdipCreateBitmapFromScan0
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipDeleteFont
GdipCreateBitmapFromStream
GdipDrawString
GdipSetStringFormatFlags
GdipBitmapLockBits
GdipCreateStringFormat
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromHICON
GdipDrawImageRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipDeleteStringFormat
GdipCreateFont
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageWidth
GdipGetImageHeight
GdipImageRotateFlip
GdipGetGenericFontFamilySansSerif

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

crypt32

CertGetNameStringW

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 528KB - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 298KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64.cab
.cab

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

16:e5:a7:75:12:03:00:fb:34:19:45:8b:40:d4:08:34Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

03:d1:cb:38:61:d9:6b:fe:83:ac:5e:dd:c2:c3:b1:5a:d5:de:de:e6Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 580KB

.rsrc Size: 18KB - Virtual size: 17KB

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

cea869a7343193d9494104ee1907a749

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

psapi

Exports

Exports

Sections

.text Size: 273KB - Virtual size: 272KB

.rdata Size: 79KB - Virtual size: 79KB

.data Size: 28KB - Virtual size: 36KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 38KB - Virtual size: 37KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 21KB - Virtual size: 40KB

.rdata Size: 4KB - Virtual size: 16KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

16:e5:a7:75:12:03:00:fb:34:19:45:8b:40:d4:08:34
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

03:d1:cb:38:61:d9:6b:fe:83:ac:5e:dd:c2:c3:b1:5a:d5:de:de:e6
Signer

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 580KB

.rsrc
Size: 18KB - Virtual size: 17KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 273KB - Virtual size: 272KB

.rdata
Size: 79KB - Virtual size: 79KB

.data
Size: 28KB - Virtual size: 36KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 38KB - Virtual size: 37KB

.text
Size: 21KB - Virtual size: 40KB

.rdata
Size: 4KB - Virtual size: 16KB

.data
Size: 1024B - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 8KB

.pklav
Size: 5KB - Virtual size: 8KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

16:e5:a7:75:12:03:00:fb:34:19:45:8b:40:d4:08:34
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

2c:3e:7a:ef:69:a2:14:3c:40:f0:a3:5a:03:39:01:39:93:c2:77:da
Signer

.text
Size: 292KB - Virtual size: 290KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 21KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

16:e5:a7:75:12:03:00:fb:34:19:45:8b:40:d4:08:34
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

6b:d6:a8:55:0b:83:8b:1f:72:96:88:a5:c5:2c:3a:69:f9:72:3d:7d
Signer

.text
Size: 412KB - Virtual size: 410KB

.rdata
Size: 44KB - Virtual size: 41KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB

.text
Size: 125KB - Virtual size: 308KB

.rdata
Size: 17KB - Virtual size: 52KB