General

Malware Config

Signatures

Files

• Aurora X [by GodsExploits].zip

  .zip

  Password: CfxUIhNRyzgjcUeF

• AuroraV2.1.rar

  .rar

  Password: CfxUIhNRyzgjcUeF

• Aurora/Aurora.exe

  .exe windows:6 windows x86 arch:x86

  Password: CfxUIhNRyzgjcUeF

  9ab9a81e69cf807eb00009b3ff30d4ca

  
  

  Code Sign

  0b:52:66:11:34:d0:1e:61:3c:34:04:03:3a:87:b7:7d

  Certificate

  Issuer

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2021 00:00

  Not After

  07-03-2024 23:59

  Subject

  SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  18-04-2012 12:00

  Not After

  18-04-2027 12:00

  Subject

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0b:52:66:11:34:d0:1e:61:3c:34:04:03:3a:87:b7:7d

  Certificate

  Issuer

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2021 00:00

  Not After

  07-03-2024 23:59

  Subject

  SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  18-04-2012 12:00

  Not After

  18-04-2027 12:00

  Subject

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  a7:19:b0:6c:ff:80:47:3b:43:02:d8:ab:e0:bd:c0:31:6d:5e:fb:55:06:13:f0:7b:c4:02:37:ab:d6:8e:e7:ec

  Signer

  Actual PE Digest

  a7:19:b0:6c:ff:80:47:3b:43:02:d8:ab:e0:bd:c0:31:6d:5e:fb:55:06:13:f0:7b:c4:02:37:ab:d6:8e:e7:ec

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  02:8f:c1:54:25:90:d5:ca:f5:f6:af:dc:6b:09:9d:79:4a:e8:60:56

  Signer

  Actual PE Digest

  02:8f:c1:54:25:90:d5:ca:f5:f6:af:dc:6b:09:9d:79:4a:e8:60:56

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  Z:\7zsfxmm-9661f20d755d8bb8ca5ead4af3460d5185a17678\Output\Win32\7ZSfxMod.pdb

  Imports

  comctl32

  ord17

  kernel32

  SetLastError

  Sleep

  CreateThread

  GetExitCodeThread

  GetLocalTime

  SystemTimeToFileTime

  GetEnvironmentVariableW

  ExpandEnvironmentStringsW

  SetCurrentDirectoryW

  GetCurrentDirectoryW

  CompareFileTime

  CreateDirectoryW

  DeleteFileW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetFileAttributesW

  RemoveDirectoryW

  GetTempPathW

  GetSystemTimeAsFileTime

  lstrcmpW

  lstrcmpiW

  lstrlenA

  MultiByteToWideChar

  WideCharToMultiByte

  GetLocaleInfoW

  GetSystemDefaultUILanguage

  GetUserDefaultUILanguage

  GetSystemDefaultLCID

  GetCommandLineW

  SetEnvironmentVariableW

  CreateFileW

  GetDriveTypeW

  WriteFile

  GetTickCount

  GetModuleFileNameW

  GetModuleHandleW

  LoadLibraryA

  BeginUpdateResourceW

  UpdateResourceW

  EndUpdateResourceW

  GetCurrentThreadId

  TerminateThread

  SuspendThread

  ResumeThread

  GetSystemDirectoryW

  GetProcAddress

  LockResource

  LocalFree

  MulDiv

  FormatMessageW

  lstrcpyW

  FindResourceA

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  VirtualAlloc

  VirtualFree

  GetFileSize

  ReadFile

  SetEndOfFile

  SetFilePointer

  SetFileTime

  GetFileInformationByHandle

  WaitForMultipleObjects

  InitializeCriticalSection

  SetEvent

  ResetEvent

  CreateEventW

  RtlUnwind

  RaiseException

  EncodePointer

  VirtualQuery

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  LoadLibraryExW

  GetCurrentProcess

  InitializeSListHead

  GetCurrentProcessId

  QueryPerformanceCounter

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  IsProcessorFeaturePresent

  SetFileAttributesW

  WaitForSingleObject

  GetLastError

  CloseHandle

  lstrlenW

  LoadResource

  TerminateProcess

  user32

  ReleaseDC

  GetClientRect

  MessageBeep

  ClientToScreen

  PtInRect

  GetWindowLongW

  SetWindowLongW

  GetWindow

  SetWindowsHookExW

  UnhookWindowsHookEx

  CallNextHookEx

  GetWindowDC

  SetTimer

  DrawIconEx

  SystemParametersInfoW

  CallWindowProcW

  DefWindowProcW

  wvsprintfW

  MessageBoxA

  GetKeyState

  GetParent

  ScreenToClient

  GetDC

  DrawTextW

  EnableMenuItem

  GetSystemMenu

  GetSystemMetrics

  EnableWindow

  LoadIconW

  KillTimer

  SendMessageW

  EndDialog

  wsprintfW

  GetDlgItem

  DialogBoxIndirectParamW

  SetWindowPos

  ShowWindow

  LoadImageW

  IsWindow

  CharUpperW

  SetWindowTextW

  GetWindowTextW

  GetWindowTextLengthW

  GetWindowRect

  SetFocus

  gdi32

  DeleteObject

  GetDeviceCaps

  SelectObject

  GetObjectW

  CreateFontIndirectW

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetMalloc

  ShellExecuteW

  SHGetSpecialFolderPathW

  ShellExecuteExW

  SHGetFileInfoW

  ole32

  CoCreateInstance

  CoInitializeEx

  oleaut32

  SysAllocStringLen

  VariantClear

  api-ms-win-crt-convert-l1-1-0

  _wtol

  api-ms-win-crt-string-l1-1-0

  wcsncmp

  strcpy_s

  _wcsnicmp

  wcsncpy

  strncpy

  wcscmp

  api-ms-win-crt-runtime-l1-1-0

  abort

  _configure_narrow_argv

  _initialize_narrow_environment

  _beginthreadex

  _register_onexit_function

  _crt_atexit

  _controlfp_s

  _cexit

  _seh_filter_exe

  _set_app_type

  terminate

  _get_initial_narrow_environment

  _initterm

  _initterm_e

  exit

  _exit

  __p___argc

  __p___argv

  _c_exit

  _register_thread_local_exe_atexit_callback

  _initialize_onexit_table

  _set_new_handler

  api-ms-win-crt-heap-l1-1-0

  _set_new_mode

  malloc

  _callnewh

  calloc

  free

  api-ms-win-crt-stdio-l1-1-0

  _set_fmode

  __p__commode

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  Sections

  .text

  Size: 186KB - Virtual size: 185KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 25KB - Virtual size: 25KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Aurora/scripts/scripts.dll

  .dll regsvr32 windows:5 windows x86 arch:x86

  Password: CfxUIhNRyzgjcUeF

  a9fd3e7f71a802c8eee0a502f46de991

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  04-03-2014 00:00

  Not After

  03-03-2024 23:59

  Subject

  CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:a1:e8:9e:15:ea:4f:fa:93:79:84:d8:8f:54:5f:ba

  Certificate

  Issuer

  CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  14-05-2015 00:00

  Not After

  07-05-2017 23:59

  Subject

  SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Flash Player,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  58:87:9f:24:25:99:c5:8a:6a:3d:a1:73:d2:9f:04:d8:cb:0a:4b:54

  Signer

  Actual PE Digest

  58:87:9f:24:25:99:c5:8a:6a:3d:a1:73:d2:9f:04:d8:cb:0a:4b:54

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  Flash.pdb

  Imports

  version

  VerQueryValueW

  GetFileVersionInfoW

  VerQueryValueA

  GetFileVersionInfoA

  GetFileVersionInfoSizeA

  GetFileVersionInfoSizeW

  winmm

  mixerGetID

  waveInGetDevCapsA

  waveOutGetDevCapsA

  waveOutMessage

  waveOutGetDevCapsW

  waveInGetDevCapsW

  waveOutGetNumDevs

  waveInGetNumDevs

  waveInStart

  waveInAddBuffer

  waveInStop

  waveInMessage

  waveInUnprepareHeader

  waveInReset

  waveInPrepareHeader

  waveInOpen

  timeKillEvent

  timeGetTime

  timeSetEvent

  timeEndPeriod

  timeBeginPeriod

  timeGetDevCaps

  waveOutWrite

  waveOutPrepareHeader

  waveOutUnprepareHeader

  waveOutReset

  waveOutClose

  waveOutOpen

  waveOutGetPosition

  mixerClose

  mixerGetLineControlsA

  mixerGetLineInfoA

  mixerGetDevCapsA

  mixerOpen

  mixerGetControlDetailsA

  waveOutRestart

  waveOutPause

  mixerSetControlDetails

  waveInClose

  waveInGetPosition

  wininet

  InternetSetCookieW

  InternetGetCookieW

  crypt32

  CertFindCertificateInStore

  CertVerifySubjectCertificateContext

  CertCreateCertificateContext

  CryptGetMessageCertificates

  CryptVerifyMessageSignature

  CertAddStoreToCollection

  CertOpenStore

  CertVerifyRevocation

  CertFreeCertificateContext

  CertCompareCertificate

  CertEnumCertificatesInStore

  CertAddCertificateContextToStore

  CertCompareCertificateName

  CryptFindOIDInfo

  CertRDNValueToStrW

  CertFindRDNAttr

  CryptDecodeObjectEx

  CertNameToStrW

  CertCloseStore

  CertVerifyTimeValidity

  oleaut32

  SysAllocString

  VariantClear

  VariantInit

  SysStringByteLen

  SysStringLen

  SysAllocStringLen

  SysFreeString

  RegisterTypeLi

  VarUI4FromStr

  LoadRegTypeLi

  LoadTypeLi

  VarBstrCat

  SysAllocStringByteLen

  SafeArrayUnlock

  SafeArrayLock

  SafeArrayCreateVector

  SafeArrayUnaccessData

  SafeArrayDestroy

  SafeArrayAccessData

  VariantChangeType

  OleCreatePropertyFrame

  UnRegisterTypeLi

  dsound

  ord1

  ord8

  msimg32

  AlphaBlend

  kernel32

  GetTickCount

  LCMapStringW

  CreateProcessA

  GetSystemDirectoryW

  GetSystemWow64DirectoryW

  FindClose

  FindNextFileW

  RemoveDirectoryW

  FindFirstFileW

  SystemTimeToFileTime

  GetSystemTime

  GetFileSizeEx

  CreateFileW

  CreateDirectoryW

  GetProcessTimes

  GetCurrentProcessId

  GlobalSize

  GetSystemDirectoryA

  GetTempFileNameW

  GetSystemInfo

  GetUserDefaultUILanguage

  MoveFileExW

  VirtualQuery

  GetUserDefaultLangID

  DeleteFileA

  CreateFileA

  WriteFile

  SetFilePointer

  VerifyVersionInfoW

  VerSetConditionMask

  ReadFile

  GetFileSize

  CreateThread

  LockResource

  FindResourceExA

  FindResourceExW

  SetUnhandledExceptionFilter

  GetTempPathW

  GetTimeZoneInformation

  ReleaseSemaphore

  CreateSemaphoreW

  DeviceIoControl

  GetFileAttributesExW

  ExpandEnvironmentStringsA

  GetLongPathNameW

  GetTempFileNameA

  GetTempPathA

  CreateDirectoryA

  FindResourceW

  SetFilePointerEx

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  GetFullPathNameW

  OutputDebugStringA

  GetFileInformationByHandle

  GetVolumeInformationW

  TryEnterCriticalSection

  UnmapViewOfFile

  ReleaseMutex

  MapViewOfFile

  CreateFileMappingA

  GetExitCodeThread

  DuplicateHandle

  TerminateThread

  CreateWaitableTimerW

  SetThreadPriority

  CompareFileTime

  QueryPerformanceCounter

  QueryPerformanceFrequency

  QueueUserAPC

  OpenThread

  SleepEx

  SwitchToThread

  SetEndOfFile

  FlushFileBuffers

  GlobalMemoryStatusEx

  IsDebuggerPresent

  SetSystemTime

  FileTimeToSystemTime

  TlsAlloc

  TlsFree

  ResumeThread

  CreateTimerQueueTimer

  DeleteTimerQueueTimer

  CreateSemaphoreA

  HeapAlloc

  HeapFree

  HeapUnlock

  HeapWalk

  HeapLock

  HeapCreate

  HeapDestroy

  VirtualProtect

  GetNumberFormatW

  GetCurrencyFormatW

  CompareStringW

  GetDateFormatW

  GetTimeFormatW

  GetUserDefaultLCID

  IsValidLocale

  EnumSystemLocalesW

  GetProcessHeap

  GetProcessAffinityMask

  IsProcessorFeaturePresent

  ExitProcess

  UnhandledExceptionFilter

  RtlUnwind

  GetCommandLineA

  ExitThread

  HeapReAlloc

  GetLocaleInfoW

  GetSystemTimeAsFileTime

  GetStdHandle

  SetConsoleCtrlHandler

  InitializeCriticalSectionAndSpinCount

  GetOEMCP

  IsValidCodePage

  SetHandleCount

  GetFileType

  GetStartupInfoA

  LCMapStringA

  GetConsoleCP

  GetConsoleMode

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetStdHandle

  GetStringTypeA

  GetStringTypeW

  EnumSystemLocalesA

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  CompareStringA

  SetEnvironmentVariableA

  GetNativeSystemInfo

  lstrcpynW

  GlobalMemoryStatus

  FlushConsoleInputBuffer

  LoadResource

  SizeofResource

  DisableThreadLibraryCalls

  SetLastError

  OutputDebugStringW

  GetCurrentThreadId

  GetModuleFileNameW

  GetVersionExA

  GetModuleFileNameA

  GetFileAttributesA

  SetFileAttributesA

  LocalAlloc

  LocalFree

  GlobalLock

  GlobalUnlock

  MulDiv

  GetCurrentProcess

  FlushInstructionCache

  lstrcmpiW

  CreateMutexW

  LoadLibraryW

  LoadLibraryA

  GetProcAddress

  WaitForMultipleObjects

  FreeLibrary

  WaitForSingleObject

  ResetEvent

  CloseHandle

  CreateEventW

  SetEvent

  GetModuleHandleW

  GlobalAlloc

  GetLastError

  GetVersionExW

  GetLocaleInfoA

  lstrlenW

  lstrlenA

  WideCharToMultiByte

  GlobalFree

  InterlockedDecrement

  InterlockedIncrement

  DeleteFileW

  GetFileAttributesW

  GetCurrentThread

  SetThreadAffinityMask

  TlsSetValue

  IsDBCSLeadByte

  GetACP

  GetCPInfo

  MultiByteToWideChar

  RaiseException

  HeapSize

  DebugBreak

  ExpandEnvironmentStringsW

  InterlockedExchange

  InterlockedCompareExchange

  Sleep

  LeaveCriticalSection

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  TlsGetValue

  SetConsoleMode

  ReadConsoleInputA

  GetModuleHandleA

  CreateEventA

  CreateWaitableTimerA

  SetWaitableTimer

  CancelWaitableTimer

  InterlockedExchangeAdd

  GetVersion

  VirtualAlloc

  VirtualFree

  CopyFileW

  TerminateProcess

  LoadLibraryExW

  CreateMutexA

  user32

  RegisterClipboardFormatW

  GetWindowThreadProcessId

  RemoveMenu

  SetMenuItemInfoW

  GetMenuItemInfoW

  InsertMenuItemW

  CreatePopupMenu

  TrackPopupMenu

  DestroyMenu

  DrawMenuBar

  CreateMenu

  SetMenuInfo

  CharUpperW

  CharLowerW

  PostThreadMessageW

  GetMessageW

  CloseWindow

  WaitForInputIdle

  TranslateMessage

  DispatchMessageW

  SetWindowTextA

  RedrawWindow

  DialogBoxIndirectParamW

  SetWindowTextW

  SendMessageTimeoutW

  CreateIconIndirect

  GetMonitorInfoW

  SetRectEmpty

  GetCursor

  DestroyIcon

  LoadImageW

  GetPropW

  SetPropW

  GetSystemMetrics

  InflateRect

  GetClipboardFormatNameA

  RegisterClipboardFormatA

  IsWindow

  PtInRect

  EqualRect

  SetWindowRgn

  BeginPaint

  EndPaint

  GetSubMenu

  MapVirtualKeyW

  LoadStringW

  IntersectRect

  CloseClipboard

  GetClipboardData

  OpenClipboard

  IsClipboardFormatAvailable

  SetClipboardData

  EmptyClipboard

  EnumDisplayDevicesW

  DestroyCaret

  ShowCaret

  CreateCaret

  SetCaretPos

  MoveWindow

  GetActiveWindow

  UnregisterClassA

  LoadIconA

  DeleteMenu

  RegisterClassExA

  CreateWindowExA

  ReleaseCapture

  UpdateWindow

  SystemParametersInfoW

  GetMessageTime

  LoadIconW

  RegisterClassW

  IsWindowVisible

  DialogBoxParamW

  GetDlgItem

  EndDialog

  SetWindowPos

  GetKeyState

  LoadStringA

  MessageBoxA

  SendMessageW

  GetQueueStatus

  SetTimer

  GetCapture

  SetCursor

  GetCursorPos

  WindowFromPoint

  ScreenToClient

  GetClientRect

  SetCapture

  MessageBoxW

  KillTimer

  PeekMessageW

  EnableMenuItem

  CheckMenuItem

  GetWindowInfo

  CopyRect

  PostQuitMessage

  ClientToScreen

  SendInput

  ActivateKeyboardLayout

  GetKeyboardLayout

  GetWindowRect

  UpdateLayeredWindow

  UnregisterClassW

  GetParent

  GetFocus

  IsChild

  SetFocus

  RegisterClassExW

  InvalidateRect

  DefWindowProcW

  UnionRect

  CallWindowProcW

  GetDC

  ReleaseDC

  LoadCursorW

  GetClassInfoExW

  GetWindowLongW

  SetWindowLongW

  CharNextW

  SetRect

  GetForegroundWindow

  GetDesktopWindow

  EnumDisplayDevicesA

  MonitorFromWindow

  FillRect

  OffsetRect

  FlashWindowEx

  GetSystemMenu

  IsZoomed

  GetWindowPlacement

  SetWindowPlacement

  ShowWindowAsync

  IsIconic

  EnumDisplaySettingsW

  MapWindowPoints

  GetWindowTextLengthW

  CreateWindowExW

  ShowWindow

  DestroyWindow

  GetDoubleClickTime

  EnumWindows

  PostMessageW

  IsWindowEnabled

  GetWindow

  GetClassNameA

  GetWindowTextW

  GetWindowTextA

  DefWindowProcA

  GetWindowLongA

  LoadCursorA

  SetWindowLongA

  PostMessageA

  RegisterWindowMessageA

  EnumDisplayMonitors

  MonitorFromRect

  GetMonitorInfoA

  wsprintfW

  GetUserObjectInformationW

  GetProcessWindowStation

  SetCursorPos

  gdi32

  GetDeviceCaps

  CreateDIBSection

  SelectObject

  GetStockObject

  GetObjectW

  DeleteObject

  GdiFlush

  DeleteDC

  CreateMetaFileW

  GetClipBox

  SetViewportOrgEx

  LPtoDP

  CreateRectRgnIndirect

  GetObjectType

  GetICMProfileA

  CreateDCA

  SetPixel

  TextOutW

  SetTextAlign

  DeleteMetaFile

  CreateBitmap

  CreateFontIndirectW

  GetTextExtentPoint32A

  ExtTextOutA

  GetTextExtentPoint32W

  GetTextMetricsW

  SetTextColor

  CreateFontIndirectA

  IntersectClipRect

  GetClipRgn

  CreateRectRgn

  SetBkMode

  SelectClipRgn

  SetTextCharacterExtra

  GetTextAlign

  GetBkMode

  GetTextColor

  GetCurrentObject

  GetBkColor

  EnumFontFamiliesA

  CreatePen

  DPtoLP

  GetTextCharacterExtra

  SetWorldTransform

  SetGraphicsMode

  GetWorldTransform

  StartDocW

  EndDoc

  StrokePath

  ExtCreatePen

  FillPath

  StartPage

  EndPage

  BeginPath

  EndPath

  SetPolyFillMode

  PolyBezierTo

  SelectClipPath

  CloseMetaFile

  RestoreDC

  SetWindowExtEx

  SetWindowOrgEx

  SaveDC

  GdiAlphaBlend

  StretchBlt

  BitBlt

  SetStretchBltMode

  CreateCompatibleBitmap

  ExtTextOutW

  SetBkColor

  GetStretchBltMode

  EnumFontFamiliesW

  CreateSolidBrush

  GetFontData

  EnumFontFamiliesExW

  LineTo

  MoveToEx

  Rectangle

  StretchDIBits

  CreateCompatibleDC

  RectVisible

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  CommDlgExtendedError

  PrintDlgW

  advapi32

  CryptDecrypt

  CryptSetKeyParam

  CryptGetHashParam

  CryptHashData

  CryptDestroyHash

  CryptAcquireContextA

  CryptCreateHash

  CryptAcquireContextW

  CryptGenRandom

  CryptReleaseContext

  RegisterEventSourceA

  ReportEventA

  DeregisterEventSource

  OpenProcessToken

  GetTokenInformation

  IsValidSid

  GetSidSubAuthorityCount

  GetSidSubAuthority

  CryptImportKey

  CryptGenKey

  CryptDestroyKey

  CryptExportKey

  CryptEncrypt

  RegOpenKeyA

  RegQueryValueExW

  RegCreateKeyA

  RegEnumKeyExW

  RegCreateKeyExA

  RegSetValueExA

  RegQueryInfoKeyW

  RegSetValueExW

  RegOpenKeyExW

  RegCreateKeyExW

  RegDeleteValueW

  RegDeleteKeyW

  RegOpenKeyExA

  RegQueryValueExA

  RegCloseKey

  shell32

  SHGetFolderLocation

  SHGetFolderPathW

  ShellExecuteW

  SHGetSpecialFolderPathW

  SHFileOperationW

  SHGetFolderPathA

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHAppBarMessage

  SHGetSettings

  SHGetDiskFreeSpaceExW

  ord165

  ole32

  CoTaskMemRealloc

  CreateOleAdviseHolder

  OleRegEnumVerbs

  OleRegGetUserType

  OleRegGetMiscStatus

  CreateDataAdviseHolder

  StringFromGUID2

  WriteClassStm

  OleSaveToStream

  ReadClassStm

  MkParseDisplayName

  PropVariantClear

  OleFlushClipboard

  OleIsCurrentClipboard

  OleSetClipboard

  OleGetClipboard

  OleUninitialize

  OleInitialize

  CoInitializeEx

  CoRegisterMessageFilter

  CoSetProxyBlanket

  CoTaskMemFree

  CoFreeUnusedLibraries

  CoInitialize

  CreateBindCtx

  CoTaskMemAlloc

  ReleaseStgMedium

  CoCreateInstance

  CoUninitialize

  ws2_32

  socket

  WSAIoctl

  WSAGetLastError

  WSAAsyncSelect

  closesocket

  WSACleanup

  WSASocketA

  ntohl

  gethostname

  WSASocketW

  select

  __WSAFDIsSet

  connect

  ioctlsocket

  WSAEnumNetworkEvents

  WSAEventSelect

  WSACreateEvent

  WSAAddressToStringA

  bind

  sendto

  recvfrom

  WSASetLastError

  getservbyport

  gethostbyaddr

  getservbyname

  htonl

  inet_ntoa

  gethostbyname

  inet_addr

  WSACloseEvent

  htons

  getsockname

  ntohs

  send

  WSAStartup

  setsockopt

  recv

  shlwapi

  UrlCanonicalizeW

  ord158

  PathFindFileNameW

  StrRStrIW

  StrStrIW

  AssocQueryStringW

  urlmon

  HlinkSimpleNavigateToMoniker

  RegisterBindStatusCallback

  CreateURLMoniker

  CopyStgMedium

  mscms

  DeleteColorTransform

  CloseColorProfile

  CreateColorTransformW

  OpenColorProfileW

  TranslateBitmapBits

  iphlpapi

  GetAdaptersAddresses

  psapi

  GetProcessMemoryInfo

  Exports

  Exports

  AdobeCPGetAPI

  DllCanUnloadNow

  DllGetClassObject

  DllRegisterServer

  DllUnregisterServer

  IAEModule_AEModule_PutKernel

  IAEModule_IAEKernel_LoadModule

  IAEModule_IAEKernel_UnloadModule

  Sections

  .text

  Size: 13.1MB - Virtual size: 13.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rodata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 3.6MB - Virtual size: 3.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 836KB - Virtual size: 1.8MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 583KB - Virtual size: 582KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 700KB - Virtual size: 699KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• README.txt