General

Malware Config

Signatures

Files

• 08333e61156e2ccfd7843a924fb671862fc226c89bf98f20ab95ea6125130ef7

  .exe windows:5 windows x86 arch:x86

  32f3282581436269b3a75b6675fe3e08

  
  

  Code Sign

  46:d0:d6:10:64:80:69:b6:0b:c9:b0:15:87:b1:a3:d5

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-02-2020 00:00

  Not After

  06-03-2023 23:59

  Subject

  CN=Restoro Ltd,O=Restoro Ltd,L=Douglas,C=IM

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  46:d0:d6:10:64:80:69:b6:0b:c9:b0:15:87:b1:a3:d5

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-02-2020 00:00

  Not After

  06-03-2023 23:59

  Subject

  CN=Restoro Ltd,O=Restoro Ltd,L=Douglas,C=IM

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  20:bf:0c:e9:d2:ab:8e:91:35:6f:ea:bb:76:bd:f7:f7:8c:29:8f:80:19:1c:60:3c:ad:4c:7d:9a:2b:a4:8b:b2

  Signer

  Actual PE Digest

  20:bf:0c:e9:d2:ab:8e:91:35:6f:ea:bb:76:bd:f7:f7:8c:29:8f:80:19:1c:60:3c:ad:4c:7d:9a:2b:a4:8b:b2

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  70:29:a4:2b:3c:49:f5:4f:48:cf:41:71:77:c8:37:b3:d3:54:d1:b9

  Signer

  Actual PE Digest

  70:29:a4:2b:3c:49:f5:4f:48:cf:41:71:77:c8:37:b3:d3:54:d1:b9

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  CreateFileW

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  CloseHandle

  lstrlenW

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpA

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  lstrlenA

  MulDiv

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrcpynA

  user32

  GetAsyncKeyState

  IsDlgButtonChecked

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  wvsprintfW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  FindWindowExW

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 415KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 3.6MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 304KB - Virtual size: 303KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/AccessControl.dll

  .dll windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Exports

  Exports

  ClearOnFile

  ClearOnRegKey

  DenyOnFile

  DenyOnRegKey

  DisableFileInheritance

  DisableRegKeyInheritance

  EnableFileInheritance

  EnableRegKeyInheritance

  GetCurrentUserName

  GetFileGroup

  GetFileOwner

  GetRegKeyGroup

  GetRegKeyOwner

  GrantOnFile

  GrantOnRegKey

  NameToSid

  RevokeOnFile

  RevokeOnRegKey

  SetFileGroup

  SetFileOwner

  SetOnFile

  SetOnRegKey

  SetRegKeyGroup

  SetRegKeyOwner

  SidToName

  Sections

  UPX0

  Size: - Virtual size: 28KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 5KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• out.upx

  .dll windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Sections

  .text

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 348B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 888B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 996B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/Banner.dll

  .dll windows:5 windows x86 arch:x86

  beba03bbad1f8d79d5b3c1359e913e0d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  lstrcmpW

  GetModuleHandleW

  CloseHandle

  Sleep

  CreateThread

  GetCurrentThreadId

  GlobalFree

  lstrcpyW

  lstrcpynW

  GlobalAlloc

  user32

  DestroyWindow

  SetWindowLongW

  GetWindowLongW

  SetWindowTextW

  SetDlgItemTextW

  DispatchMessageW

  PeekMessageW

  WaitMessage

  IsWindow

  CreateDialogParamW

  ShowWindow

  AttachThreadInput

  IsWindowVisible

  wsprintfW

  PostMessageW

  Exports

  Exports

  destroy

  getWindow

  show

  Sections

  .text

  Size: 1024B - Virtual size: 873B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 824B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 272B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/ButtonEvent.dll

  .dll windows:5 windows x86 arch:x86

  59070d80178eb0db7b7113b7a8608502

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalFree

  lstrcmpiW

  GlobalAlloc

  lstrcpyW

  lstrcpynW

  user32

  CallWindowProcW

  GetDlgItem

  FindWindowExW

  SetWindowLongW

  wsprintfW

  PostMessageW

  Exports

  Exports

  AddEventHandler

  UnsetEventHandler

  WhichButtonId

  Sections

  .text

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 534B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 108B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 912B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 306B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/ExecDos.dll

  .dll windows:5 windows x86 arch:x86

  a5d239ed12c9442d63c73cb9ff7cad0e

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalFree

  Sleep

  lstrcatW

  lstrcmpiW

  TerminateProcess

  ReadFile

  GetExitCodeProcess

  PeekNamedPipe

  CreateFileW

  FlushFileBuffers

  WriteFile

  lstrlenW

  CloseHandle

  CreateProcessW

  DuplicateHandle

  GetCurrentProcess

  CreatePipe

  GetProcAddress

  GetModuleHandleW

  GlobalAlloc

  GetExitCodeThread

  WaitForSingleObject

  CreateThread

  lstrcpyW

  lstrcpynW

  user32

  wsprintfW

  GetClassNameW

  GetDlgItem

  FindWindowExW

  SendMessageW

  Exports

  Exports

  exec

  isdone

  wait

  Sections

  .text

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 20B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 334B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/IpConfig.dll

  .dll windows:5 windows x86 arch:x86

  3f0fda09180f619ca116344bede41608

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Unicode\Plugins\IpConfig.pdb

  Imports

  kernel32

  InterlockedIncrement

  InterlockedDecrement

  GlobalAlloc

  lstrcpynW

  GlobalFree

  lstrcpyW

  FlushFileBuffers

  CloseHandle

  CreateFileA

  WriteConsoleW

  GetConsoleOutputCP

  WriteConsoleA

  SetStdHandle

  GetLocaleInfoA

  HeapFree

  GetProcessHeap

  GetLastError

  GetCurrentThreadId

  GetCommandLineA

  RaiseException

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  GetModuleHandleW

  GetProcAddress

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  SetLastError

  Sleep

  HeapSize

  ExitProcess

  HeapAlloc

  SetHandleCount

  GetStdHandle

  GetFileType

  GetStartupInfoA

  DeleteCriticalSection

  GetModuleFileNameA

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  WideCharToMultiByte

  GetEnvironmentStringsW

  HeapCreate

  HeapDestroy

  VirtualFree

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  GetModuleHandleA

  RtlUnwind

  LeaveCriticalSection

  EnterCriticalSection

  VirtualAlloc

  HeapReAlloc

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  SetFilePointer

  WriteFile

  GetConsoleCP

  GetConsoleMode

  MultiByteToWideChar

  LoadLibraryA

  InitializeCriticalSectionAndSpinCount

  LCMapStringA

  LCMapStringW

  GetStringTypeA

  GetStringTypeW

  user32

  wsprintfW

  ole32

  CoSetProxyBlanket

  CoCreateInstance

  oleaut32

  SafeArrayGetUBound

  SysFreeString

  SafeArrayGetElement

  VariantInit

  SysAllocStringByteLen

  VariantCopy

  VariantClear

  SafeArrayGetLBound

  SysStringLen

  SysAllocString

  Exports

  Exports

  GetAllNetworkAdaptersIDs

  GetAllNetworkAdaptersIDsCB

  GetDNSSuffixSearchList

  GetEnabledNetworkAdaptersIDs

  GetEnabledNetworkAdaptersIDsCB

  GetHostName

  GetNetworkAdapterConnectionID

  GetNetworkAdapterConnectionSpecificDNSSuffix

  GetNetworkAdapterDHCPLeaseExpires

  GetNetworkAdapterDHCPLeaseObtained

  GetNetworkAdapterDHCPServer

  GetNetworkAdapterDNSServers

  GetNetworkAdapterDNSServersCB

  GetNetworkAdapterDefaultIPGateways

  GetNetworkAdapterDefaultIPGatewaysCB

  GetNetworkAdapterDescription

  GetNetworkAdapterIDFromDescription

  GetNetworkAdapterIDFromIPAddress

  GetNetworkAdapterIDFromMACAddress

  GetNetworkAdapterIPAddresses

  GetNetworkAdapterIPAddressesCB

  GetNetworkAdapterIPSubNets

  GetNetworkAdapterIPSubNetsCB

  GetNetworkAdapterMACAddress

  GetNetworkAdapterPrimaryWINSServer

  GetNetworkAdapterSecondaryWINSServer

  GetNetworkAdapterType

  GetNodeType

  GetPrimaryDNSSuffix

  IsIPRoutingEnabled

  IsNetworkAdapterAutoSense

  IsNetworkAdapterDHCPEnabled

  IsWINSProxyEnabled

  Sections

  .text

  Size: 83KB - Virtual size: 82KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 21KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 31KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 436B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/LogEx.dll

  .dll windows:4 windows x86 arch:x86

  549d7b44067bbcdf42bf6a90a80a3a9e

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  WriteFile

  CreateFileW

  CloseHandle

  GlobalFree

  GlobalAlloc

  VirtualFree

  ReadFile

  VirtualAlloc

  GetFileSize

  lstrcpyW

  WideCharToMultiByte

  MultiByteToWideChar

  GetCommandLineA

  GetVersion

  GetCurrentThreadId

  TlsSetValue

  TlsAlloc

  TlsFree

  SetLastError

  TlsGetValue

  GetLastError

  ExitProcess

  TerminateProcess

  GetCurrentProcess

  SetHandleCount

  GetStdHandle

  GetFileType

  GetStartupInfoA

  DeleteCriticalSection

  GetModuleFileNameA

  FreeEnvironmentStringsA

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  GetEnvironmentStringsW

  GetModuleHandleA

  GetEnvironmentVariableA

  GetVersionExA

  HeapDestroy

  HeapCreate

  HeapFree

  HeapAlloc

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  GetCPInfo

  GetACP

  GetOEMCP

  HeapReAlloc

  GetProcAddress

  LoadLibraryA

  RtlUnwind

  GetStringTypeA

  GetStringTypeW

  LCMapStringA

  LCMapStringW

  InterlockedDecrement

  InterlockedIncrement

  user32

  FindWindowExW

  GetDlgItem

  SendMessageW

  SetWindowTextW

  Exports

  Exports

  AddFile

  Close

  Init

  Write

  Sections

  .text

  Size: 20KB - Virtual size: 17KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/MSIBanner.dll

  .dll windows:4 windows x86 arch:x86

  f4c348b6c8d3828e735f17c40df0e134

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalLock

  GlobalAlloc

  Sleep

  CreateThread

  GetModuleHandleW

  RtlUnwind

  MultiByteToWideChar

  LCMapStringW

  LCMapStringA

  GetStringTypeW

  GetStringTypeA

  LoadLibraryA

  GetProcAddress

  GetOEMCP

  GetACP

  HeapReAlloc

  GlobalFree

  GlobalUnlock

  CloseHandle

  lstrcpyW

  WideCharToMultiByte

  InterlockedDecrement

  InterlockedIncrement

  GetLastError

  GetCommandLineA

  GetVersion

  InitializeCriticalSection

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  ExitProcess

  HeapAlloc

  TerminateProcess

  GetCurrentProcess

  GetCurrentThreadId

  TlsSetValue

  TlsAlloc

  TlsFree

  SetLastError

  TlsGetValue

  SetHandleCount

  GetStdHandle

  GetFileType

  GetStartupInfoA

  GetModuleFileNameA

  FreeEnvironmentStringsA

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  GetEnvironmentStringsW

  HeapDestroy

  HeapCreate

  VirtualFree

  HeapFree

  WriteFile

  GetCPInfo

  VirtualAlloc

  user32

  CreateWindowExW

  wsprintfW

  SetWindowTextW

  FindWindowExW

  SetForegroundWindow

  LoadIconW

  DialogBoxIndirectParamW

  IsChild

  PeekMessageW

  DispatchMessageW

  WaitMessage

  SendMessageW

  DestroyIcon

  DestroyWindow

  EndDialog

  gdi32

  GetStockObject

  comctl32

  InitCommonControlsEx

  Exports

  Exports

  Autor

  Destroy

  Move

  Pos

  Reset

  Show

  Update

  getHWND

  Sections

  .text

  Size: 20KB - Virtual size: 16KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/System.dll

  .dll windows:5 windows x86 arch:x86

  039bcbc605477e8e87ec550c2e60e748

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalAlloc

  GlobalFree

  GlobalSize

  GetLastError

  lstrcpyW

  lstrcpynW

  GetProcAddress

  WideCharToMultiByte

  lstrcatW

  lstrlenW

  lstrcmpiW

  LoadLibraryW

  GetModuleHandleW

  MultiByteToWideChar

  VirtualAlloc

  VirtualProtect

  FreeLibrary

  user32

  wsprintfW

  ole32

  CLSIDFromString

  StringFromGUID2

  Exports

  Exports

  Alloc

  Call

  Copy

  Free

  Get

  Int64Op

  Store

  StrAlloc

  Sections

  .text

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 963B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 64B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 1024B - Virtual size: 588B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/UserInfo.dll

  .dll windows:5 windows x86 arch:x86

  45d25ca52c312b2254c60dbcb30342d1

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GetVersion

  GetCurrentThread

  GetCurrentProcess

  GetModuleHandleW

  GetProcAddress

  GetLastError

  GlobalFree

  CloseHandle

  lstrcpynW

  GlobalAlloc

  advapi32

  OpenProcessToken

  GetTokenInformation

  AllocateAndInitializeSid

  EqualSid

  FreeSid

  GetUserNameW

  OpenThreadToken

  Exports

  Exports

  GetAccountType

  GetName

  GetOriginalAccountType

  Sections

  .text

  Size: 1024B - Virtual size: 686B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 753B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 48B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 240B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/WmiInspector.dll

  .dll windows:5 windows x86 arch:x86

  7f0e53ce204644197ed8a4abb8792a26

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  C:\REI_WS2\NsisPlugins\WmiInspector\Release\WmiInspector.pdb

  Imports

  kernel32

  InterlockedIncrement

  InterlockedDecrement

  GlobalFree

  lstrcpyW

  lstrcpynW

  GlobalAlloc

  WideCharToMultiByte

  MultiByteToWideChar

  FlushFileBuffers

  CloseHandle

  CreateFileW

  GetStringTypeW

  LCMapStringW

  WriteConsoleW

  SetStdHandle

  GetLastError

  lstrlenA

  LocalFree

  GetCurrentThreadId

  DecodePointer

  GetCommandLineA

  HeapFree

  HeapAlloc

  RtlUnwind

  EncodePointer

  RaiseException

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetModuleHandleW

  SetLastError

  GetProcAddress

  Sleep

  ExitProcess

  SetHandleCount

  GetStdHandle

  InitializeCriticalSectionAndSpinCount

  GetFileType

  GetStartupInfoW

  DeleteCriticalSection

  GetModuleFileNameA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  HeapCreate

  HeapDestroy

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  WriteFile

  GetModuleFileNameW

  HeapSize

  IsProcessorFeaturePresent

  SetFilePointer

  GetConsoleCP

  GetConsoleMode

  EnterCriticalSection

  LeaveCriticalSection

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  HeapReAlloc

  LoadLibraryW

  ole32

  CoSetProxyBlanket

  CoCreateInstance

  oleaut32

  SysFreeString

  VariantInit

  SysAllocStringByteLen

  VariantClear

  SysStringLen

  SysAllocString

  Exports

  Exports

  Request

  Sections

  .text

  Size: 53KB - Virtual size: 52KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 13KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 436B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/inetc.dll

  .dll windows:4 windows x86 arch:x86

  86cdacc6fa5e3ff4938d358350751516

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  msvcrt

  wcstol

  _adjust_fdiv

  malloc

  _initterm

  free

  strlen

  strchr

  strrchr

  wcsrchr

  wcstoul

  wcsstr

  wcschr

  memset

  _chkesp

  kernel32

  DeleteFileW

  WideCharToMultiByte

  CreateFileA

  CreateThread

  WaitForSingleObject

  TerminateThread

  GetModuleHandleW

  MulDiv

  lstrcpyW

  GlobalAlloc

  LoadLibraryW

  GetProcAddress

  lstrcmpiW

  CreateFileW

  lstrlenW

  WriteFile

  ReadFile

  lstrcmpW

  lstrcpynW

  GetLastError

  GetFileSize

  GlobalFree

  CloseHandle

  SleepEx

  SetFilePointer

  GetTickCount

  lstrcatW

  user32

  MessageBoxW

  GetParent

  ShowWindow

  SetWindowLongW

  IsWindow

  SetWindowTextW

  SendDlgItemMessageW

  GetDlgItem

  PostMessageW

  GetWindowTextW

  SendMessageW

  SetDlgItemTextW

  SetWindowPos

  SystemParametersInfoW

  GetClientRect

  GetWindowRect

  SetTimer

  LoadIconW

  DestroyWindow

  KillTimer

  UpdateWindow

  RedrawWindow

  DispatchMessageW

  TranslateMessage

  IsDialogMessageW

  GetMessageW

  IsWindowVisible

  EnableWindow

  CreateDialogParamW

  FindWindowExW

  wsprintfA

  wsprintfW

  GetWindowLongW

  wininet

  HttpSendRequestW

  HttpSendRequestExW

  HttpQueryInfoW

  FtpCreateDirectoryW

  FtpOpenFileW

  InternetGetLastResponseInfoW

  InternetSetFilePointer

  InternetSetOptionW

  InternetQueryOptionW

  HttpAddRequestHeadersA

  InternetCloseHandle

  InternetErrorDlg

  HttpAddRequestHeadersW

  HttpOpenRequestW

  HttpEndRequestW

  InternetConnectW

  InternetCrackUrlW

  InternetOpenW

  InternetReadFile

  InternetWriteFile

  comctl32

  ord17

  Exports

  Exports

  get

  head

  post

  put

  Sections

  .text

  Size: 19KB - Virtual size: 18KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/installer-164x314.bmp
• $PLUGINSDIR/md5dll.dll

  .dll windows:4 windows x86 arch:x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Exports

  Exports

  GetFileMD5

  GetMD5

  GetMD5File

  GetMD5Random

  GetMD5String

  Sections

  UPX0

  Size: - Virtual size: 28KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 3KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• out.upx

  .dll windows:4 windows x86 arch:x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Sections

  .text

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 992B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 162B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/modern-header.bmp
• $PLUGINSDIR/nsDialogs.dll

  .dll windows:5 windows x86 arch:x86

  9ea5bdc8c90dfcffe309465c26c89758

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalAlloc

  MulDiv

  lstrlenW

  HeapFree

  GetProcessHeap

  lstrcmpiW

  HeapReAlloc

  lstrcpynW

  GetFileAttributesW

  lstrcpyW

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  HeapAlloc

  GlobalFree

  user32

  LoadCursorW

  RemovePropW

  DrawFocusRect

  GetPropW

  DrawTextW

  GetWindowTextW

  GetDlgItem

  SetWindowLongW

  SetWindowPos

  CreateDialogParamW

  MapWindowPoints

  GetWindowRect

  SetCursor

  CreateWindowExW

  IsWindow

  SetTimer

  KillTimer

  DispatchMessageW

  TranslateMessage

  GetMessageW

  IsDialogMessageW

  ShowWindow

  wsprintfW

  GetClientRect

  CharPrevW

  CallWindowProcW

  SetPropW

  DestroyWindow

  MapDialogRect

  CharNextW

  SendMessageW

  GetWindowLongW

  gdi32

  SetTextColor

  shell32

  SHGetPathFromIDListW

  SHBrowseForFolderW

  comdlg32

  GetSaveFileNameW

  CommDlgExtendedError

  GetOpenFileNameW

  ole32

  CoTaskMemFree

  Exports

  Exports

  Create

  CreateControl

  CreateItem

  CreateTimer

  GetUserData

  KillTimer

  OnBack

  OnChange

  OnClick

  OnNotify

  SelectFileDialog

  SelectFolderDialog

  SetRTL

  SetUserData

  Show

  Sections

  .text

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 48B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 152B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 590B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/nsExec.dll

  .dll windows:5 windows x86 arch:x86

  8700d0ebbb41c81ea52718af1ab70a93

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  lstrcpyW

  MultiByteToWideChar

  lstrlenA

  lstrcmpiW

  lstrlenW

  ExitProcess

  CloseHandle

  GetExitCodeProcess

  WaitForSingleObject

  CreateProcessW

  lstrcpynW

  GetCommandLineW

  Sleep

  TerminateProcess

  GlobalReAlloc

  GlobalUnlock

  GlobalSize

  ReadFile

  GetModuleHandleW

  GetTickCount

  GetStartupInfoW

  CreatePipe

  GetVersionExW

  GlobalLock

  DeleteFileW

  lstrcatW

  UnmapViewOfFile

  MapViewOfFile

  CreateFileMappingW

  CreateFileW

  CopyFileW

  GetTempFileNameW

  GlobalFree

  GlobalAlloc

  GetModuleFileNameW

  GetProcAddress

  PeekNamedPipe

  GetCurrentProcess

  user32

  CharPrevW

  CharNextW

  SendMessageW

  FindWindowExW

  wsprintfW

  advapi32

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  Exports

  Exports

  Exec

  ExecToLog

  ExecToStack

  Sections

  .text

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 454B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/rCrypt.dll

  .dll windows:5 windows x86 arch:x86

  1671686fd0e54187e7363776a72a11bf

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  SizeofResource

  LockResource

  LoadResource

  FindResourceW

  FindResourceExW

  MultiByteToWideChar

  WideCharToMultiByte

  GlobalAlloc

  GlobalFree

  lstrcpyW

  lstrcpynW

  GetLastError

  QueryPerformanceCounter

  InterlockedIncrement

  InterlockedDecrement

  Sleep

  InitializeCriticalSection

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  EncodePointer

  DecodePointer

  RaiseException

  InitializeCriticalSectionAndSpinCount

  HeapDestroy

  HeapAlloc

  HeapFree

  HeapReAlloc

  HeapSize

  GetProcessHeap

  CloseHandle

  CreateFileW

  RtlUnwind

  GetCurrentThreadId

  GetCommandLineA

  GetSystemTimeAsFileTime

  LCMapStringW

  GetCPInfo

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  TerminateProcess

  GetCurrentProcess

  WriteFile

  GetStdHandle

  GetModuleFileNameW

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetModuleHandleW

  SetLastError

  GetProcAddress

  ExitProcess

  SetHandleCount

  GetFileType

  GetStartupInfoW

  GetModuleFileNameA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  HeapCreate

  GetTickCount

  GetCurrentProcessId

  GetACP

  GetOEMCP

  IsValidCodePage

  GetStringTypeW

  SetFilePointer

  GetConsoleCP

  GetConsoleMode

  LoadLibraryW

  SetStdHandle

  WriteConsoleW

  ReadFile

  FlushFileBuffers

  user32

  wsprintfW

  Exports

  Exports

  ?myFunction@@YAXPAUHWND__@@HPA_WPAPAU_stack_t@@PAUextra_parameters@@ZZ

  Init

  dec

  dec_WithVar

  enc

  enc_WithVar

  Sections

  .text

  Size: 163KB - Virtual size: 163KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 56KB - Virtual size: 55KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 11KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 696B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 50KB - Virtual size: 50KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/registry.dll

  .dll windows:4 windows x86 arch:x86

  421a02aae559045e04759aae146087eb

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  CloseHandle

  CreateProcessA

  CreateProcessW

  GlobalAlloc

  SearchPathA

  SearchPathW

  GetFileAttributesA

  GetFileAttributesW

  CreateFileA

  CreateFileW

  WriteFile

  WideCharToMultiByte

  GetWindowsDirectoryW

  lstrlenA

  lstrlenW

  MultiByteToWideChar

  GlobalFree

  user32

  FindWindowExA

  SetWindowTextA

  SetWindowTextW

  MessageBoxW

  GetDlgItem

  advapi32

  RegQueryValueExA

  RegQueryValueExW

  RegOpenKeyExA

  RegOpenKeyExW

  RegCreateKeyExA

  RegCreateKeyExW

  RegEnumValueA

  RegEnumValueW

  RegEnumKeyExA

  RegEnumKeyExW

  RegCloseKey

  RegSetValueExA

  RegDeleteValueW

  RegDeleteValueA

  RegDeleteKeyW

  RegDeleteKeyA

  RegSetValueExW

  Exports

  Exports

  _Close

  _CopyKey

  _CopyValue

  _CreateKey

  _DeleteKey

  _DeleteKeyEmpty

  _DeleteValue

  _Find

  _HexToStrA

  _HexToStrW

  _KeyExists

  _MoveKey

  _MoveValue

  _Open

  _Read

  _ReadExtra

  _RestoreKey

  _SaveKey

  _StrToHexA

  _StrToHexW

  _Unload

  _Write

  _WriteExtra

  Sections

  .text

  Size: 18KB - Virtual size: 17KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 322KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/stack.dll

  .dll windows:4 windows x86 arch:x86

  454e327924e76e3c69e4915b2b6f1a25

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalAlloc

  GlobalFree

  lstrcmpiA

  lstrcpyA

  lstrcpynA

  GlobalUnlock

  lstrlenA

  lstrcatA

  GlobalLock

  user32

  EndDialog

  wsprintfA

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuA

  CreatePopupMenu

  SendMessageA

  GetDlgItem

  DialogBoxParamA

  Exports

  Exports

  _Debug

  _Unload

  _dll_clear

  _dll_create

  _dll_delete

  _dll_delete_range

  _dll_destroy

  _dll_exchange

  _dll_insert

  _dll_move

  _dll_move_range

  _dll_push_sort

  _dll_push_sort_int

  _dll_read

  _dll_reverse_range

  _dll_size

  _dll_sort_all

  _dll_sort_all_int

  _dll_write

  _ns_clear

  _ns_pop_front

  _ns_push_back

  _ns_push_front

  _ns_read

  _ns_size

  _ns_write

  Sections

  .text

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 360B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 642B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/xml.dll

  .dll windows:5 windows x86 arch:x86

  5bbd63919e9f724979e2ebcc7e04a7e6

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalFree

  lstrcpyW

  lstrcpynW

  GlobalAlloc

  WideCharToMultiByte

  MultiByteToWideChar

  GetProcessHeap

  SetEndOfFile

  RtlUnwind

  DecodePointer

  EncodePointer

  GetLastError

  RaiseException

  GetCurrentThreadId

  GetCommandLineA

  HeapAlloc

  HeapFree

  IsProcessorFeaturePresent

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  InterlockedIncrement

  GetModuleHandleW

  SetLastError

  InterlockedDecrement

  GetProcAddress

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  TerminateProcess

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  WriteFile

  GetStdHandle

  GetModuleFileNameW

  InitializeCriticalSectionAndSpinCount

  SetHandleCount

  GetFileType

  GetStartupInfoW

  DeleteCriticalSection

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  ReadFile

  SetFilePointer

  CloseHandle

  LCMapStringW

  Sleep

  HeapSize

  ExitProcess

  GetModuleFileNameA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  HeapCreate

  HeapDestroy

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  GetConsoleCP

  GetConsoleMode

  LoadLibraryW

  CreateFileA

  GetStringTypeW

  SetStdHandle

  FlushFileBuffers

  HeapReAlloc

  WriteConsoleW

  CreateFileW

  Exports

  Exports

  _GetText

  _GotoPath

  _LoadFile

  _Unload

  Sections

  .text

  Size: 139KB - Virtual size: 139KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 24KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 7KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $TEMP/sqlite3.exe

  .exe windows:4 windows x86 arch:x86

  ab6dc39f8604d36390ce39bdd9559b15

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  AreFileApisANSI

  CloseHandle

  CreateFileA

  CreateFileMappingW

  CreateFileW

  CreateMutexW

  DeleteCriticalSection

  DeleteFileA

  DeleteFileW

  EnterCriticalSection

  ExitProcess

  FlushFileBuffers

  FormatMessageA

  FormatMessageW

  FreeLibrary

  GetCurrentProcess

  GetCurrentProcessId

  GetDiskFreeSpaceA

  GetDiskFreeSpaceW

  GetFileAttributesA

  GetFileAttributesExW

  GetFileAttributesW

  GetFileSize

  GetFullPathNameA

  GetFullPathNameW

  GetLastError

  GetModuleHandleA

  GetProcAddress

  GetProcessHeap

  GetSystemInfo

  GetSystemTime

  GetSystemTimeAsFileTime

  GetTempPathA

  GetTempPathW

  GetTickCount

  GetVersionExA

  HeapAlloc

  HeapCreate

  HeapDestroy

  HeapFree

  HeapReAlloc

  HeapSize

  HeapValidate

  InitializeCriticalSection

  LeaveCriticalSection

  LoadLibraryA

  LoadLibraryW

  LocalFree

  LockFile

  LockFileEx

  MapViewOfFile

  MultiByteToWideChar

  OutputDebugStringA

  OutputDebugStringW

  QueryPerformanceCounter

  ReadFile

  SetEndOfFile

  SetFilePointer

  SetUnhandledExceptionFilter

  Sleep

  SystemTimeToFileTime

  TlsGetValue

  UnlockFile

  UnlockFileEx

  UnmapViewOfFile

  VirtualProtect

  VirtualQuery

  WaitForSingleObject

  WideCharToMultiByte

  WriteFile

  msvcrt

  __getmainargs

  __mb_cur_max

  __p__environ

  __p__fmode

  __set_app_type

  _access

  _assert

  _cexit

  _flsbuf

  _iob

  _isatty

  _isctype

  _onexit

  _pclose

  _pctype

  _popen

  _setmode

  _winmajor

  abort

  atexit

  atoi

  calloc

  exit

  fclose

  fflush

  fgets

  fopen

  fprintf

  fputc

  fputs

  free

  fwrite

  getenv

  localtime

  malloc

  memcmp

  memmove

  memset

  printf

  putchar

  puts

  qsort

  realloc

  signal

  strcmp

  strncmp

  strncpy

  strtol

  tolower

  vfprintf

  Sections

  .text

  Size: 417KB - Virtual size: 416KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 48KB - Virtual size: 48KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 1KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 32B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE