156c4c315215dbed30b71faf50a1e14c79c80ae3b08c3e653f319668eb19294d[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

156c4c315215dbed30b71faf50a1e14c79c80ae3b08c3e653f319668eb19294d.rar
Size

15.2MB
MD5

8e6144e0bbeb8ba5ab8796cb51b8729c
SHA1

84f3f994b0add18cf260d316b995ba39b8725f2e
SHA256

2afe69781982da13371c2eb49a0b283b9441c0f9b9945cb24d19f13889d099f3
SHA512

53ff6ac03d40a06c7d7431b2d8b62772824c642c37c0757345c758a12f9e19dcb12ef829009c148d5815b4a3e4a54bfafab1fb2755f073f29e8eed80e0aff87a
SSDEEP

393216:mBLJ+x85HpTsvdTEg0nvGota3HZQuO8BLJRKWll5vp941:wIC5Je58GotSZH6s5vs

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0736340bfdbab71f1ee58884ae3b89ba8e6f4f328671879dfcb941c6e4e67411
unpack001/3cc50a3f5e82e7ced7371e16ac8c28cb1e57010dcdc0769604805961b8bedf32
unpack001/9d9d364d3a94420cfc256139f40ecb5c3fd8298c076f89dc9a73442417703c6b
unpack001/a19607cee11cff492b4f3d4c37ad72f303598d0dbe84667c02b2b4b2aa4a4de3
unpack001/d3b5e7cd714efa82d204943d38619c06ecbca8d9f042cd47e50530f627770a54

Files

156c4c315215dbed30b71faf50a1e14c79c80ae3b08c3e653f319668eb19294d.rar
.rar
0736340bfdbab71f1ee58884ae3b89ba8e6f4f328671879dfcb941c6e4e67411
.exe windows:5 windows x86 arch:x86

3237ddf45e6fd5eb7c3cda490f6e20bb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
LoadLibraryW
GetWindowsDirectoryW
lstrlen
GetStartupInfoW
TerminateThread
lstrcpynW
GetTickCount
DeviceIoControl
GlobalMemoryStatus
OpenProcess
SetProcessWorkingSetSize
WaitForSingleObject
lstrcmpi
lstrcmp
GetSystemDirectoryW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
SetConsoleCtrlHandler
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
IsValidCodePage
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
FatalAppExitA
QueryPerformanceCounter
HeapCreate
GetCurrentThread
CreateProcessW
GetFileType
GetSystemInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
ExitProcess
GetCPInfo
LCMapStringW
LCMapStringA
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
GetFileSizeEx
ReadFile
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
InterlockedExchange
Sleep
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExW
GetVersion
SetHandleCount
GetCurrentProcessId
MulDiv
SetFilePointer
lstrcpyW
WideCharToMultiByte
GetCommandLineW
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
FreeResource
GetTempPathW
GetTempFileNameW
DeleteFileW
GetModuleHandleW
LoadLibraryExW
MultiByteToWideChar
SetLastError
CreateFileW
WriteFile
CloseHandle
lstrcmpiW
InterlockedDecrement
lstrlenW
GetCurrentThreadId
CreateMutexW
GetLastError
GetModuleFileNameW
GetProcAddress
CopyFileW
FreeLibrary
InterlockedIncrement
GetCurrentProcess
FlushInstructionCache
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetStartupInfoA

user32

GetClassInfoW
RegisterClassW
UnregisterClassA
ShowWindow
PostMessageW
SetWindowLongW
GetSysColor
SetCursor
SetCapture
ReleaseCapture
SetCaretPos
ShowCaret
IsIconic
IsWindow
SendMessageTimeoutW
FindWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
CharNextW
DestroyWindow
CreateDialogParamW
CreateCaret
IsRectEmpty
GetCursorPos
SetForegroundWindow
SetRect
FillRect
LoadImageW
IsDialogMessageW
SetActiveWindow
GetKeyState
RegisterClassExW
EnableMenuItem
GetSubMenu
LoadMenuW
DestroyMenu
LoadCursorW
GetClassInfoExW
HideCaret
ClientToScreen
MsgWaitForMultipleObjects
PostQuitMessage
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
SetWindowTextW
GetWindow
MonitorFromWindow
GetMonitorInfoW
EndDialog
GetFocus
EnableWindow
GetWindowTextW
SetDlgItemTextW
SetFocus
MoveWindow
GetShellWindow
GetWindowThreadProcessId
FindWindowW
ExitWindowsEx
ScreenToClient
MapWindowPoints
GetActiveWindow
GetDlgItem
IsWindowVisible
InvalidateRect
GetWindowRect
SetWindowPos
SetWindowRgn
KillTimer
SetTimer
SetLayeredWindowAttributes
EnumDisplayDevicesW
GetSystemMetrics
CallWindowProcW
GetWindowLongW
DialogBoxParamW
EndPaint
BeginPaint
GetDC
ReleaseDC
PtInRect
DrawTextW
GetParent
RedrawWindow
GetClientRect
CreateWindowExW
OffsetRect
SendMessageW
MessageBoxW
DefWindowProcW

gdi32

CreatePen
CreateFontW
DeleteDC
SetBkMode
DeleteObject
CreateCompatibleBitmap
SetViewportOrgEx
CombineRgn
GetDeviceCaps
ExtTextOutW
Rectangle
SelectObject
GetObjectW
CreatePolygonRgn
CreateRectRgn
EnumFontFamiliesW
GetStockObject
SetBkColor
SetTextColor
CreateFontIndirectW
CreateCompatibleDC
CreateSolidBrush
BitBlt

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExA
RegQueryValueExA
DuplicateTokenEx
OpenProcessToken
RegOpenKeyExA

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHCreateDirectoryExW
ShellExecuteW
ExtractIconExW

ole32

CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket
OleInitialize
OleUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SetErrorInfo
VariantChangeType
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
SysFreeString
SysStringLen
SysAllocString
CreateErrorInfo
GetErrorInfo

shlwapi

StrCmpW
PathCanonicalizeW
PathFindExtensionW
PathRemoveExtensionW
PathRenameExtensionW
PathIsDirectoryW
StrToIntExW
PathFindFileNameW
PathFileExistsW
PathCombineW
PathRemoveFileSpecW
PathIsRelativeW
PathAppendW
SHGetValueW
SHGetValueA
StrCmpNA
StrRChrA
PathRemoveBackslashW
StrCmpNIW
StrCmpNW
AssocQueryStringW
SHSetValueA

comctl32

_TrackMouseEvent
InitCommonControlsEx

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueA

ws2_32

gethostbyname
gethostname
inet_ntoa

wintrust

CryptCATHandleFromStore
WinVerifyTrust

crypt32

CertGetNameStringW

riched20

ord4

Sections

.text
Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
156c4c315215dbed30b71faf50a1e14c79c80ae3b08c3e653f319668eb19294d
.exe windows:5 windows x86 arch:x86

8ed464c423f2e1c8728ffda6cd7ba206

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:5b:f8:6e:85:26:53:40:33:13:83:7b
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

26/04/2023, 03:04

Not After

26/04/2026, 03:04

Subject

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a3:cf:f7:20:41:87:5c:7d:6a:4c:b6:7e:50:73:69:77:8a:04:57:ca:c9:3c:97:71:47:ac:a3:04:a0:0a:70:28
Signer

Actual PE Digest

a3:cf:f7:20:41:87:5c:7d:6a:4c:b6:7e:50:73:69:77:8a:04:57:ca:c9:3c:97:71:47:ac:a3:04:a0:0a:70:28

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\794680\out\Release\CPGenerator.pdb

Imports

kernel32

FindFirstFileW
GetModuleFileNameW
RemoveDirectoryW
Sleep
DeviceIoControl
FlushInstructionCache
RaiseException
GetVersionExW
InitializeCriticalSection
GetExitCodeThread
DeleteCriticalSection
WriteFile
SetFilePointer
WaitForSingleObject
SetEvent
CreateEventW
FlushFileBuffers
MoveFileExW
ReadFile
FreeResource
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
SetEnvironmentVariableW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetTempPathW
GetFileSize
InterlockedIncrement
InterlockedDecrement
GetTempFileNameW
CreateMutexW
GetCurrentProcessId
ResetEvent
WaitForMultipleObjects
CreateThread
MoveFileW
CopyFileW
lstrcmpiW
SetFileAttributesW
GetTickCount
TlsSetValue
TlsGetValue
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
OutputDebugStringW
SetFilePointerEx
SystemTimeToFileTime
SetEnvironmentVariableA
GetCurrentThreadId
CompareStringA
GetFullPathNameW
SetEndOfFile
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleA
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
TlsFree
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoW
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
ExitThread
ExitProcess
VirtualQuery
GetSystemInfo
VirtualProtect
GetConsoleMode
GetConsoleCP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
GetSystemWindowsDirectoryW
lstrcmpiA
lstrcmpA
CreateFileA
GetSystemDirectoryW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
lstrlenA
SetLastError
DosDateTimeToFileTime
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryW
FindClose
FindNextFileW
GetCurrentProcess
OpenProcess
GetFileSizeEx
GetDriveTypeW
GetDiskFreeSpaceExW
TlsAlloc
GetWindowsDirectoryW
DeleteFileW
FormatMessageW
CreateDirectoryW
GetLastError
GetStdHandle
CreateFileW
SetConsoleTextAttribute
LocalFileTimeToFileTime
SetFileTime
GetLocaleInfoW
GetFileAttributesW
MultiByteToWideChar
InterlockedExchange
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
InterlockedCompareExchange
FindResourceExW
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
CloseHandle
SizeofResource
lstrlenW
CompareStringW

user32

KillTimer
SendMessageTimeoutW
IsWindow
GetDC
UnregisterClassA
GetWindowThreadProcessId
GetShellWindow
SetWindowPos
SetForegroundWindow
BringWindowToTop
IsIconic
ShowWindow
IsWindowVisible
GetIconInfo
MessageBoxW
GetActiveWindow
DrawIconEx
FillRect
EndDialog
GetWindowLongW
MoveWindow
GetWindowRect
GetClientRect
ScreenToClient
GetDlgItem
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
ReleaseDC
SetWindowLongW
GetWindowTextW
EnableWindow
SetWindowTextW
SetFocus
ScrollWindow
RedrawWindow
DefWindowProcW
BeginPaint
EndPaint
UpdateWindow
InvalidateRect
CallWindowProcW
GetWindowTextLengthW
PtInRect
CreateWindowExW
IsDialogMessageW
IsWindowEnabled
RegisterClassW
SendMessageW
CreateDialogParamW
DestroyWindow
GetCursorPos
ClientToScreen
GetClassInfoW
PostMessageW
CharNextW
GetFocus
PostQuitMessage
IsDlgButtonChecked
GetSystemMetrics
LoadImageW
SetDlgItemTextW
DialogBoxParamW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
FindWindowExW
SystemParametersInfoW
AnimateWindow
SetWindowRgn
GetClassInfoExW
SetTimer
CopyRect
RegisterClassExW
UpdateLayeredWindow
LoadCursorW

gdi32

CreateRectRgn
CreateRoundRectRgn
GetObjectA
SetBoundsRect
CreateFontW
BitBlt
CreateCompatibleBitmap
SetViewportOrgEx
SetBkColor
ExtTextOutW
GetTextExtentPoint32W
CreateDIBSection
SelectObject
DeleteDC
CreateCompatibleDC
DeleteObject
CreateSolidBrush
GetDeviceCaps
GetObjectW
CombineRgn

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegCreateKeyExW
RegOpenKeyExA
RegEnumKeyExA
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateTokenEx
CreateProcessAsUserW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueExA
GetTokenInformation

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
CommandLineToArgvW
SHCreateDirectoryExW
ExtractIconExW
ord165

ole32

CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateGuid
CreateStreamOnHGlobal

oleaut32

VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
SysFreeString
SysStringLen
SysAllocString

shlwapi

PathAppendW
PathFileExistsW
StrCpyW
PathCombineW
PathRemoveFileSpecW
AssocQueryStringW
PathFindExtensionW
PathIsRelativeW
PathCompactPathW
PathCompactPathExW
StrCmpIW
PathIsPrefixW
PathFindFileNameW
StrCmpNIW
PathRemoveExtensionW
PathIsRootW
PathGetCharTypeW
PathStripToRootW
PathIsNetworkPathW
PathCanonicalizeW
StrStrIW
SHGetValueA
SHSetValueA
StrTrimA
SHGetValueW
StrStrIA

comctl32

InitCommonControlsEx
_TrackMouseEvent

gdiplus

GdiplusStartup
GdiplusShutdown
GdipFree
GdipAlloc
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipDrawImageRectRect
GdipLoadImageFromFile
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawString
GdipSetTextRenderingHint
GdipReleaseDC
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipDeleteFont
GdipDeleteGraphics
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteBrush
GdipCloneImage
GdipLoadImageFromStream
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
GdipLoadImageFromStreamICM

wininet

HttpQueryInfoW
HttpOpenRequestW
InternetCloseHandle
InternetConnectW
InternetOpenW
HttpSendRequestW

version

GetFileVersionInfoW
VerQueryValueW

wintrust

WinVerifyTrust

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 519KB - Virtual size: 518KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10.5MB - Virtual size: 10.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
3cc50a3f5e82e7ced7371e16ac8c28cb1e57010dcdc0769604805961b8bedf32
.exe windows:5 windows x86 arch:x86

74bd6be8b8a665f4df2befc974c4bb66

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\581738\out\Release\DesktopRest.pdb

Imports

kernel32

MapViewOfFileEx
InterlockedExchange
TerminateThread
GetExitCodeThread
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetFileAttributesW
MoveFileExW
GetLocalTime
ExpandEnvironmentStringsW
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcmpW
GetVersion
GetFileSizeEx
FindClose
FindFirstFileW
FindNextFileW
WritePrivateProfileStringW
GlobalFree
SetCurrentDirectoryW
GetACP
GetModuleHandleA
CreateThread
ReleaseSemaphore
SetFilePointerEx
RemoveDirectoryW
OpenThread
GetModuleHandleExW
GetThreadLocale
SetThreadLocale
LocalFree
SystemTimeToFileTime
LocalAlloc
WriteConsoleW
HeapDestroy
InitializeCriticalSection
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
GetFileType
GetStdHandle
ExitProcess
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
GetProcessAffinityMask
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReleaseMutex
HeapWalk
HeapUnlock
HeapLock
CreateFileA
LocalFileTimeToFileTime
GetCPInfo
LCMapStringW
CompareStringW
QueryPerformanceFrequency
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
TryEnterCriticalSection
GetStringTypeW
LoadLibraryExA
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
ReadFile
GetFileSize
InterlockedCompareExchange
DuplicateHandle
GetVersionExW
lstrlenW
GetCurrentProcess
QueryPerformanceCounter
OpenFileMappingW
CreateFileMappingW
lstrlenA
FreeEnvironmentStringsW
LockResource
InterlockedDecrement
InterlockedIncrement
GetUserDefaultLCID
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetTimeFormatW
GetDateFormatW
SetThreadAffinityMask
LoadLibraryExW
GetProcAddress
GetModuleHandleW
FreeLibrary
VirtualFree
UnmapViewOfFile
MapViewOfFile
GetCurrentThread
ResumeThread
SetThreadPriority
GetStartupInfoW
CreateProcessW
CopyFileW
DeleteFileW
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceExW
FindResourceW
OutputDebugStringW
GetCommandLineW
GetModuleFileNameW
LoadLibraryW
lstrcmpiW
MulDiv
SetFilePointer
WriteFile
SizeofResource
LoadResource
DeleteCriticalSection
GetCurrentThreadId
GetCurrentProcessId
OpenProcess
GetProcessHeap
GetCommandLineA
HeapSize
SetEnvironmentVariableA
VirtualProtect
VirtualAlloc
GetNativeSystemInfo
GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
GetThreadTimes
TerminateProcess
CreateSemaphoreW
Sleep
CreateEventW
CreateMutexW
WaitForSingleObjectEx
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
HeapFree
HeapReAlloc
CreateFileW
HeapAlloc
SetErrorMode
SetLastError
GetLastError
RaiseException
CloseHandle

user32

GetDC
ReleaseDC
SetWindowLongW
FindWindowW
GetWindowThreadProcessId
LoadCursorW
PostMessageW
MsgWaitForMultipleObjects
RegisterWindowMessageW
SendMessageW
PostQuitMessage
GetSystemMetrics
CharNextW
DestroyWindow
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
DefWindowProcW
SendMessageTimeoutW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetSysColors
TrackPopupMenu
GetSubMenu
DestroyMenu
LoadMenuW
CallWindowProcW
GetWindowLongW
GetDesktopWindow
FindWindowExW
ShowWindow
MoveWindow
IsWindowVisible
CharLowerW
GetDlgItem
SetFocus
GetForegroundWindow
GetClientRect
GetWindowRect
ScreenToClient
CopyRect
PtInRect
GetParent
wsprintfW
SetTimer
KillTimer
SetWindowPos
UpdateLayeredWindow
GetLastInputInfo
GetCursorPos
MapWindowPoints
InflateRect
EqualRect
GetWindow
MonitorFromWindow
GetMonitorInfoW
IsChild
GetFocus
SetCapture
ReleaseCapture
CreateAcceleratorTableW
DestroyAcceleratorTable
BeginPaint
EndPaint
InvalidateRect
InvalidateRgn
EnumDisplayMonitors
PostThreadMessageW
RedrawWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
ClientToScreen
OffsetRect
DrawTextW
GetSysColor
FillRect
GetClassNameW
GetWindowDC
MonitorFromPoint
IsRectEmpty

gdi32

CreateDCW
CreateDIBSection
StretchBlt
SetBitmapBits
GetObjectW
GetStockObject
CreateCompatibleBitmap
BitBlt
GetObjectA
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
GetDeviceCaps
SetBkMode
SetTextColor
CreateFontW
EnumFontFamiliesW
GetCurrentObject
CreateSolidBrush
SetBkColor

comdlg32

GetOpenFileNameW

advapi32

GetTokenInformation
OpenProcessToken
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
ord165
ShellExecuteW
SHGetFolderPathW
ord680

ole32

CreateStreamOnHGlobal
OleLockRunning
OleUninitialize
OleInitialize
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CoTaskMemRealloc
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
StringFromGUID2

oleaut32

OleCreateFontIndirect
VariantCopy
SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SafeArrayCreate
SysAllocStringByteLen
VarBstrCmp
LoadRegTypeLi
LoadTypeLi
SysStringLen
DispCallFunc
VariantClear
VariantInit
SysAllocStringLen
SysAllocString
VarUI4FromStr
SysFreeString
SysStringByteLen

shlwapi

SHDeleteKeyW
PathAppendW
PathFileExistsW
PathFindFileNameW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
SHGetValueW
StrStrIA
PathCombineW
StrStrIW
SHSetValueW
PathCanonicalizeW
PathIsRootW
StrCpyNW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipClosePathFigure
GdipCreateBitmapFromStream
GdipBitmapGetPixel
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipMeasureString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillPath
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateSolidFill
GdipDeleteBrush
GdipDeletePath
GdipCreatePath
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipAddPathLineI
GdipAddPathArcI
GdipAddPathRectangleI
GdipCreateFromHDC

crypt32

CryptBinaryToStringA
CryptStringToBinaryA

winmm

timeKillEvent
timeSetEvent

msi

ord173
ord217

Sections

.text
Size: 988KB - Virtual size: 988KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 249KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 127KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
54dbee2232aa2e8fb5943af1ba3b054c4d2e97fd7a6fec75447931748598f7dc
.exe windows:5 windows x86 arch:x86

a7334470dc3819101c1ccb812b85fb31

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:48:80:7b:7b:ab:9c:14:bf:d4:26:00:49:75:36:66
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

19/05/2023, 00:00

Not After

18/05/2024, 23:59

Subject

SERIALNUMBER=91110107579085401K,CN=趣游时代（北京）科技有限公司,O=趣游时代（北京）科技有限公司,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e69c9de998b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:a7:59:ea:50:de:2e:ac:76:e4:b6:37:12:59:09:c9:ba:e8:fc:a7:c0:ee:dd:54:1c:16:2b:07:06:4c:65:94
Signer

Actual PE Digest

43:a7:59:ea:50:de:2e:ac:76:e4:b6:37:12:59:09:c9:ba:e8:fc:a7:c0:ee:dd:54:1c:16:2b:07:06:4c:65:94

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\code\360GameWd\bin\Release\360GameWDDownLoader.pdb

Imports

kernel32

DeleteFileW
FlushInstructionCache
MoveFileW
Sleep
GetTempPathW
GetTempFileNameW
lstrlenW
CopyFileW
GetLogicalDriveStringsW
GetDriveTypeW
GetDiskFreeSpaceExW
CreateDirectoryW
RemoveDirectoryW
MoveFileExW
GetVersionExW
TerminateProcess
WaitForMultipleObjects
LoadLibraryExA
DecodePointer
InterlockedIncrement
LoadLibraryExW
lstrcmpiW
WriteProcessMemory
VirtualAllocEx
DuplicateHandle
OpenProcess
ReadProcessMemory
VirtualFreeEx
InterlockedDecrement
SetCurrentDirectoryW
GlobalUnlock
GlobalSize
GlobalLock
FindClose
FindNextFileW
FindFirstFileW
RaiseException
GetTickCount
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
CreateProcessW
GetModuleFileNameW
GetCurrentProcessId
DeviceIoControl
SuspendThread
ResumeThread
TerminateThread
SetThreadPriority
WaitForSingleObject
SetEvent
CreateEventW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetFileSize
GetPrivateProfileStringA
WritePrivateProfileStringA
ReleaseSemaphore
GetCurrentProcess
SetLastError
GetProcAddress
GetCurrentThread
LoadLibraryW
GetModuleHandleW
ReadFile
GetFileSizeEx
LocalFree
WideCharToMultiByte
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WriteFile
CreateFileW
SetFileAttributesW
GetFileAttributesW
WaitForSingleObjectEx
ReleaseMutex
GetSystemInfo
GlobalMemoryStatusEx
FreeResource
VerSetConditionMask
VerifyVersionInfoW
MulDiv
GlobalFree
GlobalAlloc
lstrcmpW
InterlockedExchange
SetFileTime
SetFilePointer
HeapWalk
HeapLock
OpenThread
HeapUnlock
GetSystemTime
FormatMessageW
SetEndOfFile
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateFileA
SetThreadContext
GetThreadContext
InterlockedCompareExchange
VirtualProtect
VirtualQuery
SetEnvironmentVariableA
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FreeEnvironmentStringsW
CreateMutexW
CloseHandle
GetLastError
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapAlloc
GetEnvironmentStringsW
QueryPerformanceCounter
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
CreateSemaphoreW
GetStartupInfoW
TlsFree
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStdHandle
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetModuleHandleExW
ExitProcess
RtlUnwind
GetCommandLineW
GetFileAttributesExW
GetSystemTimeAsFileTime
ExitThread
CreateThread
EncodePointer
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
OutputDebugStringW
IsDebuggerPresent
ReadConsoleW

user32

GetWindowLongW
PostMessageW
DefWindowProcW
IsWindow
MsgWaitForMultipleObjects
PeekMessageW
GetMessageW
TranslateMessage
RegisterClassExW
CreateWindowExW
SetWindowLongW
DestroyWindow
UnregisterClassW
MapWindowPoints
GetClientRect
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
ShowWindow
GetKeyState
GetFocus
SetParent
CharNextW
PostQuitMessage
CallWindowProcW
GetClassInfoExW
LoadCursorW
KillTimer
SetWindowPos
OffsetRect
GetParent
SendMessageW
DispatchMessageW
SetTimer
PostThreadMessageW
GetDC
ReleaseDC
DrawTextW
SetCapture
ReleaseCapture
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
BringWindowToTop
SwitchToThisWindow
SetFocus
BeginPaint
EndPaint
UpdateLayeredWindow
ScreenToClient
IsZoomed
SystemParametersInfoW
GetMessagePos
SetWindowRgn
SetClassLongW
DrawIcon
DrawIconEx
GetIconInfo
FillRect
CopyRect
RedrawWindow
ClientToScreen
TrackMouseEvent
IsRectEmpty
IntersectRect
InflateRect
SubtractRect
SetRect
RegisterClipboardFormatW
HideCaret
SetCursor
GetSysColor
PtInRect
GetCursorPos
GetCaretBlinkTime
GetAsyncKeyState
UnionRect
IsGUIThread
AnimateWindow
GetSystemMetrics
SetWindowTextW
LoadImageW
InvalidateRect
GetWindowThreadProcessId
MessageBoxW

gdi32

DeleteDC
SelectObject
SetBkMode
GetTextExtentPoint32W
DeleteObject
CreateCompatibleDC
CreateRoundRectRgn
CreateRectRgn
CombineRgn
CreatePen
MoveToEx
LineTo
GetObjectA
CreateSolidBrush
Rectangle
RoundRect
GetObjectW
CreateDCW
CreateFontW
CreateCompatibleBitmap
GetBitmapBits
SetBitmapBits
SetTextColor
BitBlt
StretchBlt
CreateFontIndirectW
SetStretchBltMode
SetViewportOrgEx
GetDeviceCaps
SetDIBColorTable
GetStockObject
CreateDIBSection
GetDIBits

advapi32

RegQueryValueExA
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetMalloc
ShellExecuteW
ord165
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize
CoInitialize
CoCreateInstance
GetHGlobalFromStream
CoMarshalInterface
CreateStreamOnHGlobal
OleCreate
OleSetContainedObject
OleInitialize
OleUninitialize
CoTaskMemFree
StringFromCLSID
CoCreateGuid

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
VariantCopy
VarUI4FromStr

shlwapi

PathBuildRootW
PathIsRootW
PathMatchSpecW
SHDeleteKeyW
PathFindExtensionW
PathGetDriveNumberW
SHSetValueW
StrCmpNIW
SHGetValueW
PathCombineW
PathFindFileNameW
SHRegGetPathW
SHDeleteValueW
PathAddBackslashW
PathIsDirectoryW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

crypt32

CryptUnprotectData
CryptProtectData

psapi

EnumProcessModules
GetModuleFileNameExW
GetModuleBaseNameW
EnumProcesses

gdiplus

GdiplusShutdown
GdipAddPathLineI
GdipAddPathArcI
GdipClonePath
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipSetInterpolationMode
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDrawImageI
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
GdipGetImagePixelFormat
GdiplusStartup
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdipReleaseDC
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorKeys
GdipDrawImageRectRectI
GdipGetImageHeight
GdipGetImageWidth
GdipCreateTexture2I
GdipDeleteBrush
GdipTranslateTextureTransform
GdipFillRectangleI
GdipCreatePen1
GdipDeletePen
GdipDrawLineI
GdipCreateSolidFill
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipSetTextRenderingHint
GdipDrawString
GdipMeasureString
GdipDrawRectangleI
GdipFillPath
GdipDrawPath
GdipDeletePath
GdipCreateBitmapFromFile
GdipCreatePath

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetSetStatusCallbackW
InternetGetCookieW
InternetSetCookieW
InternetOpenW
InternetCloseHandle
InternetReadFile
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
DeleteUrlCacheEntryW
HttpSendRequestExA
InternetCrackUrlW
InternetSetOptionW
InternetOpenA
HttpQueryInfoW
HttpAddRequestHeadersA
InternetSetCookieA
HttpQueryInfoA
InternetQueryOptionA
InternetWriteFile
InternetReadFileExA
InternetConnectW
HttpEndRequestW

msimg32

TransparentBlt
AlphaBlend

Sections

.text
Size: 711KB - Virtual size: 711KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
9d9d364d3a94420cfc256139f40ecb5c3fd8298c076f89dc9a73442417703c6b
.exe windows:5 windows x86 arch:x86

9bb8cb1f85a3976c1029795ecdc3a6c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\765464\out\Release\GameAssistantSetup.pdb

Imports

kernel32

FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
GetLongPathNameW
GetVolumeInformationW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
GlobalAlloc
GlobalFree
MoveFileExW
GetFileAttributesExW
GetCurrentProcess
OpenThread
GetModuleHandleExW
lstrcmpiW
GetThreadLocale
SetThreadLocale
GetVersionExW
SystemTimeToFileTime
GetLocalTime
GetCommandLineW
GetCurrentDirectoryW
CreateDirectoryW
GetFileAttributesW
LocalFileTimeToFileTime
lstrcmpA
LocalFree
GetModuleHandleA
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MapViewOfFile
GetCurrentThreadId
lstrlenA
LoadLibraryW
UnmapViewOfFile
CreateFileMappingW
GetFileSize
GetTimeZoneInformation
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
SizeofResource
LockResource
WriteConsoleW
SetStdHandle
FindClose
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetConsoleOutputCP
FlushFileBuffers
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
GetFileType
GetStdHandle
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
RtlUnwind
FreeResource
GetSystemWindowsDirectoryW
lstrcmpiA
InitializeSListHead
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapDestroy
OutputDebugStringW
WriteFile
SetFilePointer
ReadFile
GetFileSizeEx
ExpandEnvironmentStringsW
GetModuleFileNameW
GetCurrentProcessId
DeleteCriticalSection
InitializeCriticalSection
GetUserDefaultLCID
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
TerminateProcess
Sleep
CreateEventW
CreateMutexW
WaitForSingleObjectEx
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
DeleteFileW
SetFilePointerEx
SetEnvironmentVariableW
IsDebuggerPresent
GetStringTypeW
LeaveCriticalSection
TryEnterCriticalSection
EnterCriticalSection
GetCPInfo
LCMapStringEx
DeviceIoControl
HeapFree
HeapReAlloc
HeapAlloc
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetEnvironmentVariableW
FormatMessageW
GetACP
MulDiv
GlobalSize
VerSetConditionMask
VerifyVersionInfoW
GlobalUnlock
SetErrorMode
SetLastError
GetLastError
RaiseException
CloseHandle
SetFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
CreateFileA
HeapLock
HeapUnlock
HeapWalk
ReleaseMutex
TlsAlloc
TlsGetValue
TlsSetValue
GlobalLock
TlsFree
CreateFileW

user32

FindWindowW
PostMessageW
DefWindowProcW
RegisterClassExW
CreateWindowExW
IsWindow
DestroyWindow
ShowWindow
GetWindowLongW
SetWindowLongW
CharLowerW
GetSystemMetrics
IntersectRect
OffsetRect
EqualRect
PtInRect
GetMonitorInfoW
EnumDisplayMonitors
AttachThreadInput
IsIconic
BringWindowToTop
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
GetDesktopWindow
DrawTextW
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetAsyncKeyState
GetSysColor
ClientToScreen
SetCursor
UnionRect
MonitorFromPoint
IsZoomed
GetCursorPos
GetKeyState
ScreenToClient
SendMessageTimeoutW
UpdateLayeredWindow
IsRectEmpty
GetUpdateRect
MoveWindow
EndPaint
BeginPaint
InvalidateRect
ReleaseCapture
SetCapture
GetFocus
GetDC
CallWindowProcW
RegisterClassW
LoadCursorW
ReleaseDC
GetWindowThreadProcessId
wsprintfW
SetWindowPos
IsWindowVisible
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageW
PostQuitMessage
SetTimer
KillTimer
GetClientRect
GetWindowRect
MapWindowPoints
GetParent
GetWindow
LoadImageW
MonitorFromWindow
SetFocus
EnableWindow
SetWindowTextW
SetWindowRgn

advapi32

RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
CloseServiceHandle
RegQueryInfoKeyW
RegEnumKeyExW
StartServiceW
SetServiceObjectSecurity
QueryServiceStatus
QueryServiceObjectSecurity
OpenServiceW
ChangeServiceConfigW
RegEnumKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
OpenProcessToken
OpenSCManagerW

shell32

ord165
SHGetPathFromIDListW
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteW
SHBrowseForFolderW
SHGetFolderPathW

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoTaskMemRealloc
CreateStreamOnHGlobal
CoCreateGuid
OleInitialize
OleUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW
StrStrIW
PathAppendW
SHDeleteValueW
StrCmpIW
StrStrIA
PathRemoveFileSpecW
SHGetValueW
StrCmpNIW
PathCanonicalizeW
PathIsDirectoryW
PathIsPrefixW
PathIsRootW
PathRemoveBackslashW
PathIsRelativeW
PathFindFileNameW
SHSetValueW
SHGetValueA
SHSetValueA
PathCombineW
StrTrimA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

psapi

GetModuleFileNameExW

gdiplus

GdipCreateRegionPath
GdipDeleteRegion
GdipSetPathGradientFocusScales
GdipFillRegion
GdipCreatePathGradientFromPath
GdiplusShutdown
GdipDeletePath
GdipCreatePath
GdipSetPixelOffsetMode
GdipImageGetFrameDimensionsList
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipSetPathGradientPresetBlend
GdipImageGetFrameCount
GdipCreateBitmapFromStream
GdiplusStartup
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipSetPathGradientWrapMode
GdipImageGetFrameDimensionsCount
GdipCloneBrush
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipCreatePen1
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipDrawImageRectRectI
GdipDeleteBrush
GdipAddPathPath
GdipGetPropertyItem
GdipCreateFromHDC
GdipMeasureString
GdipFillEllipse
GdipDrawEllipse
GdipDrawString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawPath
GdipDrawRectangleI
GdipDrawLineI
GdipCreateLineBrushFromRectI
GdipFillPath
GdipCreateSolidFill
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipSetSmoothingMode
GdipClosePathFigure
GdipAddPathArc
GdipAddPathLine
GdipAddPathEllipse
GdipAddPathRectangle
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipGetWorldTransform
GdipLoadImageFromFile
GdipImageRotateFlip
GdipDrawImageRect
GdipSetWorldTransform
GdipRotateMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix
GdipCreatePen2
GdipSetLineBlend
GdipCreateLineBrushFromRect
GdipDrawArc
GdipDeletePen

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx

crypt32

CryptBinaryToStringA

winmm

timeKillEvent
timeSetEvent

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

msimg32

AlphaBlend

iphlpapi

GetAdaptersInfo

wininet

InternetConnectW
InternetSetOptionW
InternetReadFile
HttpQueryInfoW
HttpSendRequestW
InternetCrackUrlW
InternetOpenW
InternetCloseHandle
HttpOpenRequestW

gdi32

DeleteObject
GetObjectW
CreateRoundRectRgn
BitBlt
CreateFontIndirectW
GetDeviceCaps
GetWindowOrgEx
CreateRectRgnIndirect
SaveDC
ExtSelectClipRgn
RestoreDC
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteDC
SetWindowOrgEx
SetStretchBltMode
StretchBlt
SetTextColor
SetBkColor
SetBkMode
GetObjectA
GetStockObject

Sections

.text
Size: 969KB - Virtual size: 968KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 240KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
a19607cee11cff492b4f3d4c37ad72f303598d0dbe84667c02b2b4b2aa4a4de3
.exe windows:5 windows x86 arch:x86

06475a7f08c90c0411b67834b52a9e0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\337038\out\Release\update.pdb

Imports

kernel32

DeleteCriticalSection
GetFileTime
lstrcmpiW
GetFileSizeEx
FlushFileBuffers
CreateFileW
ReadFile
FileTimeToSystemTime
WriteFile
GetTickCount
SetFilePointerEx
InterlockedDecrement
InterlockedIncrement
SystemTimeToTzSpecificLocalTime
SetEndOfFile
DeleteAtom
FindAtomW
AddAtomW
SetFileAttributesW
CreateThread
WritePrivateProfileStringW
MoveFileExW
GetTempFileNameW
WideCharToMultiByte
CopyFileW
GetPrivateProfileStringW
InterlockedCompareExchange
DeleteFileW
CloseHandle
GetDiskFreeSpaceExW
LockResource
EnterCriticalSection
GetProcAddress
GetLastError
lstrlenW
GetModuleFileNameW
lstrcpynW
LeaveCriticalSection
SizeofResource
Sleep
MoveFileW
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
lstrlenA
MultiByteToWideChar
WaitForSingleObject
SystemTimeToFileTime
GetCurrentProcess
LoadLibraryW
SetLastError
GetStartupInfoW
CreateProcessW
TerminateProcess
GetSystemDirectoryW
SetEvent
CreateEventW
GetCurrentProcessId
OpenProcess
GetLongPathNameW
GetExitCodeProcess
GetCurrentThreadId
RaiseException
FlushInstructionCache
DeviceIoControl
LoadLibraryExW
GetVersionExW
GetVersion
GetFileSize
GetLocalTime
WaitForMultipleObjects
HeapFree
GetProcessHeap
LocalFree
LocalAlloc
CreateEventA
HeapAlloc
SetFilePointer
UnmapViewOfFile
SetFileTime
DosDateTimeToFileTime
MapViewOfFile
CreateFileMappingW
GetExitCodeThread
CreateFileA
GetTempPathW
GetACP
IsBadReadPtr
OutputDebugStringA
lstrcmpW
FreeResource
MulDiv
InterlockedExchange
ResumeThread
ResetEvent
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
HeapDestroy
HeapReAlloc
HeapSize
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
TlsGetValue
OutputDebugStringW
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
ReleaseMutex
TlsAlloc
TlsFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileAttributesW
RtlUnwind
ExitProcess
ExitThread
LCMapStringA
LCMapStringW
GetCPInfo
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapCreate
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetModuleHandleA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
lstrcmpA
lstrcmpiA
GetSystemWindowsDirectoryW
OpenEventA
InitializeCriticalSection
LoadResource
FreeLibrary
FindResourceW
FindResourceExW
GetModuleHandleW
CreateMutexW

user32

FindWindowExW
CharNextW
SetLayeredWindowAttributes
RedrawWindow
CopyRect
IsZoomed
SetForegroundWindow
IntersectRect
DestroyIcon
DrawIconEx
GetIconInfo
DrawTextW
CharPrevW
SetRect
CreateCaret
HideCaret
ShowCaret
SetCaretPos
ClientToScreen
GetSysColor
FillRect
InvalidateRgn
MoveWindow
CreateAcceleratorTableW
wvsprintfW
MonitorFromWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
UnregisterClassA
PostThreadMessageW
PeekMessageW
IsIconic
GetParent
GetWindowLongW
IsWindowVisible
PostMessageW
DispatchMessageW
SendMessageW
TranslateMessage
SetCursor
InflateRect
GetWindowDC
OffsetRect
RegisterClassW
GetPropW
LoadImageW
SystemParametersInfoW
ShowWindow
GetWindow
GetUpdateRect
BeginPaint
EndPaint
IsRectEmpty
UpdateLayeredWindow
GetCursorPos
IsChild
GetClassNameW
MapWindowPoints
SetFocus
GetFocus
ReleaseDC
GetDC
PtInRect
ReleaseCapture
SetCapture
InvalidateRect
SetWindowPos
GetKeyState
SetPropW
GetWindowRect
SetWindowRgn
ScreenToClient
GetClientRect
RemovePropW
EnableWindow
CallWindowProcW
CreateWindowExW
LoadCursorW
GetClassInfoExW
BringWindowToTop
SetWindowLongW
IsWindow
SetTimer
GetMessageW
PostQuitMessage
KillTimer
FindWindowW
RegisterClassExW
SendMessageTimeoutW
DestroyWindow
GetWindowThreadProcessId
DefWindowProcW
GetMonitorInfoW

advapi32

OpenProcessToken
AdjustTokenPrivileges
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
SetTokenInformation
GetLengthSid
CreateWellKnownSid
DuplicateTokenEx
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyW
RegQueryValueExA
RegEnumKeyExW
RegEnumKeyExA
RegOpenKeyExA
GetTokenInformation
RegCreateKeyExW
LookupPrivilegeValueW

shell32

SHCreateDirectoryExW
ord165
ShellExecuteW
ShellExecuteExW
SHFileOperationW
SHGetSpecialFolderPathW

ole32

PropVariantClear
CoInitialize
CoUninitialize
CoCreateInstance
CoCreateGuid
CLSIDFromProgID
CLSIDFromString
OleLockRunning
CreateStreamOnHGlobal

oleaut32

VariantClear
SysAllocString
SafeArrayCreate
SafeArrayPutElement
SysFreeString
SysStringByteLen
VariantInit

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathCombineW
PathAppendW
PathIsRelativeW
wnsprintfW
PathIsDirectoryW
PathIsRootW
AssocQueryStringW
PathFindFileNameW
SHGetValueA
SHSetValueA
StrCmpNIW
StrStrIW
StrCmpIW
StrStrIA
StrTrimA
PathStripToRootW
PathFindExtensionW

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

msimg32

GradientFill
AlphaBlend

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

urlmon

URLDownloadToCacheFileW

psapi

GetModuleFileNameExW
EnumProcesses

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

iphlpapi

GetAdaptersInfo

gdi32

GetDeviceCaps
CreateSolidBrush
StretchBlt
SetDIBitsToDevice
CreateDCW
GetDIBits
GetCharABCWidthsW
SetStretchBltMode
GetTextExtentPoint32W
SetTextColor
CombineRgn
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
SelectClipRgn
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
SaveDC
RestoreDC
BitBlt
Rectangle
SetWindowOrgEx
DeleteDC
CreatePen
SetBkMode
RoundRect
MoveToEx
LineTo
SetBkColor
ExtTextOutW
CreateRoundRectRgn
GetStockObject
GetObjectW
CreateFontIndirectW
SelectObject
GetTextMetricsW
TextOutW
DeleteObject

gdiplus

GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipFillPath
GdipClosePathFigure
GdipCreateTexture
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImagePointsI
GdipDrawImageRectRectI
GdipCloneBitmapAreaI
GdipAddPathArcI
GdipDeleteBrush
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipCreateSolidFill
GdipCreateFromHDC
GdipSetSmoothingMode
GdipFillEllipseI
GdipCloneBrush
GdipCreatePen1
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipAddPathArc
GdipDrawPath
GdipDrawEllipseI
GdipDisposeImage
GdipGetImageWidth
GdipBitmapUnlockBits
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGraphicsClear
GdipDrawImageRectI
GdipLoadImageFromStreamICM
GdipCloneImage
GdipSaveImageToFile
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateHBITMAPFromBitmap
GdipBitmapLockBits
GdipGetImageHeight

Sections

.text
Size: 766KB - Virtual size: 768KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 176KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 134KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
d3b5e7cd714efa82d204943d38619c06ecbca8d9f042cd47e50530f627770a54
.exe windows:5 windows x86 arch:x86

be41bf7b8cc010b614bd36bbca606973

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 532KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3237ddf45e6fd5eb7c3cda490f6e20bb

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

iphlpapi

version

ws2_32

wintrust

crypt32

riched20

Sections

.text Size: 516KB - Virtual size: 516KB

.rdata Size: 100KB - Virtual size: 100KB

.data Size: 32KB - Virtual size: 32KB

.rsrc Size: 140KB - Virtual size: 140KB

.reloc Size: 100KB - Virtual size: 100KB

8ed464c423f2e1c8728ffda6cd7ba206

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:5b:f8:6e:85:26:53:40:33:13:83:7bCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

a3:cf:f7:20:41:87:5c:7d:6a:4c:b6:7e:50:73:69:77:8a:04:57:ca:c9:3c:97:71:47:ac:a3:04:a0:0a:70:28Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

wininet

version

wintrust

iphlpapi

Sections

.text Size: 519KB - Virtual size: 518KB

.rdata Size: 96KB - Virtual size: 95KB

.data Size: 19KB - Virtual size: 33KB

.rsrc Size: 10.5MB - Virtual size: 10.5MB

.reloc Size: 63KB - Virtual size: 63KB

74bd6be8b8a665f4df2befc974c4bb66

Headers

DLL Characteristics

File Characteristics

.text
Size: 516KB - Virtual size: 516KB

.rdata
Size: 100KB - Virtual size: 100KB

.data
Size: 32KB - Virtual size: 32KB

.rsrc
Size: 140KB - Virtual size: 140KB

.reloc
Size: 100KB - Virtual size: 100KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:5b:f8:6e:85:26:53:40:33:13:83:7b
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

a3:cf:f7:20:41:87:5c:7d:6a:4c:b6:7e:50:73:69:77:8a:04:57:ca:c9:3c:97:71:47:ac:a3:04:a0:0a:70:28
Signer

.text
Size: 519KB - Virtual size: 518KB

.rdata
Size: 96KB - Virtual size: 95KB

.data
Size: 19KB - Virtual size: 33KB

.rsrc
Size: 10.5MB - Virtual size: 10.5MB

.reloc
Size: 63KB - Virtual size: 63KB

.text
Size: 988KB - Virtual size: 988KB

.rdata
Size: 249KB - Virtual size: 252KB

.data
Size: 56KB - Virtual size: 60KB

.rsrc
Size: 35KB - Virtual size: 36KB

.reloc
Size: 127KB - Virtual size: 128KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

02:48:80:7b:7b:ab:9c:14:bf:d4:26:00:49:75:36:66
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

43:a7:59:ea:50:de:2e:ac:76:e4:b6:37:12:59:09:c9:ba:e8:fc:a7:c0:ee:dd:54:1c:16:2b:07:06:4c:65:94
Signer

.text
Size: 711KB - Virtual size: 711KB

.rdata
Size: 153KB - Virtual size: 152KB

.data
Size: 24KB - Virtual size: 42KB

.rsrc
Size: 5.5MB - Virtual size: 5.5MB

.reloc
Size: 48KB - Virtual size: 48KB