7ac0c6b9db7f41a283667b9b7994a56a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

7ac0c6b9db7f41a283667b9b7994a56a_JaffaCakes118
Size

2.4MB
MD5

7ac0c6b9db7f41a283667b9b7994a56a
SHA1

7bd40c9ded32aa0a2be03f1b902136837f1c72c1
SHA256

1741be55d741c6d4cba3d685241aa1f10c05517bc6dab5392ce4b4f945ff184e
SHA512

9077548d208d544ed19894384334cdb6213f68c2674beb4e04f9af64cb66f0f80107975b47712236a4ac4411d522206976e59108ae78ad9f57afb5419976a6fa
SSDEEP

49152:yTfno1caNfe84rigelADN5VDFgdl9NOilgSozbVtBZVarBqO0xWgX:6oKuR4rigelOVFcOSof1ZVKnmr

Score

3^/10

Malware Config

Signatures

Unsigned PE 24 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WebEx/Ateditor.dll
unpack001/WebEx/UILibRes.dll
unpack001/WebEx/asaudio.dll
unpack001/WebEx/atWbxUI3.dll
unpack001/WebEx/atas32.dll
unpack001/WebEx/atasctrl.dll
unpack001/WebEx/atasnt40.dll
unpack001/WebEx/ataudio.dll
unpack001/WebEx/atinet.dll
unpack001/WebEx/atjpeg60.dll
unpack001/WebEx/atkbctl.dll
unpack001/WebEx/atmdctl.dll
unpack001/WebEx/atnetext.dll
unpack001/WebEx/atnt40k.sys
unpack001/WebEx/atpack.dll
unpack001/WebEx/atpng.dll
unpack001/WebEx/atrecply.dll
unpack001/WebEx/atres.dll
unpack001/WebEx/atrpui.dll
unpack001/WebEx/atstmget.dll
unpack001/WebEx/atwmvdrv.dll
unpack001/WebEx/edconvrt.dll
unpack001/WebEx/wmasf.dll
unpack001/WebEx/快捷方式管理器.exe

Files

7ac0c6b9db7f41a283667b9b7994a56a_JaffaCakes118
.rar
WebEx/Ateditor.dll
.dll windows:4 windows x86 arch:x86

0f3d8eb6c3a9f2759217e3aa15997315

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetStringTypeW
GetStringTypeA
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
RaiseException
GetOEMCP
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
HeapSize
ExitProcess
GetModuleHandleA
GetVersion
HeapReAlloc
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
SetStdHandle
FlushFileBuffers
MulDiv
LocalAlloc
LocalFree
lstrcmpiA
CreateSemaphoreA
ReadFile
GetCommandLineA
GlobalGetAtomNameA
FindClose
GlobalLock
GlobalUnlock
TerminateProcess
GlobalDeleteAtom
CreateThread
SetThreadPriority
GetWindowsDirectoryA
GetTempPathA
GetFileAttributesA
GetVersionExA
GetDiskFreeSpaceA
GetFileSize
GetDateFormatA
GetTimeFormatA
OutputDebugStringA
UnmapViewOfFile
SetFilePointer
SetEndOfFile
DeleteFileA
CreateFileA
CreateFileMappingA
MapViewOfFile
CloseHandle
GlobalAddAtomA
FindFirstFileA
CompareStringA
WinExec
GetSystemDefaultLangID
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetLastError
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
FreeLibrary
GetTickCount
GetModuleFileNameA
WideCharToMultiByte
lstrcatA
lstrlenA
MultiByteToWideChar
lstrcpyA
GetACP

user32

GetSysColor
SetDlgItemInt
GetDlgItemTextA
CheckRadioButton
FindWindowExA
IsRectEmpty
FrameRect
DestroyCursor
GetCapture
GetDlgCtrlID
CreateCursor
GetClassNameA
GetClipboardData
IsIconic
ChangeClipboardChain
DestroyAcceleratorTable
IsZoomed
CheckMenuItem
SetMenu
LoadAcceleratorsA
SetForegroundWindow
CreateDialogParamA
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
ModifyMenuA
EnableScrollBar
SetScrollRange
SetScrollInfo
GetWindowPlacement
SetWindowPlacement
GetClassLongA
SetClassLongA
GetSystemMenu
DeleteMenu
GetScrollRange
GetScrollPos
SetScrollPos
GetKeyState
RedrawWindow
ClientToScreen
DrawFocusRect
GetMenuState
GetPropA
DestroyMenu
WindowFromPoint
SetRectEmpty
UpdateWindow
EnableMenuItem
GetMenu
DrawMenuBar
GetClipboardViewer
SetClipboardViewer
SetActiveWindow
LoadMenuA
LoadStringA
SetDlgItemTextA
OpenClipboard
EmptyClipboard
CloseClipboard
wvsprintfA
CharNextA
InflateRect
DefWindowProcA
MessageBeep
RegisterHotKey
UnregisterHotKey
SystemParametersInfoA
IsDlgButtonChecked
GetActiveWindow
DialogBoxParamA
GetWindowTextLengthA
SetCursor
CheckDlgButton
GetClientRect
EndPaint
FillRect
BeginPaint
KillTimer
CallWindowProcA
ReleaseDC
GetDC
SetTimer
SetCapture
PtInRect
ScreenToClient
GetCursorPos
TranslateAcceleratorA
GetSubMenu
EnumWindows
ReleaseCapture
SendMessageA
GetParent
GetMenuItemCount
AppendMenuA
RegisterClipboardFormatA
TrackPopupMenu
IsClipboardFormatAvailable
GetFocus
PostMessageA
OffsetRect
LoadBitmapA
SetFocus
DestroyWindow
GetWindowTextA
SendDlgItemMessageA
IsWindowEnabled
GetWindow
IsWindowVisible
RemovePropA
DrawTextA
MessageBoxA
GetDlgItem
MapWindowPoints
GetWindowRect
GetSystemMetrics
SetWindowPos
InvalidateRect
LoadImageA
DrawIconEx
DestroyIcon
EndDialog
SetWindowTextA
SetPropA
LoadIconA
EnableWindow
ShowWindow
CreateWindowExA
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
IsWindow
MoveWindow
CopyRect
SetWindowLongA
GetWindowLongA
GetWindowDC

gdi32

SetViewportExtEx
GetViewportExtEx
SetMapMode
GetMapMode
CreateCompatibleBitmap
DPtoLP
GetObjectA
GetStockObject
CreateSolidBrush
CreateFontA
GetTextMetricsA
FillRgn
SetBkMode
GetTextExtentPoint32A
CombineRgn
CreateRectRgn
GetWindowExtEx
CreateFontIndirectA
RestoreDC
GetDeviceCaps
SetWindowOrgEx
SetViewportOrgEx
SetGraphicsMode
SaveDC
IntersectClipRect
SelectClipRgn
CreateRectRgnIndirect
StretchBlt
GetTextExtentPointA
CreateBrushIndirect
GetObjectType
SetPixel
SetWindowExtEx
GetTextColor
GetBkColor
CreateCompatibleDC
PatBlt
SetTextColor
SetBkColor
BitBlt
DeleteDC
CreateBitmap
CreatePatternBrush
Arc
CreatePen
SelectObject
MoveToEx
TextOutA
DeleteObject
LineTo

comdlg32

GetSaveFileNameA
GetOpenFileNameA

advapi32

RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA

winmm

mixerGetNumDevs
waveOutGetDevCapsA
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mixerOpen
mixerGetDevCapsA
mixerGetLineInfoA
mixerClose
waveInGetNumDevs
waveInGetDevCapsA
waveOutGetNumDevs

shell32

ShellExecuteExA
ShellExecuteA

ole32

OleInitialize
OleUninitialize

comctl32

ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_Create
ImageList_Draw
_TrackMouseEvent

Exports

Exports

WOTExitEditor
WOTInitEditor
WOTIsDialogMessage

Sections

.text
Size: 260KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/Atrcp.dll
.dll windows:4 windows x86 arch:x86

78f58eb5a4f783a6d7c1ed32ff9f6ae0

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:75:9a:ef:5b:8a:e7:ef:58:67:5a:32:c4:e8:99:e7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24/02/2006, 00:00

Not After

07/04/2009, 23:59

Subject

CN=WebEx Communications Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=WebEx Communications Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcessId
lstrlenW
WideCharToMultiByte
GetProcAddress
GetCurrentProcess
FlushInstructionCache
lstrcatA
FreeLibrary
LoadLibraryA
WinExec
GetSystemDefaultLangID
lstrlenA
lstrcpyA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetCurrentThreadId
MultiByteToWideChar
GetModuleHandleA
GetModuleFileNameA
lstrcpynA
DisableThreadLibraryCalls

user32

IsIconic
GetParent
CreateWindowExA
RegisterClassExA
LoadCursorA
GetClassInfoExA
GetSystemMetrics
GetWindow
GetPropA
GetWindowThreadProcessId
SetDlgItemTextA
MapWindowPoints
SetWindowPos
GetWindowRect
LoadStringA
LoadIconA
MoveWindow
FindWindowA
PeekMessageA
DispatchMessageA
ShowWindow
SetRectEmpty
SetTimer
KillTimer
IsWindow
RegisterWindowMessageA
DefWindowProcA
BeginPaint
EndPaint
CopyRect
InflateRect
GetScrollPos
OffsetRect
InvalidateRect
GetSysColor
FillRect
GetWindowLongA
SetWindowLongA
SendMessageA
CallWindowProcA
DestroyWindow
GetClientRect
wsprintfA
PostMessageA
SystemParametersInfoA

gdi32

SetBkMode
GetStockObject
SelectObject
GetTextExtentPoint32A
ExtTextOutA
CreateSolidBrush
LineTo
MoveToEx
CreatePen
DeleteObject
SetTextColor
CreateFontIndirectA

oleaut32

SysAllocStringLen
SysFreeString

atkbctl

KbSetFocus
KbUninstallFocusControl
KbInstallFocusControl

msvcrt

malloc
_adjust_fdiv
_initterm
_strlwr
_ftol
memset
free
??3@YAXPAX@Z
memcpy
atol
??2@YAPAXI@Z
strrchr
sscanf

Exports

Exports

ATDeleteInstance
ATNewInstance
ExitControl
InitControl
WebEx_SetControlType
WebEx_SetControlType2

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/UILibRes.dll
.dll windows:4 windows x86 arch:x86

5c54715227e960c5019e7a45d4b9d02a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/asaudio.dll
.dll windows:4 windows x86 arch:x86

d65f4a892bf740040f401267fd91eeb0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
GetTimeFormatA
CloseHandle
SetFilePointer
WriteFile
GetLastError
GetFileAttributesA
CreateDirectoryA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
GetDateFormatA

user32

wsprintfA
wvsprintfA
SetWindowLongA

msvcrt

_splitpath
_adjust_fdiv
malloc
_purecall
??2@YAPAXI@Z
__CxxFrameHandler
??3@YAXPAX@Z
_makepath
_itoa
__dllonexit
_onexit
free
_initterm

Exports

Exports

MDDeleteInstance
MDNewInstance
WOTInitPlayer
WOTInitRecorder
WOTKillPlayer
WOTKillRecorder

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atWbxUI3.dll
.dll windows:4 windows x86 arch:x86

b62282b623caba77a3d3d93bc02fe7f5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindAtomA
GetProcAddress
LoadLibraryA
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
lstrcpynA
lstrcmpA
lstrlenA
GetVersionExA
GetCurrentProcessId
lstrcpyA
IsBadWritePtr
lstrcmpiA
CompareStringA
GetLastError
GetModuleHandleA
GetTickCount
lstrcatA
IsDBCSLeadByte
lstrcpynW
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
DisableThreadLibraryCalls
EnumResourceLanguagesA
GetModuleFileNameA
GetSystemDefaultLangID
FreeLibrary
AddAtomA
DeleteAtom
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalReAlloc
GlobalFree

user32

GetScrollPos
GetClassLongA
LoadIconA
SetDlgItemTextA
EnableWindow
RedrawWindow
GetPropA
GetMenuStringA
GetMenuItemID
GetTopWindow
GetMenuItemRect
AppendMenuA
CreatePopupMenu
EnableMenuItem
IsRectEmpty
IsIconic
GetSystemMenu
DrawIconEx
PostQuitMessage
LoadStringW
SetCapture
DestroyCursor
SetRect
GetDesktopWindow
RemovePropA
SetPropA
SetParent
LoadStringA
WindowFromDC
GetWindowRgn
CreateDialogParamA
DialogBoxParamA
EndDialog
ShowWindow
SetWindowTextA
ClientToScreen
GetWindowTextLengthA
CreateCursor
EndPaint
BeginPaint
FindWindowExA
GetWindow
GetCapture
MapWindowPoints
GetSubMenu
PeekMessageA
IsMenu
RegisterWindowMessageA
GetMessagePos
GetSysColorBrush
GetKeyState
GetActiveWindow
GetWindowThreadProcessId
CharNextA
CharLowerA
GetFocus
MessageBeep
PostMessageA
DestroyMenu
InflateRect
DrawStateA
DestroyIcon
FillRect
GetClassNameA
SetWindowPos
SetRectEmpty
CallNextHookEx
SystemParametersInfoA
SetWindowsHookExA
TrackPopupMenuEx
UnhookWindowsHookEx
UpdateWindow
GetMenuItemCount
GetMenuItemInfoA
SetMenuItemInfoA
ModifyMenuA
OffsetRect
GetWindowDC
LoadImageA
LoadBitmapA
ReleaseDC
GetDlgItem
GetDC
GetSystemMetrics
ValidateRect
SetCursor
GetNextDlgTabItem
SetFocus
GetDlgCtrlID
ReleaseCapture
SendMessageA
GetCursorPos
ChildWindowFromPoint
WindowFromPoint
IsWindowVisible
IsWindowEnabled
PtInRect
DrawFocusRect
FrameRect
SetWindowRgn
GetWindowTextA
DrawTextA
GetSysColor
GetWindowRect
GetParent
ScreenToClient
InvalidateRect
DestroyWindow
CreateWindowExA
GetWindowLongA
SetWindowLongA
IsWindow
MoveWindow
CopyRect
KillTimer
CallWindowProcA
SetTimer
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
GetClientRect
DefWindowProcA
EqualRect

gdi32

GetDIBits
SetDIBitsToDevice
SetStretchBltMode
StretchDIBits
SelectClipRgn
GetDeviceCaps
CreateFontIndirectA
Rectangle
Polygon
CreatePatternBrush
CreateBitmap
StretchBlt
CreateRectRgn
CreateRoundRectRgn
GetTextColor
OffsetRgn
GetRgnBox
CombineRgn
GetTextExtentPoint32A
CreateCompatibleBitmap
RestoreDC
ExtTextOutA
ExcludeClipRect
SaveDC
CreatePolygonRgn
FillRgn
Arc
GetPixel
SetPolyFillMode
TextOutA
SetWindowExtEx
GetWindowExtEx
SetViewportExtEx
GetViewportExtEx
SetMapMode
GetMapMode
DPtoLP
ExtCreateRegion
CreateDIBSection
GetObjectType
SetBkColor
CreateCompatibleDC
BitBlt
DeleteDC
GetTextMetricsA
RoundRect
CreateSolidBrush
SetBkMode
SetTextColor
CreatePen
SelectObject
DeleteObject
MoveToEx
LineTo
GetStockObject
GetObjectA
PatBlt

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

shell32

ShellExecuteA

comctl32

ImageList_GetIconSize
ImageList_GetImageCount
ImageList_AddMasked
ImageList_DrawEx
ImageList_Add
ImageList_GetImageInfo
_TrackMouseEvent
ImageList_GetIcon
ImageList_Draw
ImageList_Create
ImageList_Destroy
InitCommonControlsEx

msvcrt

_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
_mbsrchr
_mbsnbcpy
abs
_mbscmp
memcmp
_ftol
atoi
_mbschr
memmove
realloc
malloc
free
memset
strlen
??2@YAPAXI@Z
__CxxFrameHandler
memcpy
??3@YAXPAX@Z

Exports

Exports

BitmapToRegion
DisableXPVisualStyle
DrawArrow
DrawGradientLine
DrawRoundRectBorder
ExDrawLine
GetBitmapSize
GetBmpHeight
GetBmpWidth
GetHScrollBar
GetVScrollBar
GradientRectangle
Init_UILibResourceDLL
InitializeWbxSB
Internal_DrawButton_BK
Internal_LoadUILibString
MakeToolbarImageList
UnInit_UILibResourceDLL
WbxDrawTransparentBitmap
WbxSB_InitializeApp
WbxSB_SetStyle
WbxSB_UninitializeApp
WbxSynchronizeDCMap
WbxUI_ClearMagicWindow
WbxUI_Draw3DRect
WbxUI_DrawBKBmp
WbxUI_DrawBK_UsedBmp
WbxUI_DrawHypeLinkText
WbxUI_DrawText
WbxUI_ExtractSubBitmap
WbxUI_FillSolidRect
WbxUI_GetBmpFromImgList
WbxUI_GetCharSet
WbxUI_GetFont
WbxUI_GetFontByLOGFONT
WbxUI_GetFontByPT
WbxUI_GetMagicWindowFlag
WbxUI_GetOSVersion
WbxUI_GetResourceHandle
WbxUI_GetTextHeight
WbxUI_GetTextLength
WbxUI_Initialize
WbxUI_IsMagicWindow
WbxUI_MapToGray
WbxUI_SetDefaultFont
WbxUI_SetMagicWindow
WbxUI_SetMagicWindowFlag
WbxUI_SetResourceHandle
WbxUI_Uninitialize

Sections

.text
Size: 208KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atas32.dll
.dll windows:4 windows x86 arch:x86

2be6902f6ef7585872434d13b6f1b496

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
LoadLibraryA
GetProcAddress
GetShortPathNameA
lstrcpyA
CreateFileA
GetModuleFileNameA
GetCurrentProcess
WriteConsoleOutputA
SetConsoleCursorInfo
SetConsoleCursorPosition
EnterCriticalSection
LeaveCriticalSection
FlushConsoleInputBuffer
GetNumberOfConsoleInputEvents
ReadConsoleInputA
GetStdHandle
WriteConsoleInputA
WaitForSingleObject
TerminateThread
CloseHandle
FreeConsole
CreateThread
SetThreadPriority
AllocConsole
SetConsoleTitleA
SetConsoleCtrlHandler
ResumeThread
DeviceIoControl
MulDiv
GetSystemDirectoryA
lstrcatA
GetFileAttributesA
GetVersion
WideCharToMultiByte
GetACP
MultiByteToWideChar
GetTickCount

user32

ReleaseDC
GetDC
DestroyCursor
DestroyIcon
UnionRect
GetWindowDC
GetSystemMetrics
MessageBeep
PostThreadMessageA
mouse_event
GetDoubleClickTime
keybd_event
MapVirtualKeyA
CreateCursor
CreateIconIndirect
GetMessageExtraInfo
ExitWindowsEx
RedrawWindow
IntersectRect
SetRectEmpty

gdi32

TextOutA
GetTextExtentPoint32A
SetBkMode
SetROP2
CreatePenIndirect
Rectangle
UnrealizeObject
SetBrushOrgEx
GetBkColor
GetTextColor
SelectClipRgn
SetBkColor
SetTextColor
BitBlt
FlattenPath
GetTextExtentPoint32W
PolyDraw
PolyBezierTo
CloseFigure
LineTo
CreateRectRgn
ExtTextOutW
GetDeviceCaps
Ellipse
AngleArc
MoveToEx
SetArcDirection
ArcTo
BeginPath
RoundRect
EndPath
CreateDIBPatternBrushPt
TextOutW
CreateFontIndirectA
SetTextAlign
SetTextCharacterExtra
ExtTextOutA
Polygon
CreateDIBSection
GetBitmapBits
StretchBlt
Arc
Chord
Pie
FrameRgn
GetRgnBox
ExtFloodFill
SetPolyFillMode
ExtCreatePen
StrokeAndFillPath
FillPath
StrokePath
DeleteObject
CreateBitmap
CreatePalette
CombineRgn
CreateBitmapIndirect
CreateCompatibleBitmap
GetDIBits
GetObjectA
DeleteDC
PatBlt
CreateSolidBrush
SelectObject
CreateCompatibleDC
GetPath
ExtCreateRegion
GetRegionData
RealizePalette
SelectPalette
GetStockObject
SetDIBits
CreatePatternBrush
CreateBrushIndirect
Polyline

advapi32

RegCloseKey
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA

msvcrt

_adjust_fdiv
_initterm
realloc
strncpy
_splitpath
strcpy
strcat
memmove
??2@YAPAXI@Z
??3@YAXPAX@Z
free
malloc
memcmp
abs
strlen
memcpy
memset

Exports

Exports

AppShareJpegCompressBitmap
AppShareJpegDecompressBitmap
AppShareSetMode
AppShareZipCompress
AppShareZipDecompress
GetAtas32Version
GetFunctionPoints
SetAtasctrlVersion

Sections

.text
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atasanot.exe
.exe windows:4 windows x86 arch:x86

251c884d8341c8d5c12ae387accaed16

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:75:9a:ef:5b:8a:e7:ef:58:67:5a:32:c4:e8:99:e7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24/02/2006, 00:00

Not After

07/04/2009, 23:59

Subject

CN=WebEx Communications Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=WebEx Communications Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalGetAtomNameA
GlobalDeleteAtom
GetStartupInfoA
GetCommandLineA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleHandleA
GetModuleFileNameA
GetDateFormatA
GetTimeFormatA
GetVersion
GetSystemDefaultLangID
GetVersionExA
lstrcatA
lstrlenA
MulDiv
WideCharToMultiByte
lstrcpyA
Sleep
MultiByteToWideChar

user32

HideCaret
MessageBeep
ShowCaret
SetFocus
GetAsyncKeyState
GetCursorPos
ScreenToClient
TabbedTextOutA
GetTabbedTextExtentA
TabbedTextOutW
GetTabbedTextExtentW
FillRect
PtInRect
GetFocus
PostMessageA
SetCursor
InflateRect
GetDC
ReleaseDC
RedrawWindow
InvalidateRect
UpdateWindow
SendMessageA
GetClientRect
ReleaseCapture
SetCapture
LoadCursorA
CreateCaret
SetCaretPos
DestroyCaret
SetRect
DefWindowProcA
SetWindowLongA
GetWindowLongA
CallWindowProcA
wvsprintfA
LoadBitmapA
GetDesktopWindow
DispatchMessageA
TranslateMessage
GetMessageA
FindWindowA
KillTimer
GetClassLongA
DestroyWindow
SetForegroundWindow
SetClassLongA
SetTimer
GetWindowRect
GetWindowThreadProcessId
ClientToScreen
GetKeyState
BeginPaint
EndPaint
PostQuitMessage
GetSystemMetrics
CreateWindowExA
ShowWindow
LoadIconA
IsWindow
RegisterClassA

gdi32

SetViewportExtEx
SetWindowOrgEx
SetWindowExtEx
SetBrushOrgEx
SetStretchBltMode
SetMapMode
LPtoDP
RestoreDC
DeleteObject
Rectangle
GetStockObject
SelectObject
CreatePen
SetBkMode
SelectClipRgn
SaveDC
Polyline
SetROP2
FillRgn
CreatePolygonRgn
CreateSolidBrush
LineTo
MoveToEx
Ellipse
GetObjectType
CreateDIBSection
GetObjectA
DPtoLP
GetDeviceCaps
GetTextMetricsA
CreateBitmap
PatBlt
SetBkColor
BitBlt
GetTextExtentPoint32A
CreateCompatibleDC
CreateCompatibleBitmap
SetTextColor
CreateFontIndirectA
TextOutW
DeleteDC
Polygon
CreateEllipticRgn
CombineRgn
PtInRegion
SetViewportOrgEx

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_stricmp
_except_handler3
_splitpath
_makepath
strcat
fputs
fflush
wcscpy
wcslen
memmove
sqrt
abs
_ftol
strcmp
memcmp
strlen
strcpy
memcpy
free
malloc
memset
??2@YAPAXI@Z
??3@YAXPAX@Z

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WebEx/atasctrl.dll
.dll windows:4 windows x86 arch:x86

c59e0cd4ab4440b63ed00bfd880ba53f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileSize
CreateFileMappingA
HeapDestroy
DisableThreadLibraryCalls
lstrlenW
GetCommandLineA
WaitForSingleObject
GetExitCodeThread
DeleteCriticalSection
InitializeCriticalSection
GetTempPathA
GetTempFileNameA
SetFilePointer
WriteFile
FlushFileBuffers
ReadFile
GlobalFree
LockResource
IsBadWritePtr
FindFirstFileA
FindClose
GlobalDeleteAtom
OpenProcess
LoadLibraryA
TerminateProcess
FindNextFileA
MapViewOfFile
UnmapViewOfFile
GlobalAlloc
GlobalLock
GlobalUnlock
ExpandEnvironmentStringsA
AddAtomA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetExitCodeProcess
IsBadReadPtr
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateThread
ResumeThread
GetCurrentProcessId
GetAtomNameA
DeleteAtom
GetTickCount
lstrcmpiA
GetACP
CreateProcessA
GlobalAddAtomA
GetWindowsDirectoryA
OpenFileMappingA
GetSystemDirectoryA
CreateFileA
GetSystemDefaultLangID
lstrcatA
MulDiv
WideCharToMultiByte
Sleep
MultiByteToWideChar
GetVersion
OutputDebugStringA
GetVersionExA
GetDateFormatA
GetTimeFormatA
GetLocalTime
GetPrivateProfileIntA
GetPrivateProfileStringA
DeleteFileA
GetProcAddress
GetModuleFileNameA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetModuleHandleA
GetCurrentProcess
FlushInstructionCache
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
SetLastError
CreateMutexA
GetLastError
lstrlenA
lstrcpyA
ReleaseMutex
CloseHandle
FreeLibrary

user32

CheckMenuRadioItem
DialogBoxParamA
ScrollWindowEx
GetMessageExtraInfo
ScrollDC
ShowScrollBar
SetScrollInfo
GetScrollInfo
DrawFocusRect
GetSysColorBrush
SetDlgItemTextA
EnableWindow
CheckDlgButton
GetDlgItem
IsDlgButtonChecked
SetMenu
LoadImageA
DispatchMessageA
TranslateMessage
IsDialogMessageA
ChangeClipboardChain
SetClipboardViewer
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
DestroyMenu
IsZoomed
AdjustWindowRect
SetRectEmpty
SubtractRect
GetCapture
GetKeyState
FlashWindow
DrawTextA
RegisterClassA
GetParent
mouse_event
ChildWindowFromPointEx
FindWindowExA
IsRectEmpty
IntersectRect
EqualRect
UnregisterClassA
CreateDialogParamA
GetLastActivePopup
IsWindowEnabled
GetSubMenu
GetWindowTextA
OpenClipboard
EmptyClipboard
GetWindowDC
CloseClipboard
GetWindow
GetWindowTextLengthA
SystemParametersInfoA
CharNextA
WaitForInputIdle
EnumChildWindows
IsIconic
GetForegroundWindow
BringWindowToTop
PostThreadMessageA
EnumThreadWindows
GetClassNameA
GetWindowThreadProcessId
EnumDisplaySettingsA
PeekMessageA
TrackPopupMenu
keybd_event
GetClassLongA
DestroyIcon
FindWindowA
SetRect
DestroyCaret
CreateCaret
SetCaretPos
GetFocus
HideCaret
ShowCaret
GetAsyncKeyState
TabbedTextOutA
GetTabbedTextExtentA
TabbedTextOutW
GetTabbedTextExtentW
PtInRect
InflateRect
RedrawWindow
UpdateWindow
SetTimer
LoadIconA
DrawIconEx
KillTimer
EndDialog
SetForegroundWindow
SetActiveWindow
CopyRect
SendDlgItemMessageA
SetWindowPos
GetDC
ReleaseDC
GetMenuItemCount
GetMenuItemInfoA
InvalidateRgn
GetSysColor
CreatePopupMenu
AppendMenuA
SetClipboardData
CheckMenuItem
RemovePropA
GetPropA
SetPropA
GetDesktopWindow
LoadBitmapA
LoadMenuA
LoadStringA
GetSystemMetrics
GetClientRect
InvalidateRect
IsWindow
EndPaint
FillRect
BeginPaint
CallWindowProcA
SetFocus
PostMessageA
MoveWindow
GetScrollRange
GetScrollPos
SetScrollPos
DestroyWindow
DefWindowProcA
ShowWindow
ClientToScreen
GetCursorPos
SetCapture
OffsetRect
GetWindowRect
ReleaseCapture
IsWindowVisible
GetClipboardOwner
MapVirtualKeyA
GetClipboardData
GetActiveWindow
MessageBoxA
wvsprintfA
ScreenToClient
DeferWindowPos
EndDeferWindowPos
BeginDeferWindowPos
MessageBeep
GetClassInfoExA
wsprintfA
RegisterClassExA
CreateWindowExA
GetWindowLongA
SetWindowLongA
ChangeDisplaySettingsA
SendMessageA
SetClassLongA
SetCursor
LoadCursorA
SendMessageTimeoutA
GetMenu
EnableMenuItem
DrawMenuBar
EnumWindows

gdi32

GetClipBox
ExtTextOutW
GetTextExtentPointA
TextOutA
IntersectClipRect
GetRgnBox
ExtSelectClipRgn
SetRectRgn
CreateRectRgn
EnumFontFamiliesA
GetObjectType
DPtoLP
GetTextMetricsA
CreateBitmap
PatBlt
SetBkColor
GetStockObject
CreateCompatibleBitmap
SetTextColor
CreateFontIndirectA
TextOutW
Polygon
CreateEllipticRgn
CombineRgn
PtInRegion
Ellipse
CreatePolygonRgn
FillRgn
SetROP2
Polyline
SelectClipRgn
SetBkMode
Rectangle
LPtoDP
SetMapMode
SetStretchBltMode
SetBrushOrgEx
SetWindowExtEx
SetWindowOrgEx
SetViewportExtEx
SetViewportOrgEx
CreateDIBSection
GetCurrentObject
GetDIBits
GetDeviceCaps
CreateHalftonePalette
SelectPalette
RealizePalette
StretchDIBits
BitBlt
CreatePen
MoveToEx
LineTo
CreateSolidBrush
CreateCompatibleDC
SelectObject
StretchBlt
DeleteDC
GetObjectA
DeleteObject
SaveDC
ExcludeClipRect
RestoreDC
GetTextExtentPoint32A

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegCreateKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegCreateKeyA
CreateServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
StartServiceA
RegSetValueExA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHAppBarMessage
Shell_NotifyIconA
FindExecutableA
ShellExecuteExA
ExtractIconExA

imm32

ImmAssociateContext

atkbctl

KbInstallFocusControl
KbUninstallFocusControl
KbSetFocus
KbSetDialogFocus

atwbxui3

ord198
ord1059
ord1202
ord1209
ord1797
ord1256
ord1097
ord3
ord1121
ord1020
ord1042
ord1071
ord1208
ord111
ord206
ord456
ord1677
ord1395
ord1640
ord1636
ord1656
ord1681
ord94

ole32

CoCreateInstance

oleaut32

SysFreeString
SysAllocStringLen

comctl32

ord17

msvcrt

__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
free
malloc
_except_handler3
memcpy
strlen
strcpy
memset
strcmp
_makepath
_splitpath
_purecall
fopen
fclose
fflush
fprintf
ctime
_ftime
fputc
fputs
strcat
abs
strchr
sprintf
_ftol
sqrt
memmove
wcslen
wcscpy
atoi
_stricmp
strstr
strrchr
strncmp
strncpy
_strdup
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strcmpi
_strupr
_strnicmp
memcmp

Exports

Exports

ATDeleteInstance
ATNewInstance
ApASEscape
ApActiveSharingApplication
ApAnnotationPrivilegeStatus
ApAnnounceNodeInfo
ApEnterAnnotation
ApEnumRunningApplications
ApFullScreen
ApGetOnlineRecordingStatus
ApGetSharingApplicationList
ApGpcExitInstance
ApGpcInitInstance
ApIsAnnotationOpen
ApIsApplicationShared
ApIsFullScreen
ApLeaveAnnotation
ApOnlineWebExRecord
ApOnlineWebExRecordStop
ApPreLeave
ApPrepareQuit
ApQuitAppLeaveRecord
ApRAGetLastActiveTick
ApRASettings
ApRemoteControlPrivilegeStatus
ApRemoteShareApplication
ApRemoveAnnotationPrivilege
ApRemoveRemoteControlPrivilege
ApSelectColorSet
ApSessionEnroll2
ApSetAnnotationPrivilegeTo
ApSetAppsharingParameter
ApSetControlTo
ApSetHost
ApSetHwndforBacktoMeeting
ApSetMeetingType
ApSetPresenter
ApSetRemoteControlPrivilegeTo
ApSetSessionCtrlInfo
ApShareApplication
ApShareProgram
ApShareShortcut
ApStartShareApplication
ApStartShareApplicationWithoutDelay
ApStopShareApplication
ApSwitchApplication
ApSwitchCmdSet
ApWOTAutoPlay
ApWOTCallWebExPlayer
ApWOTCallWebExRecorder
ApWOTSaveRecordStatus
ApWebExPlayback
ApWebExRecord
ApWebExRecordOptions
AsAdjustPrivilege
AsAssignAnnotation
AsAssignRemoteControl
AsChangeScreenResolution
AsClearAnnotation
AsEmulateKeyStrike
AsEnterAnnotation
AsGetAnnotationPalette
AsGetAnnotationTool
AsGetCurrentAnnotationColor
AsGetInternalUserList
AsGetRunningState
AsGetShareMode
AsGetUserInfo
AsInterIOControl
AsIsAnnotationMode
AsIsAnnotationObjectExist
AsIsRemoteController
AsLeaveAnnotation
AsNodeIDToUserID
AsPause
AsQuit
AsRefresh
AsRegisterServiceInfo
AsResume
AsSendControlCommand
AsSetAnnotationTool
AsSetCurrentAnnotationColor
AsSetLogoState
AsSetShareMode
AsSetViewMode
ServerSideRecordingStatus
SetARMPath
SetServerSideRecordingProvider

Sections

.text
Size: 252KB - Virtual size: 249KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atasnt40.dll
.dll windows:4 windows x86 arch:x86

39e5abba5ebff1ee6d2308e48374dd16

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExpandEnvironmentStringsA
WriteProfileStringA
GetProfileStringA
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetSystemDirectoryA
DeleteCriticalSection
GetACP
ReadFile
GlobalGetAtomNameA
InterlockedExchange
EnterCriticalSection
OutputDebugStringA
GetDateFormatA
GetTimeFormatA
Sleep
GetPrivateProfileIntA
GetPrivateProfileStringA
DeleteFileA
lstrcatA
CopyFileA
GetModuleFileNameW
lstrlenA
lstrcpyA
TryEnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
IsBadCodePtr
VirtualLock
VirtualUnlock
VirtualFree
GetProcessHeap
HeapAlloc
HeapFree
GetModuleHandleW
VirtualAlloc
SetEvent
WaitForSingleObject
CreateEventA
CreateThread
LoadLibraryA
FreeLibrary
CreateFileA
WriteFile
GetTempPathA
GetLocalTime
lstrcmpA
GetVersion
GetCurrentProcess
OpenProcess
SetPriorityClass
CloseHandle
lstrcmpiA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetProcessVersion
GetLastError
IsBadReadPtr
GetTickCount
GetCurrentThread
GetThreadPriority
GetModuleHandleA
GetVersionExA
GetProcAddress
GetCurrentThreadId
GetCurrentProcessId
SetThreadPriority
InitializeCriticalSection

user32

GetWindowLongW
SystemParametersInfoA
SetRect
WaitMessage
MsgWaitForMultipleObjects
GetThreadDesktop
OpenInputDesktop
SetThreadDesktop
CloseDesktop
InflateRect
LoadBitmapA
LoadStringA
MessageBoxA
GetIconInfo
GetWindowTextA
DrawTextA
GetPropA
wsprintfA
RegisterClassA
ChildWindowFromPointEx
SetCursorPos
GetMessageExtraInfo
LoadCursorA
RegisterClassExA
EnumDisplaySettingsA
CreateWindowExA
MoveWindow
SetWindowLongA
InvalidateRect
SetActiveWindow
BeginPaint
EndPaint
ClientToScreen
SetCapture
ClipCursor
OffsetRect
ReleaseCapture
DefWindowProcA
PostThreadMessageA
GetFocus
WindowFromPoint
EnumChildWindows
CallNextHookEx
IsWindow
CallWindowProcA
PtInRect
GetClientRect
EqualRect
GetForegroundWindow
CopyRect
IntersectRect
PeekMessageA
GetDC
wvsprintfA
SendMessageA
GetWindow
GetWindowRect
IsRectEmpty
GetWindowRgn
GetWindowDC
ReleaseDC
WindowFromDC
GetWindowLongA
GetClassNameA
GetCursor
GetSystemMetrics
GetCursorPos
UnhookWindowsHookEx
SendNotifyMessageA
DestroyWindow
EnumWindows
RedrawWindow
GetWindowThreadProcessId
FindWindowA
GetDesktopWindow
GetParent
SetWindowsHookExA
KillTimer
SetTimer
RegisterWindowMessageA
GetLastActivePopup
IsIconic
ShowWindow
IsWindowVisible
PostMessageA
SendMessageTimeoutA
UnregisterClassA
ShowCursor

gdi32

GetRgnBox
GetDCOrgEx
GetNearestColor
GetPaletteEntries
GetBitmapBits
CreateDIBSection
CreateDCA
DescribePixelFormat
GetPixelFormat
PatBlt
GetTextExtentPoint32A
SetBkMode
Rectangle
GetArcDirection
PtInRegion
GetPolyFillMode
GetPath
CreateBrushIndirect
FillRgn
GetGraphicsMode
GetTextMetricsA
GetTextMetricsW
GetTextCharacterExtra
GetTextAlign
GetTextExtentPoint32W
CreateFontIndirectA
GetCurrentPositionEx
GetBkMode
GetROP2
IntersectClipRect
SetDIBits
GetBoundsRect
SetBoundsRect
GetStretchBltMode
GetRegionData
DeleteObject
CreateRectRgn
OffsetRgn
CreateRectRgnIndirect
CombineRgn
EqualRgn
CreateSolidBrush
SetStretchBltMode
CreateCompatibleDC
BitBlt
GetDeviceCaps
GetObjectType
DeleteDC
GetBrushOrgEx
GetDIBits
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
GetViewportOrgEx
SetWindowOrgEx
GetWindowOrgEx
SetMapMode
SetBkColor
SaveDC
RestoreDC
GetCurrentObject
GetObjectA
GetMapMode
GetWindowExtEx
GetViewportExtEx
LPtoDP
DPtoLP
RectInRegion
SelectClipRgn
GetStockObject
GetSystemPaletteEntries
CreatePalette
SelectPalette
RealizePalette
CreateBitmap
CreateCompatibleBitmap
GetTextColor
SetTextColor
GetBkColor
SelectObject

advapi32

RegCreateKeyA
CreateServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
StartServiceA
RegQueryValueExA
RegSetValueExA
RegFlushKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegCloseKey
RegOpenKeyA

msvcrt

_wcsupr
memset
memcpy
memmove
strcpy
??3@YAXPAX@Z
malloc
free
strlen
sprintf
strcat
fprintf
_purecall
abs
memcmp
_makepath
_splitpath
wcsstr
fflush
fwrite
fopen
fclose
??2@YAPAXI@Z
wcslen
wcscpy
_strnicmp
strstr
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strcmpi
_wcsicmp

Exports

Exports

AppsEnterSpecialWinMode
AppsEscape
AppsFreeDLL
AppsGetSharingAppCount
AppsIsShared
AppsRecordHostedWindow
AppsRetrieveData
AppsSessionEnd
AppsSessionStart
AppsSetCollaborate
AppsTellDeviceCaps

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/ataudio.dll
.dll windows:4 windows x86 arch:x86

5f02925649795d538ae47a912dba42e2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MulDiv
GetSystemDefaultLangID
InterlockedExchange
SetCurrentDirectoryA
lstrcpynA
InterlockedIncrement
InterlockedDecrement
FlushInstructionCache
GetCurrentProcess
FindResourceA
LocalAlloc
UnmapViewOfFile
OpenFileMappingA
MapViewOfFile
CreateFileMappingA
ResetEvent
SetEvent
CreateEventA
GetVersion
LocalFree
GetCurrentThread
SetThreadPriority
WaitForSingleObject
GetExitCodeThread
TerminateThread
CloseHandle
GetLastError
GetModuleHandleA
Sleep
GetTickCount
DisableThreadLibraryCalls
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetCurrentThreadId
GetModuleFileNameA
lstrlenA
lstrcpyA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
FreeLibrary
LoadLibraryA

user32

SetTimer
DialogBoxParamA
IsChild
GetMessageA
SetActiveWindow
ShowWindow
LoadIconA
GetDesktopWindow
EndPaint
PostQuitMessage
EnableWindow
DrawTextA
GetSysColor
BeginPaint
DefWindowProcA
InvalidateRect
ReleaseDC
SetWindowRgn
GetClassInfoExA
LoadCursorA
wsprintfA
PeekMessageA
PostThreadMessageA
CreateWindowExA
SetWindowLongA
GetWindowLongA
RegisterClassExA
EndDialog
KillTimer
LoadBitmapA
TranslateMessage
SetWindowTextA
DispatchMessageA
FillRect
FrameRect
IsWindow
GetSystemMetrics
OffsetRect
GetCursorPos
GetClientRect
GetWindowRect
LoadStringA
CallWindowProcA
GetActiveWindow
DestroyWindow
GetWindow
GetDlgItem
SendMessageA
SetWindowPos
SendNotifyMessageA
WindowFromPoint
GetDC

gdi32

GetObjectA
CreateCompatibleDC
LineTo
MoveToEx
CreatePen
BitBlt
GetTextExtentPoint32A
TextOutA
CreateSolidBrush
SetTextColor
DeleteDC
SelectObject
SetBkColor
SetBkMode
GetStockObject
Rectangle
DeleteObject
CreateRoundRectRgn
CreateFontA

winmm

waveOutWrite
waveOutClose
waveOutReset
waveInOpen
waveInStart
waveOutUnprepareHeader
waveInAddBuffer
waveInClose
waveInReset
waveOutPrepareHeader
waveInPrepareHeader
waveInUnprepareHeader
mixerGetID
mmioOpenA
mmioStringToFOURCCA
mmioDescend
mmioRead
mmioClose
mmioAscend
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mixerGetDevCapsA
mixerGetLineInfoA
waveInGetNumDevs
waveInGetDevCapsA
waveOutGetNumDevs
waveOutGetDevCapsA
mixerGetNumDevs
mixerOpen
mixerClose
waveOutOpen

advapi32

RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey

atwbxui3

ord1679
ord3
ord1097
ord1059
ord1202
ord1209
ord1797
ord1256
ord1677
ord1636
ord1642
ord1407
ord1409
ord1464
ord198
ord196
ord217
ord237
ord133
ord90
ord94
ord102
ord173

dsound

ord7
ord2

msvcrt

_itoa
vsprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
memcpy
free
strcpy
strcmp
_ftol
_purecall
_beginthreadex
strstr
atoi
sprintf
_beginthread
strrchr
_endthread
strlen
malloc
log10
_initterm
_adjust_fdiv

msvcp60

??_F?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

Exports

Exports

ATCloseAudio
ATConvertWRAToPCM
ATEditSetCodecProperty
ATGetAudioDeviceInfo
ATGetCodecInfo
ATGetMapHandle
ATGetVolume
ATInitAudio
ATIsInstanceHere
ATPlay
ATPlayAdjustQueueTime
ATPlayEx
ATPlayExEx
ATPlayPause
ATPlaySetCodecProperty
ATPlayStop
ATRecPause
ATRecStart
ATRecStop
ATRecordAudioCloseSetting
ATRecordAudioRunSetting
ATRecordAudioRunSetupWizard
ATRecorderGetCodecProperty
ATRecorderGetFrameSize
ATReleaseMem
ATSetAudioNeedFlag
ATSetMapFlag

Sections

.text
Size: 132KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atauthor.exe
.exe windows:4 windows x86 arch:x86

f41df666b6daca4201a99abd2f45a1b0

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:75:9a:ef:5b:8a:e7:ef:58:67:5a:32:c4:e8:99:e7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24/02/2006, 00:00

Not After

07/04/2009, 23:59

Subject

CN=WebEx Communications Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=WebEx Communications Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpynA
DeleteFileA
MultiByteToWideChar
RemoveDirectoryA
FindClose
FindNextFileA
FindFirstFileA
CreateDirectoryA
FreeLibrary
LoadLibraryA
GetProcAddress
GlobalDeleteAtom
GlobalGetAtomNameA
CloseHandle
OpenMutexA
Sleep
GetFileAttributesA
WriteFile
CreateFileA
GetSystemDirectoryA
LockResource
SizeofResource
LoadResource
FindResourceA
AreFileApisANSI
GetFullPathNameA
GetStartupInfoA
GetModuleHandleA
GetModuleFileNameA
lstrcatA
lstrlenA
lstrcpyA
GetCommandLineA
WaitForSingleObject
lstrcmpiA

user32

DispatchMessageA
LoadStringA
wsprintfA
MessageBoxA
GetMessageA
TranslateMessage
SetWindowTextA
GetClientRect
LoadIconA
PostMessageA
KillTimer
DestroyWindow
PostQuitMessage
DefWindowProcA
SetTimer
LoadCursorA
RegisterClassA
CreateWindowExA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey

shell32

SHGetSpecialFolderLocation
SHChangeNotify
ShellExecuteExA
SHGetDesktopFolder
SHGetMalloc
SHGetPathFromIDListA

ole32

OleUninitialize
CoInitialize
CoCreateInstance
CoUninitialize
OleInitialize

shlwapi

SHDeleteKeyA

msvcrt

__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
strcmp
_splitpath
_strupr
_makepath
strcpy
strrchr
memset
strlen
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_adjust_fdiv
??2@YAPAXI@Z
strstr
??3@YAXPAX@Z
strchr

Exports

Exports

WOTAssocation

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WebEx/atinet.dll
.dll windows:4 windows x86 arch:x86

cb5373b7854032b02af4663bf975492e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
GetModuleHandleA
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
CreateSemaphoreA
CreateEventA
CloseHandle
WaitForSingleObject
SetEvent
lstrcatA
lstrcpyA
lstrcmpiA
ReleaseSemaphore
WaitForMultipleObjects
ResetEvent
SetLastError
EnterCriticalSection
LeaveCriticalSection
lstrcpynA
lstrlenA

user32

wsprintfA
RegisterWindowMessageA
IsWindow
GetWindowThreadProcessId
GetPropA
GetParent
SendMessageA

msvcrt

_adjust_fdiv
malloc
_initterm
??2@YAPAXI@Z
memcpy
??3@YAXPAX@Z
_purecall
memcmp
memset
free

Exports

Exports

_HttpAddRequestHeadersA@16
_HttpOpenRequestA@32
_HttpQueryInfoA@20
_HttpSendRequestA@20
_InternetCloseHandle@4
_InternetConnectA@32
_InternetCrack@4
_InternetEnableWinINET@0
_InternetInitialize@8
_InternetOpenA@20
_InternetQueryDataAvailable@16
_InternetReadFile@16
_InternetSetOptionA@16
_InternetSetStatusCallback@8

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atjpeg60.dll
.dll windows:4 windows x86 arch:x86

83fe5294b6e5eb78cbda216e0e5325fa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

fclose
_ftol
exit
sprintf
sscanf
fopen
memcpy
free
_initterm
_adjust_fdiv
fflush
fwrite
getenv
memset
malloc

kernel32

DisableThreadLibraryCalls
GlobalAlloc
GlobalFree
GetVersion

Exports

Exports

jpeg_calc_output_dimensions
jpeg_close_file
jpeg_consume_input
jpeg_create_compress
jpeg_create_decompress
jpeg_destroy_compress
jpeg_destroy_decompress
jpeg_file_dest
jpeg_finish_compress
jpeg_finish_decompress
jpeg_finish_output
jpeg_has_multiple_scans
jpeg_read_header
jpeg_read_scanlines
jpeg_resync_to_restart
jpeg_set_defaults
jpeg_set_marker_processor
jpeg_set_quality
jpeg_start_compress
jpeg_start_decompress
jpeg_start_output
jpeg_std_error
jpeg_stdio_dest
jpeg_write_scanlines

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 474B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atkbctl.dll
.dll windows:4 windows x86 arch:x86

7a3f89d8b6f5b7d017d6cc527c8be5c5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TlsGetValue
TlsSetValue
GetCurrentThreadId
TlsFree
TlsAlloc

user32

UnhookWindowsHookEx
MessageBeep
CallNextHookEx
SetActiveWindow
IsWindow
IsDialogMessageA
GetWindowLongA
GetParent
SetWindowsHookExA

msvcrt

_adjust_fdiv
malloc
_initterm
free
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z

Exports

Exports

KbGetFocus
KbInstallFocusControl
KbSetDialogFocus
KbSetEnvironment
KbSetFocus
KbUninstallFocusControl

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 950B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atmdctl.dll
.dll windows:4 windows x86 arch:x86

9acc17ee23088cf14d1dea78bd2e59e7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetFilePointer
CloseHandle
CreateFileA
GetTimeFormatA
GetDateFormatA
DeleteFileA
SetEndOfFile
WriteFile
GetTempPathA
ReadFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
GetLastError
GetFileAttributesA
CreateDirectoryA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
FreeLibrary
GetCurrentThreadId
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetTempFileNameA

user32

wsprintfA
wvsprintfA
PostMessageA
DestroyWindow

gdi32

GetDIBits
GetObjectA
DeleteDC
SelectObject
CreateCompatibleDC

msvcrt

strrchr
_adjust_fdiv
_initterm
_onexit
__dllonexit
??3@YAXPAX@Z
strcpy
memset
??2@YAPAXI@Z
memcpy
__CxxFrameHandler
free
abs
_itoa
strlen
strcat
_purecall
malloc
_makepath
_splitpath
sprintf

Exports

Exports

MDDeleteInstance
MDNewInstance

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atnetext.dll
.dll windows:4 windows x86 arch:x86

dd355eed42675e22ad8fcb07c46731c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
GetCurrentThreadId
VirtualProtect
VirtualQuery
FlushInstructionCache
VirtualFree
GetProcAddress
GetModuleHandleA
GetLocalTime
lstrcpyA
lstrlenA
VirtualAlloc
lstrcatA

user32

wsprintfA

advapi32

RegCloseKey
RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA

wsock32

inet_addr
ntohs

msvcrt

_adjust_fdiv
malloc
_initterm
free
_vsnprintf
isprint
memset
??3@YAXPAX@Z
memcpy
??2@YAPAXI@Z
strlen
strstr
atoi
strcpy
strcat
sprintf
abs
strchr
__dllonexit
_onexit

Exports

Exports

NSpyCalcInstructionBoundary
NSpyGetLogData
NSpyGetLogDataLength
NSpyGetVersion
NSpyIsPluginPatchEnabled
NSpySetPluginVersion
NSpySetSocketContext
NSpyStart
NSpyStop

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atnt40k.sys
.sys windows:4 windows x86 arch:x86

8dd8195d5c51322d76fc009cd5a32157

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
IofCompleteRequest
IoDeleteSymbolicLink
memmove
ProbeForWrite
PsGetVersion
IoFreeMdl
MmUnlockPages
MmUnmapLockedPages
MmMapLockedPages
MmProbeAndLockPages
IoAllocateMdl
DbgPrint
PsGetCurrentProcessId
MmGetPhysicalAddress
IoCreateDevice
ExFreePool
ExAllocatePoolWithTag
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
KeTickCount
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwClose
RtlFreeUnicodeString
ZwCreateSection
ZwCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
sprintf
IoCreateSymbolicLink
IoDeleteDevice
MmIsAddressValid
KeInitializeEvent

hal

ExReleaseFastMutex
KeGetCurrentIrql
ExAcquireFastMutex

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 962B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atpack.dll
.dll windows:4 windows x86 arch:x86

7c83bc45b3cb6a6882f5e88a7c2d5f54

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_setjmp3
longjmp
malloc
free
fprintf
_iob
_errno
memmove
_pctype
__mb_cur_max
_isctype
_initterm
_adjust_fdiv

Exports

Exports

Compress
Decompress
strlwr

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atpng.dll
.dll windows:4 windows x86 arch:x86

ac32296004c20b034b182bde907ea93d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
GetFileSize
CreateFileA
CloseHandle

gdi32

CreateCompatibleDC
BitBlt
DeleteObject
SelectObject
DeleteDC
CreateDIBSection

msvcrt

_iob
_adjust_fdiv
_initterm
__CxxFrameHandler
??3@YAXPAX@Z
free
malloc
memcpy
memset
_ftol
strncpy
floor
_CxxThrowException
strcpy
fclose
fopen
_purecall
fread
fwrite
fseek
ftell
fflush
fputc
getc
calloc
abs
longjmp
strcmp
??2@YAPAXI@Z
_setjmp3
__CxxLongjmpUnwind
sin
cos
acos
strlen
realloc
abort
sprintf
memcmp
fabs
pow
fprintf
strtod
??1type_info@@UAE@XZ

Exports

Exports

ConverBmpToPng
IsPngTransparent
Png12Draw

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atrecply.dll
.dll windows:4 windows x86 arch:x86

721a13d693acfc654429af9a7f60c1dd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
FlushFileBuffers
FormatMessageA
MoveFileA
ReleaseMutex
WaitForSingleObject
GetLocalTime
FindFirstFileA
FindClose
SetFileAttributesA
TerminateThread
GetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetProcAddress
GetDiskFreeSpaceA
GetAtomNameA
DeleteAtom
AddAtomA
CreateThread
GetTickCount
GetDateFormatA
GetTimeFormatA
OutputDebugStringA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetCurrentThreadId
OpenMutexA
CreateMutexA
GetModuleFileNameA
lstrcpynA
lstrcatA
LoadLibraryA
FreeLibrary
GetVersionExA
WriteFile
CreateFileMappingA
lstrcpyA
lstrlenA
DeleteFileA
CopyFileA
GetTempFileNameA
LocalAlloc
LocalFree
CreateFileA
ReadFile
CloseHandle
GetLastError
GetTempPathA
GlobalAlloc
GlobalLock
GlobalUnlock
GetFileSize
MapViewOfFile
UnmapViewOfFile
SetFilePointer
SetEndOfFile

user32

SetWindowPos
EnableWindow
WindowFromDC
GetWindowDC
SetFocus
UnregisterHotKey
MessageBeep
IsWindowVisible
ShowWindow
IsIconic
SetForegroundWindow
FindWindowA
PostMessageA
wvsprintfA
RegisterClassA
CreateWindowExA
CallWindowProcA
SetWindowLongA
GetParent
InflateRect
ReleaseDC
GetDC
MessageBoxA
SendMessageA
SetActiveWindow
SetCapture
IsWindowEnabled
KillTimer
SetTimer
RedrawWindow
InvalidateRect
UpdateWindow
EndPaint
BeginPaint
MapWindowPoints
ScreenToClient
GetClientRect
GetWindowLongA
DefWindowProcA
PtInRect
DrawTextA
GetCursorPos
GetKeyState
ReleaseCapture
FillRect
GetSystemMetrics
SetCursor
CopyRect
SetRectEmpty
DestroyWindow
LoadMenuA
LoadCursorA
LoadBitmapA
LoadStringA
IsWindow
wsprintfA
IsClipboardFormatAvailable
GetClipboardData
RegisterClipboardFormatA
GetActiveWindow
OpenClipboard
SetClipboardData
CloseClipboard
RegisterHotKey

gdi32

SetBrushOrgEx
StretchBlt
IntersectClipRect
SaveDC
RestoreDC
CreateRectRgn
GetObjectType
GetClipRgn
SelectClipRgn
SetBkMode
SetStretchBltMode
Polygon
CreateFontA
CreateSolidBrush
DeleteObject
LineTo
MoveToEx
SelectObject
CreatePen
Arc
CreatePatternBrush
CreateBitmap
DeleteDC
BitBlt
SetBkColor
SetTextColor
PatBlt
CreateCompatibleDC
GetBkColor
GetTextColor
SetWindowExtEx
GetWindowExtEx
SetViewportExtEx
GetViewportExtEx
SetMapMode
GetMapMode
CreateCompatibleBitmap
DPtoLP
CreateDIBitmap
GetCurrentObject
GetObjectA
CreatePalette
CreateDIBSection
RealizePalette
SelectPalette
CreateHalftonePalette
StretchDIBits
GetDeviceCaps
GetDIBits
SetViewportOrgEx
GetStockObject
SetPixel

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegCloseKey

comdlg32

GetSaveFileNameA
GetOpenFileNameA

ole32

OleInitialize

comctl32

ImageList_Draw
ImageList_GetIconSize

msvcrt

_strcmpi
abs
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
memcpy
memmove
strcat
_except_handler3
strcpy
strncpy
strrchr
strlen
_local_unwind2
realloc
free
memcmp
strstr
tolower
_ftol
_strupr
_makepath
_splitpath
fwrite
fclose
fopen
fread
ftell
fseek
strcmp
fprintf
sprintf
sscanf
__CxxFrameHandler
__dllonexit
_onexit
_initterm
_adjust_fdiv
_stricmp
malloc

Exports

Exports

WOTInitPlayer
WOTInitRecorder
WOTKillPlayer
WOTKillRecorder

Sections

.text
Size: 320KB - Virtual size: 319KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atres.dll
.dll windows:4 windows x86 arch:x86

e07e00e45407ff0dd6abc9eaa981fa7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_initterm
malloc
_adjust_fdiv
free

Sections

.text
Size: 4KB - Virtual size: 340B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 138B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atrpui.dll
.dll windows:4 windows x86 arch:x86

bb1b74d06454f114672556ae5221a749

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MulDiv
LocalAlloc
LocalFree
GetCurrentDirectoryA
GetFileAttributesA
CreateDirectoryA
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
HeapDestroy
GlobalGetAtomNameA
GlobalDeleteAtom
GetSystemDefaultLangID
lstrcmpiA
CompareStringA
WinExec
FindFirstFileA
FindClose
GetExitCodeProcess
TerminateProcess
CreateFileA
GetFileSize
CloseHandle
GetModuleFileNameA
lstrcpynA
lstrcatA
lstrlenA
lstrcpyA
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
GetTickCount
FreeLibrary

user32

FindWindowA
DeleteMenu
SetPropA
EndDialog
MessageBoxA
RegisterClassA
DrawIconEx
GetDesktopWindow
ModifyMenuA
SetClassLongA
GetSysColorBrush
SetFocus
IsDlgButtonChecked
LoadIconA
SetDlgItemTextA
SendDlgItemMessageA
GetWindow
SystemParametersInfoA
GetDlgItemTextA
SetParent
SetWindowTextA
BringWindowToTop
LoadMenuA
LoadStringA
FrameRect
GetSystemMetrics
OffsetRect
GetWindowRect
PostMessageA
DestroyWindow
WindowFromPoint
GetSysColor
SetWindowPos
IsWindowVisible
GetWindowTextLengthA
IsRectEmpty
GetDlgItem
EnableWindow
FindWindowExA
RemovePropA
DrawTextA
IsWindowEnabled
GetKeyState
MapWindowPoints
RedrawWindow
InvalidateRect
UpdateWindow
SetRectEmpty
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
IsWindow
MoveWindow
CopyRect
CreateWindowExA
SetWindowLongA
GetWindowLongA
GetParent
SendMessageA
ReleaseCapture
GetCursorPos
ScreenToClient
PtInRect
SetCapture
SetTimer
GetDC
CharNextA
GetDlgCtrlID
GetCapture
GetMenuState
CheckDlgButton
CheckMenuItem
DestroyCursor
GetWindowTextA
GetActiveWindow
IsIconic
SetForegroundWindow
MessageBeep
SetMenu
UnregisterClassA
wvsprintfA
GetFocus
DrawFocusRect
GetClassNameA
LoadBitmapA
CreateCursor
ReleaseDC
CallWindowProcA
KillTimer
BeginPaint
IsMenu
DestroyMenu
GetMenuItemCount
GetMenuItemInfoA
SetMenuItemInfoA
EnableMenuItem
GetSubMenu
DestroyIcon
LoadImageA
ShowWindow
InflateRect
DefWindowProcA
GetClientRect
EndPaint
FillRect
SetCursor

gdi32

SetViewportExtEx
GetViewportExtEx
SetMapMode
GetMapMode
CreateCompatibleBitmap
DPtoLP
GetObjectA
GetStockObject
CreateFontA
GetObjectType
GetWindowExtEx
SetPixel
SetBkMode
GetTextExtentPoint32A
CreateBrushIndirect
TextOutA
SetWindowExtEx
GetTextColor
GetBkColor
CreateCompatibleDC
PatBlt
SetTextColor
SetBkColor
DeleteDC
BitBlt
CreateBitmap
CreatePatternBrush
Arc
CreatePen
SelectObject
MoveToEx
LineTo
CreateSolidBrush
CreateRectRgn
CombineRgn
FillRgn
LPtoDP
Ellipse
GetTextMetricsA
CreateFontIndirectA
DeleteObject

advapi32

RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegCloseKey

winmm

waveOutGetDevCapsA
waveOutGetNumDevs
waveInGetDevCapsA
waveInGetNumDevs
mixerClose
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerSetControlDetails
mixerGetControlDetailsA
mixerGetLineControlsA
mixerGetNumDevs

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteExA
ShellExecuteA
SHBrowseForFolderA

comctl32

_TrackMouseEvent

atwbxui3

ord189
ord32
ord158
ord230
ord1683
ord90
ord181
ord241
ord196
ord198
ord94
ord78
ord1059
ord1202
ord1209
ord1797
ord1256
ord1097
ord3
ord1121
ord1020
ord206
ord111
ord456
ord500
ord1042
ord1071
ord1208
ord1681
ord1520
ord1391
ord1421
ord1550
ord1301
ord1677
ord1636
ord113
ord207

atkbctl

KbInstallFocusControl
KbUninstallFocusControl
KbSetFocus
KbSetDialogFocus

msvcrt

_initterm
??3@YAXPAX@Z
??2@YAPAXI@Z
strrchr
strstr
tolower
sprintf
_itoa
strchr
_makepath
_splitpath
free
malloc
_strlwr
_strnset
atoi
_ftol
strncat
__dllonexit
_onexit
_adjust_fdiv

Exports

Exports

CleanRecorderPanel
InitOnlinePlayerConsole
InitPlayerPanel
InitRecorderConsole
InitRecorderPanel
KillOnlinePlayerConsole
KillPlayerPanel
KillRecorderConsole
KillRecorderPanel

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atstmget.dll
.dll windows:4 windows x86 arch:x86

b9db8be23153c53f3454f4b551d9defb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

atinet

_InternetEnableWinINET@0
_HttpOpenRequestA@32
_HttpSendRequestA@20
_HttpQueryInfoA@20
_InternetReadFile@16
_InternetQueryDataAvailable@16
_InternetOpenA@20
_InternetConnectA@32
_InternetCloseHandle@4

kernel32

DisableThreadLibraryCalls
GetModuleHandleA
GetProcAddress
lstrcpyA
WaitForSingleObject
CloseHandle
GetLastError
lstrcmpiA
lstrlenA
OutputDebugStringA

user32

PostThreadMessageA

msvcrt

__CxxFrameHandler
memmove
free
_initterm
malloc
_adjust_fdiv
strstr
_beginthreadex
_purecall
_strlwr
??2@YAPAXI@Z
sprintf
memset
??3@YAXPAX@Z
memcpy
strlen
strcpy

Exports

Exports

ATInitStreamGet
ATShutdownStreamGet
ATStreamGet
GpcExitInstance
GpcInitInstance

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 526B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/atwmvdrv.dll
.dll windows:4 windows x86 arch:x86

ce88f5c8c8a3a7ccbff27f45f1fa7a02

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
GetCurrentThreadId
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteFileA
GetDateFormatA
lstrlenA
MulDiv
ReadFile
GetFileSize
GetFileType
GetTimeFormatA
GetLastError
CreateFileA
CloseHandle
SetFilePointer
WriteFile
GetFileAttributesA
CreateDirectoryA
MultiByteToWideChar
lstrcpynA

user32

PeekMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
wvsprintfA
wsprintfA

wmvcore

WMCreateWriter
WMCreateProfileManager

ole32

CoUninitialize
CoInitialize

msvcrt

free
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
swprintf
wcscmp
??2@YAPAXI@Z
strlen
memcmp
memset
memcpy
strrchr
strcat
_itoa
_purecall
_makepath
_splitpath
strcpy
__CxxFrameHandler
time
wcscpy
wcslen

Exports

Exports

MDDeleteInstance
MDNewInstance

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/audio.gsm
WebEx/edconvrt.dll
.dll windows:4 windows x86 arch:x86

c163363d2c2b8845fb121941bbb2aefc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetStdHandle
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
HeapSize
TerminateProcess
ExitProcess
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
GetModuleHandleA
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
HeapAlloc
GetVersion
GetCommandLineA
InterlockedIncrement
FlushFileBuffers
GetFileSize
GetVersionExA
GetDiskFreeSpaceA
GetAtomNameA
DeleteAtom
GetTickCount
AddAtomA
CreateThread
GetDateFormatA
GetTimeFormatA
OutputDebugStringA
UnmapViewOfFile
SetFilePointer
SetEndOfFile
CreateFileMappingA
MapViewOfFile
lstrcmpiA
lstrcmpA
GetSystemDefaultLCID
GetCurrentProcess
FlushInstructionCache
GetFileAttributesA
CreateDirectoryA
CreateFileA
CloseHandle
DeleteFileA
lstrcpynA
LoadLibraryA
GetProcAddress
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
lstrcatA
lstrlenA
lstrcpyA
lstrlenW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
InterlockedDecrement
HeapFree
RtlUnwind
WriteFile
GetLastError
GetCurrentThreadId
DisableThreadLibraryCalls
GetCPInfo

user32

GetParent
InflateRect
DestroyWindow
wvsprintfA
EndDialog
GetDlgItem
EnableWindow
SetWindowTextA
SetFocus
GetWindowTextLengthA
GetWindowRect
MoveWindow
GetWindowTextA
CallWindowProcA
DefWindowProcA
SendMessageA
SetCapture
SetTimer
PtInRect
DrawTextA
IsWindowEnabled
GetWindowLongA
ScreenToClient
GetCursorPos
CharNextA
KillTimer
ReleaseCapture
GetKeyState
MapWindowPoints
GetClientRect
FillRect
RedrawWindow
EndPaint
BeginPaint
InvalidateRect
UpdateWindow
CopyRect
SetRectEmpty
GetDC
ReleaseDC
wsprintfA
LoadMenuA
LoadCursorA
LoadBitmapA
LoadStringA
SetWindowLongA
DialogBoxParamA
CreateDialogParamA
CreateWindowExA
ShowWindow
MessageBoxA
IsWindow

gdi32

CreateBrushIndirect
SetBkMode
SetPixel
GetStockObject
CreateSolidBrush
GetObjectType
GetObjectA
CreateFontA
GetCurrentObject
GetDIBits
GetDeviceCaps
StretchDIBits
CreateHalftonePalette
SelectPalette
RealizePalette
CreateDIBSection
DPtoLP
CreateCompatibleBitmap
GetMapMode
SetMapMode
GetViewportExtEx
SetViewportExtEx
GetWindowExtEx
SetWindowExtEx
GetTextColor
GetBkColor
CreateCompatibleDC
PatBlt
SetTextColor
BitBlt
DeleteDC
CreateBitmap
CreatePatternBrush
Arc
CreatePen
SelectObject
MoveToEx
LineTo
DeleteObject
SetBkColor

advapi32

RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA

wmvcore

WMCreateProfileManager

ole32

CoCreateInstance

oleaut32

SysAllocString
LoadTypeLi
RegisterTypeLi
SysFreeString

comctl32

ImageList_GetIconSize
ImageList_Draw

Exports

Exports

ATDeleteInstance
ATNewInstance
ATPrepare
ATSetInPutFile
ATSetOutPutFile
ATSetParent
AtRun

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/wmasf.dll
.dll windows:5 windows x86 arch:x86

7f54fbd6c699bd468624d69053eae4cb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
GetProcAddress
GetCurrentProcess
TerminateProcess
Sleep
CloseHandle
GetLastError
WriteFile
FlushFileBuffers
WideCharToMultiByte
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapAlloc
GetProcessHeap
HeapFree
MultiByteToWideChar
MulDiv
InitializeCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime

msvcrt

_purecall
malloc
_adjust_fdiv
_initterm
free
_wcsicmp
wcscmp
wcscpy
wcslen
memmove
??2@YAPAXI@Z
??3@YAXPAX@Z

ole32

CoCreateGuid

Exports

Exports

ASFAddPresDelta
ASFAddSendDelta
ASFCalculatePresDelta
ASFCreateBitrateTracker
ASFCreateIOMonitor
ASFCreateIndexMaker
ASFCreateIndexMakerFileSink
ASFCreateLibrary
ASFCreateMediaObjectIndexMaker
ASFCreateStreamSelector
ASFFindHeaderObject
ASFFindRootObject
ASFFindStreamPropertiesObject
ASFGUIDFromCodecID
ASFGUIDToCodecID
ASFGetDataUnitInfo
ASFGetHeaderObject
ASFGetRootObject
ASFGetStreamPropertiesObject
ASFGetTimeBase
ASFPresDeltaTimeToTime
ASFPresDeltaToFull
ASFPresFullToDelta
ASFPresTimeToSendTime
ASFPresTimeToTime
ASFReadHeaderFromFile
ASFReadHeaderFromFileHandle
ASFSendTimeToPresTime
ASFSendTimeToTime
ASFSetDataUnitInfo
ASFTimeToPresDeltaTime
ASFTimeToPresTime
ASFTimeToSendTime
ASFWriteHeaderToFile
CreateAsfCellPoolAllocator

Sections

.text
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebEx/wmvcore.dll
.dll regsvr32 windows:5 windows x86 arch:x86

6f3c714b8cb3ad114b9e28d99535c21e

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:07:11:43:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/05/2002, 00:55

Not After

25/11/2003, 01:05

Subject

CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
FreeResource
CloseHandle
WriteFile
SleepEx
OpenProcess
GetExitCodeProcess
GetVersion
HeapSize
RaiseException
FlushInstructionCache
DuplicateHandle
SizeofResource
LockResource
LoadResource
TerminateProcess
GetCurrentProcess
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
InterlockedCompareExchange
InterlockedIncrement
HeapAlloc
GetProcessHeap
HeapFree
GetLastError
InterlockedDecrement
ReadFile
GetFileType
InitializeCriticalSection
SetEvent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SystemTimeToFileTime
GetSystemTime
WaitForSingleObject
GetFileSize
ReleaseSemaphore
MultiByteToWideChar
IsBadReadPtr
SetFilePointer
WideCharToMultiByte
lstrlenA
CompareFileTime
Sleep
FreeLibrary
InterlockedExchange
WaitForMultipleObjects
ResetEvent
MulDiv
VirtualFree
VirtualAlloc
GlobalMemoryStatus
ReleaseMutex
WaitForSingleObjectEx
GlobalLock
GlobalAlloc
GetSystemDefaultLangID
GetUserDefaultLCID
IsBadWritePtr
FileTimeToSystemTime
GetFileTime
SetEndOfFile
CreateSemaphoreA
SetThreadPriority
GetThreadPriority
GetCurrentThread
GetExitCodeThread
CreateThread
GetComputerNameA
GetDiskFreeSpaceA
GetLocalTime
DeviceIoControl
LoadLibraryA
GetModuleHandleW
GetVersionExA
GetSystemInfo
LocalAlloc
LocalFree
SetLastError
GetVersionExW
LoadLibraryW
HeapReAlloc
lstrlenW
CreateEventA
CreateEventW
CreateFileA
CreateFileW
CreateSemaphoreW
DeleteFileA
DeleteFileW
FindResourceA
FindResourceW
GetModuleFileNameA
GetModuleFileNameW
GetTempPathA
GetTempPathW
GetVolumeInformationA
GetVolumeInformationW
IsBadStringPtrA
IsBadStringPtrW
OutputDebugStringA
SetFileAttributesA
SetFileAttributesW
GetLocaleInfoA
GetLocaleInfoW
CreateMutexA
CreateMutexW
GetComputerNameW
GetSystemDirectoryA
GetSystemDirectoryW

wmasf

ASFSendTimeToTime
ASFPresTimeToTime
ord18
ASFTimeToSendTime
ASFSetDataUnitInfo
ord24
ord11
ASFTimeToPresTime
ord10
ord6
ord8
ord17
ord7
ord5
ASFGetTimeBase
ASFCreateStreamSelector
ord9

msvcrt

isalnum
_except_handler3
free
strcpy
realloc
abs
_waccess
_wcsupr
_ui64toa
strlen
srand
_beginthread
memmove
_wcslwr
longjmp
_setjmp3
sprintf
strncpy
strpbrk
memchr
wcstombs
_stricmp
_ultow
_wtol
wcsncmp
_wcsicmp
_set_error_mode
_purecall
wcscmp
wcscpy
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
_wcsnicmp
wcscat
_itoa
towupper
iswprint
_errno
strtoul
isdigit
strchr
strstr
isspace
sscanf
rand
memcpy
memcmp
memset
iswdigit
wcsncat
iswspace
_vsnwprintf
_vsnprintf
swscanf
wcstoul
wcspbrk
setlocale
_wtoi
_snwprintf
swprintf
wcstol
wcsstr
wcsncpy
_snprintf
_strnicmp
wcsrchr
wcschr
_itow
__CxxFrameHandler
_ultoa
calloc
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_adjust_fdiv
_initterm
vswprintf
_CIpow
printf
strcspn
strspn
abort
exit
fprintf
_iob
getenv
ceil
toupper
isxdigit
iswcntrl
iswascii
wcsspn
wcscspn
_ltoa
isalpha
wcsftime
gmtime
wcstok
strcmp
malloc
_strcmpi
time
strncmp

advapi32

RegQueryValueExW
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
GetUserNameA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExW
GetUserNameW
RegCreateKeyExW
RegEnumKeyA
RegEnumKeyW
RegEnumValueA
RegEnumValueW
RegOpenKeyA
RegDeleteKeyA
RegDeleteKeyW
RegDeleteValueA
RegDeleteValueW
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey

user32

wsprintfA
MsgWaitForMultipleObjects
ReleaseDC
GetDC
GetDesktopWindow
DispatchMessageA
DispatchMessageW
PeekMessageA
PeekMessageW
PostThreadMessageA
PostThreadMessageW
RegisterWindowMessageA
wvsprintfW

ole32

CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateGuid
CoTaskMemAlloc
StringFromCLSID
CoCreateInstance
CLSIDFromString
CoGetTreatAsClass

oleaut32

VariantCopy
VariantInit
SysFreeString
VariantChangeType
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SysAllocStringLen
VariantTimeToSystemTime
SysStringByteLen
SysStringLen
SysAllocString
VariantClear

gdi32

GetSystemPaletteEntries

Exports

Exports

DllRegisterServer
WMCheckURLExtension
WMCheckURLScheme
WMCreateBackupRestorer
WMCreateBackupRestorerPrivate
WMCreateEditor
WMCreateIndexer
WMCreateProfileManager
WMCreateReader
WMCreateReaderPriv
WMCreateSyncReader
WMCreateSyncReaderPriv
WMCreateWriter
WMCreateWriterFileSink
WMCreateWriterNetworkSink
WMCreateWriterPriv
WMCreateWriterPushSink
WMIsAvailableOffline
WMIsContentProtected
WMValidateData

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 312KB - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WebEx/快捷方式管理器.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 536KB - Virtual size: 536KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f3d8eb6c3a9f2759217e3aa15997315

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

winmm

shell32

ole32

comctl32

Exports

Exports

Sections

.text Size: 260KB - Virtual size: 257KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 20KB - Virtual size: 28KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 16KB - Virtual size: 13KB

78f58eb5a4f783a6d7c1ed32ff9f6ae0

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

15:75:9a:ef:5b:8a:e7:ef:58:67:5a:32:c4:e8:99:e7Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

oleaut32

atkbctl

msvcrt

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 12KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 6KB

.reloc Size: 4KB - Virtual size: 1KB

5c54715227e960c5019e7a45d4b9d02a

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 2KB

d65f4a892bf740040f401267fd91eeb0

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 3KB

.text
Size: 260KB - Virtual size: 257KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 20KB - Virtual size: 28KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 16KB - Virtual size: 13KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

15:75:9a:ef:5b:8a:e7:ef:58:67:5a:32:c4:e8:99:e7
Certificate

.text
Size: 16KB - Virtual size: 12KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 6KB

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 676B

.rsrc
Size: 4KB - Virtual size: 984B

.reloc
Size: 4KB - Virtual size: 524B

.text
Size: 208KB - Virtual size: 204KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 8KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 12KB

.text
Size: 102KB - Virtual size: 101KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

15:75:9a:ef:5b:8a:e7:ef:58:67:5a:32:c4:e8:99:e7
Certificate

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 3KB