86391598a6c19d4a738a341dc3e7e071_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

86391598a6c19d4a738a341dc3e7e071_JaffaCakes118
Size

13.7MB
MD5

86391598a6c19d4a738a341dc3e7e071
SHA1

9907c5c325ea64c2183b899cddaadd9506712ee9
SHA256

22e4f72c966d77d30c53ee44964d584aefc4d7247ab5403d558ab24791bda4b8
SHA512

159fa99257c8f7fe80eb8b95cf1fd9316ab00dd04bfe8618ef8e7afe4b18a6f51af33bda31a4a471cf809e30431bebd53f28726a4f3016495bdede290cf1ce62
SSDEEP

393216:SDE7Oib6OguyYsJJDXB8w41SBHA73ULsJ9cCGciSpc:SQ7OwB2TVXfQqAwL09Yj

Score

1^/10

Malware Config

Signatures

Files

86391598a6c19d4a738a341dc3e7e071_JaffaCakes118
.zip
CCleaner.exe
.exe windows:5 windows x86 arch:x86

f96c3bb7ea085c244eee821f185a6bad

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:3c:45:5a:5c:7b:7b:26:66:91:5e:b2:18:57:d7:ea
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20-09-2017 00:00

Not After

11-10-2018 23:59

Subject

CN=Piriform Ltd,O=Piriform Ltd,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:b6:a8:14:74:e8:04:89:20:f1:90:9e:45:4d:7f:c0
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

20-09-2017 00:00

Not After

11-10-2018 23:59

Subject

CN=Piriform Ltd,O=Piriform Ltd,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04-01-2017 00:00

Not After

18-01-2028 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bb:dd:fc:fc:87:fe:ae:fc:f6:ec:81:53:20:86:53:cc:53:2f:39:6b:08:d4:dc:a7:ae:79:01:26:b4:1b:d0:8c
Signer

Actual PE Digest

bb:dd:fc:fc:87:fe:ae:fc:f6:ec:81:53:20:86:53:cc:53:2f:39:6b:08:d4:dc:a7:ae:79:01:26:b4:1b:d0:8c

Digest Algorithm

sha256

PE Digest Matches

true

49:e5:d8:97:cb:2c:90:00:22:50:31:c6:7f:ac:18:d6:49:6d:35:72
Signer

Actual PE Digest

49:e5:d8:97:cb:2c:90:00:22:50:31:c6:7f:ac:18:d6:49:6d:35:72

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BUILD\work\00\d579b6d7712aabd3\bin\CCleaner\Release\CCleaner.pdb

Imports

rpcrt4

UuidToStringW
UuidFromStringA
RpcStringFreeW
UuidCreate
UuidFromStringW

kernel32

GetShortPathNameW
FileTimeToLocalFileTime
GetPrivateProfileIntW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetUserDefaultLangID
lstrcpyW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
SetFileAttributesW
GetTempPathW
GetTempFileNameW
IsBadStringPtrW
GetTickCount
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
LoadLibraryA
MoveFileExW
SetProcessWorkingSetSize
GetFileSizeEx
GetModuleHandleA
QueueUserWorkItem
FlushViewOfFile
CreateFileMappingA
GetComputerNameW
CopyFileW
LocalLock
LocalUnlock
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
GlobalMemoryStatusEx
GetSystemTimes
ReadFile
GetFileSize
CompareFileTime
QueryDepthSList
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
CreateTimerQueue
GetExitCodeThread
WritePrivateProfileStringW
FindNextFileW
GetFullPathNameW
lstrcmpA
BackupSeek
BackupRead
GetCompressedFileSizeW
LocalAlloc
SystemTimeToFileTime
GetLocalTime
GetVersion
GetPrivateProfileStringW
DeleteFileW
LocalFree
FormatMessageW
SetCurrentDirectoryW
GetCurrentDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
GetCommandLineW
FreeLibrary
WriteFile
FlushFileBuffers
GetFileAttributesW
CreateMutexW
GetProcAddress
lstrcmpiW
CompareStringW
GetVersionExW
lstrlenW
lstrcmpW
MulDiv
InterlockedIncrement
InterlockedDecrement
GlobalHandle
CreateProcessW
GetStartupInfoW
CreateDirectoryW
RemoveDirectoryW
LoadLibraryW
SetFileTime
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
GetVolumeInformationW
GetDiskFreeSpaceW
MoveFileW
FindClose
FindFirstFileW
DeviceIoControl
UnlockFile
HeapCompact
DeleteFileA
GetFileAttributesA
GetDiskFreeSpaceA
HeapValidate
GetFullPathNameA
LockFile
InterlockedCompareExchange
HeapCreate
GetThreadTimes
LocalSize
GetTempFileNameA
GetTempPathA
SetConsoleCursorPosition
GetNumberOfConsoleInputEvents
FillConsoleOutputAttribute
WriteConsoleInputW
CreateFileA
ReadConsoleInputW
FillConsoleOutputCharacterW
SetConsoleCursorInfo
GetConsoleCursorInfo
GetConsoleScreenBufferInfo
GetExitCodeProcess
UnregisterWaitEx
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
ReadDirectoryChangesW
DebugBreak
CreateHardLinkW
ConnectNamedPipe
SwitchToThread
GetNamedPipeHandleStateA
PeekNamedPipe
CreateNamedPipeW
CreateNamedPipeA
UnregisterWait
RegisterWaitForSingleObject
SetHandleInformation
CancelIo
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateSemaphoreA
TryEnterCriticalSection
GetCurrencyFormatW
CompareStringA
GlobalSize
AllocConsole
UnlockFileEx
LockFileEx
SetConsoleTextAttribute
QueryDosDeviceW
GetLogicalDriveStringsW
WTSGetActiveConsoleSessionId
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetNativeSystemInfo
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
ReadConsoleW
SetStdHandle
GetOEMCP
IsValidCodePage
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLogicalDrives
GetACP
WriteConsoleW
GetFileType
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwind
InterlockedFlushSList
UnhandledExceptionFilter
AreFileApisANSI
FormatMessageA
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjectsEx
WaitForSingleObjectEx
OpenEventA
GetCPInfo
GetStringTypeW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
OutputDebugStringW
IsDebuggerPresent
LoadLibraryExA
VirtualProtect
OutputDebugStringA
GetModuleFileNameA
GetFileInformationByHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
GetLocaleInfoW
VerifyVersionInfoW
VerSetConditionMask
GlobalMemoryStatus
GetVersionExA
WaitNamedPipeW
TransactNamedPipe
DuplicateHandle
WaitForMultipleObjects
SetNamedPipeHandleState
SetUnhandledExceptionFilter
VirtualQueryEx
CreateSemaphoreW
CreateThread
TerminateThread
ReleaseSemaphore
RtlCaptureContext
GetSystemTime
OpenThread
VirtualQuery
FlushInstructionCache
GetCurrentProcessId
GetThreadContext
VirtualProtectEx
GetSystemInfo
GetThreadPriority
GetCurrentThread
ResumeThread
SuspendThread
InitializeCriticalSection
SetThreadPriority
VirtualAlloc
VirtualFree
GetDiskFreeSpaceExW
GetWindowsDirectoryW
GetProcessTimes
GetCurrentProcess
FreeResource
FileTimeToSystemTime
GetLongPathNameW
GetDriveTypeW
GetSystemDirectoryW
SetErrorMode
SetFilePointer
GetModuleFileNameW
GetCurrentThreadId
SetLastError
GetModuleHandleW
WideCharToMultiByte
MultiByteToWideChar
CreateEventA
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GlobalAlloc
GlobalLock
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GlobalUnlock
GlobalFree
InterlockedExchange
CreateFileW
CreateEventW
ResetEvent
SetEvent
Sleep
GetLastError
OpenProcess
TerminateProcess
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
RaiseException
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LoadLibraryExW

user32

BeginPaint
EndPaint
GetActiveWindow
PostMessageW
EndDialog
InvalidateRect
DefWindowProcW
DrawTextW
IsWindow
SetWindowTextW
GetWindowTextW
ReleaseDC
GetDC
GetDlgCtrlID
IsZoomed
GetSystemMenu
TrackPopupMenu
SetForegroundWindow
RedrawWindow
UnregisterClassW
PtInRect
TrackMouseEvent
SystemParametersInfoW
InflateRect
LoadImageW
FillRect
IsWindowEnabled
ShowWindow
ChildWindowFromPoint
IsChild
IsWindowVisible
UpdateWindow
GetSysColor
DestroyWindow
MoveWindow
ScreenToClient
GetDlgItem
SendMessageW
SetWindowLongW
CreateDialogParamW
EnableWindow
FrameRect
RegisterWindowMessageW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
DialogBoxIndirectParamW
DestroyAcceleratorTable
CallWindowProcW
InvalidateRgn
ReleaseCapture
SetCapture
ClientToScreen
CreateAcceleratorTableW
CharNextW
GetClassNameW
SetFocus
GetFocus
GetWindowTextLengthW
MapWindowPoints
GetClientRect
GetWindowRect
SetWindowPos
GetDesktopWindow
GetWindow
GetParent
GetKeyboardLayout
WaitMessage
WinHelpW
LoadStringW
GetDialogBaseUnits
DrawIcon
MessageBeep
GetLastActivePopup
MonitorFromPoint
GetIconInfo
DestroyCursor
GetNextDlgGroupItem
GetAsyncKeyState
SendMessageTimeoutW
GetLastInputInfo
EnumDisplaySettingsW
WaitForInputIdle
ExitWindowsEx
GetWindowThreadProcessId
SetClipboardData
EmptyClipboard
GetDlgItemTextW
CharLowerA
CharLowerW
GetMenuItemID
DrawTextExW
SystemParametersInfoA
LoadBitmapW
MonitorFromWindow
GetMonitorInfoW
GetSystemMetrics
DrawFrameControl
ShowScrollBar
GetPropW
RemovePropW
GetScrollRange
SetScrollRange
EnableScrollBar
AnimateWindow
GetWindowPlacement
wsprintfW
GetForegroundWindow
GetDlgItemInt
GetNextDlgTabItem
SetDlgItemTextW
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
GetShellWindow
GetWindowInfo
SetMenuDefaultItem
LockWindowUpdate
PostQuitMessage
IsDialogMessageW
FindWindowExW
LoadIconW
GetComboBoxInfo
AdjustWindowRectEx
GetMenu
DrawEdge
SendDlgItemMessageW
MapDialogRect
DeleteMenu
SetLayeredWindowAttributes
SetWindowContextHelpId
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
SetPropW
AppendMenuW
GetScrollPos
GetClassLongW
DestroyIcon
DrawStateW
GetKeyState
GetMessagePos
InsertMenuW
SetCursorPos
DialogBoxParamW
CreatePopupMenu
MsgWaitForMultipleObjects
IsWindowUnicode
GetMessageA
DispatchMessageA
EnableMenuItem
BringWindowToTop
GetWindowDC
MessageBoxW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterClassW
GetClassInfoW
WindowFromPoint
SetRect
IsIconic
EnumWindows
FindWindowW
OpenIcon
IsDlgButtonChecked
CheckDlgButton
SetScrollPos
GetScrollInfo
GetCapture
GetCursorPos
ScrollWindowEx
SetRectEmpty
SetScrollInfo
DrawFocusRect
SetCursor
OffsetRect
UpdateLayeredWindow
CopyRect
DestroyMenu
GetSysColorBrush
SetTimer
KillTimer
EnumThreadWindows
EndDeferWindowPos
GetUpdateRect
IsRectEmpty
GetMessageTime
GetDoubleClickTime
CallMsgFilterW
BeginDeferWindowPos
SetClassLongW
NotifyWinEvent
DeferWindowPos
EnumDisplayDevicesW
EnumDisplayMonitors
DestroyCaret
CreateDialogIndirectParamW
CreateCaret
SetCaretPos
SetWinEventHook
MapVirtualKeyW
RegisterClipboardFormatW
CountClipboardFormats
EnumClipboardFormats
GetClipboardSequenceNumber
LoadCursorFromFileA
CreateIconIndirect
DrawIconEx
SetActiveWindow
GetQueueStatus
PostThreadMessageW
GetWindowLongW

gdi32

CreateFontW
CreateDCW
CreateRectRgn
GetClipRgn
BeginPath
EndPath
StrokeAndFillPath
UnrealizeObject
PolylineTo
GetCurrentObject
Ellipse
LineTo
MoveToEx
SelectClipRgn
CreatePen
Rectangle
GetBkColor
GetTextColor
CreateRectRgnIndirect
CombineRgn
ExcludeClipRect
GetTextMetricsW
GetClipBox
CreatePatternBrush
CreateBitmap
PatBlt
TextOutW
GetTextExtentPoint32W
RestoreDC
SaveDC
GetStockObject
SetDIBColorTable
CreateDIBSection
GetDIBColorTable
StretchBlt
CreateFontIndirectW
SetTextColor
ExtTextOutW
SetBkColor
GetObjectW
CreateSolidBrush
SetBkMode
GetDeviceCaps
BitBlt
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SetViewportOrgEx
SelectObject
DeleteDC
SetLayout
EndPage
StartDocW
SetMapMode
EndDoc
StartPage
AddFontMemResourceEx
GetDIBits
GetGlyphIndicesW
GetObjectA
EnumFontFamiliesExW
GetFontUnicodeRanges

comdlg32

GetOpenFileNameW
GetSaveFileNameW
PrintDlgW
CommDlgExtendedError

advapi32

OpenSCManagerW
CloseEventLog
ClearEventLogW
OpenEventLogW
LookupPrivilegeNameW
RegUnLoadKeyW
RegLoadKeyW
RegNotifyChangeKeyValue
GetUserNameW
LookupAccountNameW
CopySid
GetLengthSid
LookupAccountSidW
EqualSid
OpenThreadToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
RegEnumValueW
AccessCheck
MapGenericMask
DuplicateToken
GetFileSecurityW
SetNamedSecurityInfoW
SetEntriesInAclW
AllocateAndInitializeSid
FreeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ConvertSidToStringSidW
OpenServiceW
QueryServiceStatus
StartServiceW
CloseServiceHandle
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
DragQueryFileW
DragFinish
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
ord727
ord74
ShellExecuteExW
Shell_NotifyIconW
ExtractIconExW
ShellExecuteW
SHGetFileInfoW
SHEmptyRecycleBinW
SHAddToRecentDocs

ole32

OleLockRunning
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
OleUninitialize
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoFreeUnusedLibraries
CoCreateGuid
CoCreateInstance
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
CoTaskMemRealloc
ReleaseStgMedium
OleDuplicateData
RevokeDragDrop
RegisterDragDrop
DoDragDrop
CoSetProxyBlanket
CoInitializeEx
PropVariantClear
StgIsStorageFile
StgOpenStorageEx
CoInitializeSecurity

oleaut32

SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocStringLen
OleCreateFontIndirect
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
VariantClear
VariantInit
SysAllocString
VarUI4FromStr
VariantTimeToSystemTime
VariantChangeType
VarBstrFromI4
VarBstrFromR8
DispCallFunc
SysFreeString

shlwapi

PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathIsDirectoryW
PathCompactPathW
PathGetDriveNumberW
PathRemoveBackslashW
PathSkipRootW
PathStripToRootW
PathRemoveExtensionW
PathAddExtensionW
PathStripPathW
PathRemoveExtensionA
PathIsDirectoryEmptyW
PathCombineW
PathFindExtensionW
PathUnquoteSpacesW
PathRemoveArgsW
SHStrDupW
PathFindFileNameW
PathIsURLW
PathCreateFromUrlW
PathStripPathA
PathIsUNCW
PathIsRelativeW
ord487
StrRetToStrW
PathMatchSpecW

comctl32

_TrackMouseEvent
ImageList_Destroy
ImageList_Draw
ImageList_GetIconSize
ImageList_Duplicate
ImageList_SetIconSize
ImageList_LoadImageW
ImageList_Add
ImageList_Create
ImageList_Remove
ImageList_GetImageCount
ImageList_DrawEx
ImageList_GetIcon
ImageList_ReplaceIcon
InitCommonControlsEx

gdiplus

GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer2
GdipGraphicsClear
GdipGetPathWorldBounds
GdipClonePath
GdipSetClipRect
GdipAddPathRectangleI
GdipEndContainer
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRect
GdipTransformPoints
GdipMultiplyWorldTransform
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipScaleMatrix
GdipShearMatrix
GdipCreateTexture
GdipFillEllipse
GdipDrawEllipse
GdipFillPie
GdipDrawPie
GdipDrawArc
GdipDrawRectangle
GdipResetPath
GdipIsVisiblePathPoint
GdipStartPathFigure
GdipAddPathLine
GdipClosePathFigure
GdipSetPathFillMode
ord1
GdipAddPathBezier
GdipGetSmoothingMode
GdipTranslateWorldTransform
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipCreateFromHWND
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetFontHeightGivenDPI
GdipMeasureString
GdipDeleteFontFamily
GdipGetFamily
GdipGetCellAscent
GdipGetFontSize
GdipGetEmHeight
GdipGetCellDescent
GdipDrawString
GdipAddPathString
GdipGetFontStyle
GdipCreatePen2
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenLineJoin
GdipSetPenMiterLimit
GdipSetPenDashStyle
GdipSetPenDashArray
GdipSetPenDashOffset
GdipDeleteFont
GdipCreateFontFromDC
GdipGetLineSpacing
GdipCreateFontFromLogfontA
GdipCreateBitmapFromGraphics
GdipCreateHBITMAPFromBitmap
GdipDrawDriverString
GdipSetClipRectI
GdipFillRectanglesI
GdipDrawPath
GdipSetPathGradientTransform
GdipSetPathGradientCenterPoint
GdipSetPathGradientWrapMode
GdipSetPathGradientPresetBlend
GdipFree
GdipDisposeImage
GdipAddPathEllipse
GdipSetLineWrapMode
GdipSetLinePresetBlend
GdipCreateMatrix2
GdipMultiplyLineTransform
GdipCreateLineBrush
GdipGetClipBoundsI
GdipFillPath
GdipAddPathLineI
GdipAddPathArcI
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromStream
GdiplusShutdown
GdiplusStartup
GdipCreatePath
GdipDeletePath
GdipCreatePathGradientFromPath
GdipDeleteBrush
GdipCloneBrush
GdipCreateSolidFill
GdipFillRectangleI
GdipCreateFromHDC
GdipSetSmoothingMode
GdipCreatePen1
GdipDeletePen
GdipDrawRectangleI
GdipCreateHatchBrush
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipFillRectangle
GdipDrawLine
GdipCreateBitmapFromFile
GdipSetCompositingQuality
GdipSetPageUnit

dbghelp

MakeSureDirectoryPathExists

psapi

GetProcessImageFileNameW

urlmon

FindMimeFromData

winspool.drv

ord203

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod
timeKillEvent
PlaySoundW
timeSetEvent

ws2_32

GetAddrInfoW
WSAStartup
WSAGetLastError
getsockopt
closesocket
ioctlsocket
WSARecv
socket
FreeAddrInfoW
WSASocketW
listen
shutdown
WSASend
WSAIoctl
bind
WSARecvFrom
htons
select
WSASetLastError
setsockopt

oleacc

AccessibleObjectFromWindow
LresultFromObject

imm32

ImmNotifyIME
ImmAssociateContextEx
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmIsIME

usp10

ScriptFreeCache
ScriptApplyDigitSubstitution
ScriptItemize
ScriptBreak
ScriptShape
ScriptPlace

Exports

Exports

on_avast_dll_unload

Sections

.text
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 516KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512KB - Virtual size: 511KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CCleaner64.exe
.exe windows:5 windows x64 arch:x64

feb71b1e7523826994d70ab219118cd0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:3c:45:5a:5c:7b:7b:26:66:91:5e:b2:18:57:d7:ea
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20-09-2017 00:00

Not After

11-10-2018 23:59

Subject

CN=Piriform Ltd,O=Piriform Ltd,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:b6:a8:14:74:e8:04:89:20:f1:90:9e:45:4d:7f:c0
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

20-09-2017 00:00

Not After

11-10-2018 23:59

Subject

CN=Piriform Ltd,O=Piriform Ltd,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04-01-2017 00:00

Not After

18-01-2028 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a8:12:5d:76:11:72:96:9e:ae:1a:da:7c:07:5b:af:a9:95:b2:55:13:c8:29:a9:08:6b:71:d9:5e:d1:5e:04:06
Signer

Actual PE Digest

a8:12:5d:76:11:72:96:9e:ae:1a:da:7c:07:5b:af:a9:95:b2:55:13:c8:29:a9:08:6b:71:d9:5e:d1:5e:04:06

Digest Algorithm

sha256

PE Digest Matches

true

ad:02:bd:4e:e6:19:99:f0:b6:52:ab:ee:f0:5f:62:df:98:3d:91:62
Signer

Actual PE Digest

ad:02:bd:4e:e6:19:99:f0:b6:52:ab:ee:f0:5f:62:df:98:3d:91:62

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BUILD\work\00\d579b6d7712aabd3\bin\CCleaner\Release\CCleaner64.pdb

Imports

rpcrt4

UuidToStringW
RpcStringFreeW
UuidFromStringA
UuidCreate
UuidFromStringW

kernel32

GetPrivateProfileIntW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetUserDefaultLangID
lstrcpyW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
SetFileAttributesW
GetTempPathW
GetTempFileNameW
IsBadStringPtrW
GetTickCount
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
LoadLibraryA
MoveFileExW
SetProcessWorkingSetSize
GetFileSizeEx
GetModuleHandleA
QueueUserWorkItem
FlushViewOfFile
CreateFileMappingA
GetComputerNameW
LocalAlloc
FileTimeToLocalFileTime
LocalUnlock
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
GlobalMemoryStatusEx
GetSystemTimes
GetLongPathNameW
SetFilePointer
ReadFile
QueryDepthSList
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
CreateTimerQueue
GetExitCodeThread
GetShortPathNameW
CopyFileW
WritePrivateProfileStringW
FindNextFileW
GetFullPathNameW
lstrcmpA
LocalLock
BackupSeek
GetFileSize
CompareFileTime
SystemTimeToFileTime
GetLocalTime
GetVersion
GetPrivateProfileStringW
DeleteFileW
LocalFree
FormatMessageW
SetCurrentDirectoryW
GetCurrentDirectoryW
QueryPerformanceCounter
VirtualProtect
GetSystemDirectoryW
SetErrorMode
LoadLibraryExW
FreeLibrary
WriteFile
FlushFileBuffers
GetFileAttributesW
CreateMutexW
GetProcAddress
lstrcmpiW
CompareStringW
GetVersionExW
lstrlenW
lstrcmpW
QueryPerformanceFrequency
DecodePointer
BackupRead
GetCompressedFileSizeW
GetDriveTypeW
CreateDirectoryW
GetCommandLineW
RemoveDirectoryW
SetFileTime
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
GetVolumeInformationW
GetDiskFreeSpaceW
MoveFileW
FindClose
HeapCompact
DeleteFileA
GetFileAttributesA
GetDiskFreeSpaceA
HeapValidate
GetFullPathNameA
LockFile
HeapCreate
GetThreadTimes
LocalSize
GetTempFileNameA
GetTempPathA
SetConsoleCursorPosition
GetNumberOfConsoleInputEvents
FillConsoleOutputAttribute
WriteConsoleInputW
CreateFileA
ReadConsoleInputW
FillConsoleOutputCharacterW
SetConsoleCursorInfo
GetConsoleCursorInfo
GetConsoleScreenBufferInfo
GetExitCodeProcess
UnregisterWaitEx
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
ReadDirectoryChangesW
DebugBreak
CreateHardLinkW
ConnectNamedPipe
SwitchToThread
GetNamedPipeHandleStateA
PeekNamedPipe
CreateNamedPipeW
CreateNamedPipeA
UnregisterWait
RegisterWaitForSingleObject
SetHandleInformation
CancelIo
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateSemaphoreA
TryEnterCriticalSection
GetCurrencyFormatW
CompareStringA
GlobalSize
AllocConsole
UnlockFileEx
LockFileEx
SetConsoleTextAttribute
QueryDosDeviceW
GetLogicalDriveStringsW
WTSGetActiveConsoleSessionId
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetNativeSystemInfo
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
ReadConsoleW
SetStdHandle
GetOEMCP
IsValidCodePage
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLogicalDrives
GetACP
WriteConsoleW
GetFileType
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwindEx
InterlockedFlushSList
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
AreFileApisANSI
FormatMessageA
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjectsEx
WaitForSingleObjectEx
OpenEventA
GetCPInfo
GetStringTypeW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
LoadLibraryExA
FindFirstFileW
DeviceIoControl
OutputDebugStringA
GetModuleFileNameA
GetFileInformationByHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
GetLocaleInfoW
VerifyVersionInfoW
VerSetConditionMask
GlobalMemoryStatus
GetVersionExA
WaitNamedPipeW
TransactNamedPipe
DuplicateHandle
WaitForMultipleObjects
SetNamedPipeHandleState
SetUnhandledExceptionFilter
VirtualQueryEx
CreateSemaphoreW
CreateThread
TerminateThread
ReleaseSemaphore
RtlCaptureContext
GetSystemTime
OpenThread
VirtualQuery
FlushInstructionCache
GetCurrentProcessId
GetThreadContext
VirtualProtectEx
GetSystemInfo
GetThreadPriority
GetCurrentThread
ResumeThread
SuspendThread
InitializeCriticalSection
SetThreadPriority
VirtualAlloc
VirtualFree
GetDiskFreeSpaceExW
GetWindowsDirectoryW
GetProcessTimes
GetCurrentProcess
FreeResource
UnlockFile
CreateProcessW
GetStartupInfoW
FileTimeToSystemTime
MulDiv
GlobalHandle
GetModuleFileNameW
GetCurrentThreadId
SetLastError
GetModuleHandleW
WideCharToMultiByte
MultiByteToWideChar
CreateEventA
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GlobalAlloc
GlobalLock
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GlobalUnlock
GlobalFree
CreateFileW
CreateEventW
ResetEvent
SetEvent
Sleep
GetLastError
OpenProcess
TerminateProcess
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
RaiseException
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LoadLibraryW

user32

InvalidateRect
BeginPaint
EndPaint
GetActiveWindow
PostMessageW
DefWindowProcW
SetWindowLongPtrW
DrawTextW
IsWindow
SetWindowTextW
GetWindowTextW
ReleaseDC
EndDialog
GetDlgCtrlID
IsZoomed
GetSystemMenu
TrackPopupMenu
SetForegroundWindow
UnregisterClassW
RedrawWindow
PtInRect
TrackMouseEvent
SystemParametersInfoW
InflateRect
LoadImageW
FillRect
IsWindowEnabled
ShowWindow
ChildWindowFromPoint
IsChild
IsWindowVisible
UpdateWindow
GetSysColor
GetDC
MoveWindow
ScreenToClient
GetDlgItem
SendMessageW
DestroyWindow
CreateDialogParamW
EnableWindow
FrameRect
RegisterWindowMessageW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
DialogBoxIndirectParamW
GetWindowLongPtrW
DestroyAcceleratorTable
CallWindowProcW
InvalidateRgn
ReleaseCapture
SetCapture
ClientToScreen
CreateAcceleratorTableW
CharNextW
GetClassNameW
SetFocus
SetWindowLongW
MapWindowPoints
GetWindowRect
SetWindowPos
GetClientRect
GetDesktopWindow
GetWindow
GetParent
EnumDisplayMonitors
WaitMessage
WinHelpW
LoadStringW
GetDialogBaseUnits
DrawIcon
MessageBeep
GetLastActivePopup
MonitorFromPoint
GetIconInfo
DestroyCursor
GetNextDlgGroupItem
GetAsyncKeyState
SendMessageTimeoutW
GetLastInputInfo
EnumDisplaySettingsW
WaitForInputIdle
ExitWindowsEx
GetWindowThreadProcessId
SetClipboardData
EmptyClipboard
GetDlgItemTextW
CharLowerA
CharLowerW
GetMenuItemID
DrawTextExW
SystemParametersInfoA
LoadBitmapW
MonitorFromWindow
GetMonitorInfoW
GetSystemMetrics
DrawFrameControl
ShowScrollBar
GetPropW
RemovePropW
GetScrollRange
SetScrollRange
EnableScrollBar
AnimateWindow
GetWindowPlacement
wsprintfW
GetForegroundWindow
GetDlgItemInt
GetNextDlgTabItem
SetDlgItemTextW
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
GetShellWindow
GetWindowInfo
SetMenuDefaultItem
LockWindowUpdate
PostQuitMessage
IsDialogMessageW
FindWindowExW
LoadIconW
GetComboBoxInfo
AdjustWindowRectEx
GetMenu
DrawEdge
SendDlgItemMessageW
MapDialogRect
DeleteMenu
SetLayeredWindowAttributes
SetWindowContextHelpId
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
SetPropW
AppendMenuW
GetScrollPos
GetClassLongPtrW
DestroyIcon
DrawStateW
GetKeyState
GetMessagePos
InsertMenuW
SetCursorPos
DialogBoxParamW
CreatePopupMenu
MsgWaitForMultipleObjects
IsWindowUnicode
GetMessageA
DispatchMessageA
EnableMenuItem
BringWindowToTop
GetWindowDC
MessageBoxW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterClassW
GetClassInfoW
WindowFromPoint
SetRect
IsIconic
EnumWindows
FindWindowW
OpenIcon
IsDlgButtonChecked
CheckDlgButton
SetScrollPos
GetScrollInfo
GetCapture
GetCursorPos
ScrollWindowEx
SetRectEmpty
SetScrollInfo
DrawFocusRect
SetCursor
OffsetRect
UpdateLayeredWindow
CopyRect
DestroyMenu
GetSysColorBrush
SetTimer
KillTimer
CreateDialogIndirectParamW
GetWindowTextLengthW
GetClassLongW
EnumThreadWindows
EndDeferWindowPos
GetUpdateRect
IsRectEmpty
GetMessageTime
GetDoubleClickTime
CallMsgFilterW
BeginDeferWindowPos
SetClassLongW
NotifyWinEvent
DeferWindowPos
EnumDisplayDevicesW
GetFocus
DestroyCaret
GetKeyboardLayout
CreateCaret
SetCaretPos
SetWinEventHook
MapVirtualKeyW
RegisterClipboardFormatW
CountClipboardFormats
EnumClipboardFormats
GetClipboardSequenceNumber
LoadCursorFromFileA
CreateIconIndirect
DrawIconEx
SetActiveWindow
GetQueueStatus
PostThreadMessageW
GetWindowLongW

gdi32

GetGlyphIndicesW
CreateDCW
CreateRectRgn
GetClipRgn
BeginPath
EndPath
StrokeAndFillPath
UnrealizeObject
PolylineTo
GetCurrentObject
Ellipse
LineTo
MoveToEx
SelectClipRgn
CreatePen
Rectangle
GetBkColor
GetTextColor
CreateRectRgnIndirect
CombineRgn
ExcludeClipRect
GetTextMetricsW
GetClipBox
CreatePatternBrush
CreateBitmap
PatBlt
TextOutW
GetTextExtentPoint32W
RestoreDC
SaveDC
GetStockObject
SetDIBColorTable
CreateDIBSection
GetDIBColorTable
StretchBlt
CreateFontIndirectW
SetTextColor
ExtTextOutW
SetBkColor
GetObjectW
CreateSolidBrush
SetBkMode
GetDeviceCaps
BitBlt
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SetViewportOrgEx
SelectObject
DeleteDC
SetLayout
EndPage
StartDocW
SetMapMode
EndDoc
StartPage
AddFontMemResourceEx
GetDIBits
GetObjectA
CreateFontW
EnumFontFamiliesExW
GetFontUnicodeRanges

comdlg32

GetOpenFileNameW
GetSaveFileNameW
PrintDlgW
CommDlgExtendedError

advapi32

ConvertSidToStringSidW
CloseEventLog
ClearEventLogW
OpenEventLogW
LookupPrivilegeNameW
RegUnLoadKeyW
RegLoadKeyW
RegNotifyChangeKeyValue
GetUserNameW
LookupAccountNameW
CopySid
GetLengthSid
LookupAccountSidW
EqualSid
OpenThreadToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
RegEnumValueW
AccessCheck
MapGenericMask
DuplicateToken
GetFileSecurityW
SetNamedSecurityInfoW
SetEntriesInAclW
AllocateAndInitializeSid
FreeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptAcquireContextW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
CloseServiceHandle
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
DragQueryFileW
DragFinish
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
ord727
ord74
Shell_NotifyIconW
ExtractIconExW
ShellExecuteW
SHGetFileInfoW
SHEmptyRecycleBinW
SHAddToRecentDocs

ole32

OleLockRunning
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
OleUninitialize
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoFreeUnusedLibraries
CoCreateGuid
CoCreateInstance
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
CoTaskMemRealloc
ReleaseStgMedium
OleDuplicateData
RevokeDragDrop
RegisterDragDrop
DoDragDrop
CoInitializeSecurity
CoSetProxyBlanket
PropVariantClear
StgIsStorageFile
StgOpenStorageEx
CoInitializeEx

oleaut32

SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocStringLen
OleCreateFontIndirect
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
VariantClear
VariantInit
SysAllocString
VarUI4FromStr
VariantTimeToSystemTime
VariantChangeType
VarBstrFromI4
VarBstrFromR8
DispCallFunc
SysFreeString

shlwapi

PathAppendW
PathRemoveFileSpecW
PathIsDirectoryW
PathCompactPathW
PathGetDriveNumberW
PathRemoveBackslashW
PathSkipRootW
PathStripToRootW
PathRemoveExtensionW
PathAddExtensionW
PathStripPathW
PathRemoveExtensionA
PathIsDirectoryEmptyW
PathCombineW
PathFindExtensionW
PathUnquoteSpacesW
PathRemoveArgsW
SHStrDupW
PathFindFileNameW
PathIsURLW
PathCreateFromUrlW
PathStripPathA
PathIsUNCW
PathIsRelativeW
ord487
StrRetToStrW
PathMatchSpecW
PathFileExistsW

comctl32

_TrackMouseEvent
ImageList_Destroy
ImageList_Draw
ImageList_GetIconSize
ImageList_Duplicate
ImageList_SetIconSize
ImageList_LoadImageW
ImageList_Add
ImageList_Create
ImageList_Remove
ImageList_GetImageCount
ImageList_DrawEx
ImageList_GetIcon
ImageList_ReplaceIcon
InitCommonControlsEx

gdiplus

GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer2
GdipGraphicsClear
GdipGetPathWorldBounds
GdipClonePath
GdipSetClipRect
GdipAddPathRectangleI
GdipEndContainer
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRect
GdipTransformPoints
GdipMultiplyWorldTransform
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipScaleMatrix
GdipShearMatrix
GdipCreateTexture
GdipFillEllipse
GdipDrawEllipse
GdipFillPie
GdipDrawPie
GdipDrawArc
GdipDrawRectangle
GdipResetPath
GdipIsVisiblePathPoint
GdipStartPathFigure
GdipAddPathLine
GdipClosePathFigure
GdipSetPathFillMode
ord1
GdipAddPathBezier
GdipGetSmoothingMode
GdipTranslateWorldTransform
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipCreateFromHWND
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetFontHeightGivenDPI
GdipMeasureString
GdipDeleteFontFamily
GdipGetFamily
GdipGetCellAscent
GdipGetFontSize
GdipGetEmHeight
GdipGetCellDescent
GdipDrawString
GdipAddPathString
GdipGetFontStyle
GdipCreatePen2
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenLineJoin
GdipSetPenMiterLimit
GdipSetPenDashStyle
GdipSetPenDashArray
GdipSetPenDashOffset
GdipDeleteFont
GdipCreateFontFromDC
GdipGetLineSpacing
GdipCreateFontFromLogfontA
GdipCreateBitmapFromGraphics
GdipCreateHBITMAPFromBitmap
GdipDrawDriverString
GdipSetClipRectI
GdipFillRectanglesI
GdipDrawPath
GdipSetPathGradientTransform
GdipSetPathGradientCenterPoint
GdipSetPathGradientWrapMode
GdipSetPathGradientPresetBlend
GdipFree
GdipDisposeImage
GdipAddPathEllipse
GdipSetLineWrapMode
GdipSetLinePresetBlend
GdipCreateMatrix2
GdipMultiplyLineTransform
GdipCreateLineBrush
GdipGetClipBoundsI
GdipFillPath
GdipAddPathLineI
GdipAddPathArcI
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromStream
GdiplusShutdown
GdiplusStartup
GdipCreatePath
GdipDeletePath
GdipCreatePathGradientFromPath
GdipDeleteBrush
GdipCloneBrush
GdipCreateSolidFill
GdipFillRectangleI
GdipCreateFromHDC
GdipSetSmoothingMode
GdipCreatePen1
GdipDeletePen
GdipDrawRectangleI
GdipCreateHatchBrush
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipFillRectangle
GdipDrawLine
GdipCreateBitmapFromFile
GdipSetCompositingQuality
GdipSetPageUnit

dbghelp

MakeSureDirectoryPathExists

psapi

GetProcessImageFileNameW

urlmon

FindMimeFromData

winspool.drv

ord203

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod
timeKillEvent
PlaySoundW
timeSetEvent

ws2_32

GetAddrInfoW
WSAStartup
WSAGetLastError
getsockopt
closesocket
ioctlsocket
WSARecv
socket
FreeAddrInfoW
WSASocketW
listen
shutdown
WSASend
WSAIoctl
bind
WSARecvFrom
htons
select
WSASetLastError
setsockopt

oleacc

AccessibleObjectFromWindow
LresultFromObject

imm32

ImmIsIME
ImmAssociateContextEx
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmNotifyIME

usp10

ScriptFreeCache
ScriptApplyDigitSubstitution
ScriptItemize
ScriptBreak
ScriptShape
ScriptPlace

Exports

Exports

on_avast_dll_unload

Sections

.text
Size: 9.5MB - Virtual size: 9.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 585KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 431KB - Virtual size: 430KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
License.txt
ccleaner.ini
debug.log
portable.dat

Sharing

General

Malware Config

Signatures

Files

f96c3bb7ea085c244eee821f185a6bad

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

3d:3c:45:5a:5c:7b:7b:26:66:91:5e:b2:18:57:d7:eaCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

52:b6:a8:14:74:e8:04:89:20:f1:90:9e:45:4d:7f:c0Certificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

bb:dd:fc:fc:87:fe:ae:fc:f6:ec:81:53:20:86:53:cc:53:2f:39:6b:08:d4:dc:a7:ae:79:01:26:b4:1b:d0:8cSigner

49:e5:d8:97:cb:2c:90:00:22:50:31:c6:7f:ac:18:d6:49:6d:35:72Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

dbghelp

psapi

urlmon

winspool.drv

winmm

ws2_32

oleacc

imm32

usp10

Exports

Exports

Sections

.text Size: 6.9MB - Virtual size: 6.9MB

.rdata Size: 2.0MB - Virtual size: 2.0MB

.data Size: 516KB - Virtual size: 2.6MB

.gfids Size: 200KB - Virtual size: 200KB

.tls Size: 512B - Virtual size: 13B

.rsrc Size: 2.7MB - Virtual size: 2.7MB

.reloc Size: 512KB - Virtual size: 511KB

feb71b1e7523826994d70ab219118cd0

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

3d:3c:45:5a:5c:7b:7b:26:66:91:5e:b2:18:57:d7:ea
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

52:b6:a8:14:74:e8:04:89:20:f1:90:9e:45:4d:7f:c0
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

bb:dd:fc:fc:87:fe:ae:fc:f6:ec:81:53:20:86:53:cc:53:2f:39:6b:08:d4:dc:a7:ae:79:01:26:b4:1b:d0:8c
Signer

49:e5:d8:97:cb:2c:90:00:22:50:31:c6:7f:ac:18:d6:49:6d:35:72
Signer

.text
Size: 6.9MB - Virtual size: 6.9MB

.rdata
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 516KB - Virtual size: 2.6MB

.gfids
Size: 200KB - Virtual size: 200KB

.tls
Size: 512B - Virtual size: 13B

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

.reloc
Size: 512KB - Virtual size: 511KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

3d:3c:45:5a:5c:7b:7b:26:66:91:5e:b2:18:57:d7:ea
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

52:b6:a8:14:74:e8:04:89:20:f1:90:9e:45:4d:7f:c0
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

a8:12:5d:76:11:72:96:9e:ae:1a:da:7c:07:5b:af:a9:95:b2:55:13:c8:29:a9:08:6b:71:d9:5e:d1:5e:04:06
Signer

ad:02:bd:4e:e6:19:99:f0:b6:52:ab:ee:f0:5f:62:df:98:3d:91:62
Signer

.text
Size: 9.5MB - Virtual size: 9.5MB

.rdata
Size: 3.7MB - Virtual size: 3.7MB

.data
Size: 585KB - Virtual size: 2.6MB

.pdata
Size: 431KB - Virtual size: 430KB