99c860056bc39d5d3df4c8c24094958e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

99c860056bc39d5d3df4c8c24094958e_JaffaCakes118
Size

7.5MB
MD5

99c860056bc39d5d3df4c8c24094958e
SHA1

32190d74befec23804827e682406849807749b6b
SHA256

012db81de9c65b59b34a02169719bde16836abf1060d69f8c0063e2a91586256
SHA512

87098b1dc132da28ba40de3ecab304c7ee9243a38bbd6c7182c621a693b8131a267dd19d72bf3ea159f92165c8b22843e35a572317d24b063a61baf4c5bd4564
SSDEEP

196608:8V80djtbRSgvZetgdzvLUMDYOrXC1TjT3MvXLruDc3H:x0djXv0tsIMwEXvuDcX

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsResize.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsResize.dll	upx

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/ButtonEvent.dll
unpack001/$PLUGINSDIR/GraphicalInstaller.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/Math.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsResize.dll
unpack002/out.upx

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/DWUninstall.exe	nsis_installer_1
static1/unpack001/DWUninstall.exe	nsis_installer_2

Files

99c860056bc39d5d3df4c8c24094958e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4f67aeda01a0484282e8c59006b0b352

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2015, 00:00

Not After

18/11/2018, 23:59

Subject

SERIALNUMBER=C3712890,CN=Secure Installer Inc,O=Secure Installer Inc,L=Pleasanton,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d8:c5:e7:0a:13:a4:e9:67:26:78:b1:ef:21:83:4d:9b:58:aa:06:e1
Signer

Actual PE Digest

d8:c5:e7:0a:13:a4:e9:67:26:78:b1:ef:21:83:4d:9b:58:aa:06:e1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyFileA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetFileAttributesA
SetFileAttributesA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
GetCurrentProcess
GetFullPathNameA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
CloseHandle
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
lstrcmpiA
SetFileTime
lstrcmpA
ExpandEnvironmentStringsA
lstrcpynA
SetErrorMode
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc

user32

ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA

advapi32

RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ButtonEvent.dll
.dll windows:5 windows x86 arch:x86

0ece15e7d9bb35972aec701f46192460

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GlobalAlloc
lstrcpyA
lstrcpynA
GlobalFree

user32

PostMessageA
CallWindowProcA
GetDlgItem
FindWindowExA
SetWindowLongA
wsprintfA

Exports

Exports

AddEventHandler
UnsetEventHandler
WhichButtonId

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 262B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/GraphicalInstaller.dll
.dll windows:5 windows x86 arch:x86

b7a0648cf67d5ae9aee89c880d26b206

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

uxtheme

CloseThemeData
DrawThemeBackground
OpenThemeData

kernel32

GetStringTypeW
LCMapStringW
GetVersionExA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsSetValue
TlsGetValue
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
FreeLibrary
LocalFree
lstrcmpiA
GetLastError
GetFileAttributesA
FormatMessageA
lstrlenA
lstrcmpA
lstrcpyA
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
lstrcpynA
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetStdHandle
GetVersion
HeapFree
GetProcessHeap
GetModuleHandleW
HeapAlloc
MulDiv
SetLastError
VirtualProtect
FlushInstructionCache
GetCurrentProcess
VirtualQuery
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
Sleep
ExitProcess
WriteFile

user32

FillRect
ScreenToClient
GetWindowRect
DrawTextW
LoadBitmapA
IsWindowEnabled
PtInRect
GetWindowTextA
GetAsyncKeyState
GetWindowLongW
GetWindowTextW
IsWindowUnicode
SetWindowLongW
GetSysColor
GetCursorPos
DrawFrameControl
CallWindowProcW
EndPaint
GetClassNameA
SetWindowRgn
DrawTextA
GetPropA
GetParent
FindWindowExA
GetClientRect
SendMessageA
BeginPaint
GetDC
SetPropA
SetWindowLongA
InvalidateRect
GetWindowLongA
GetDlgItem
SetWindowPos
EnableScrollBar
GetScrollInfo
GetScrollPos
GetScrollRange
SetScrollInfo
SetScrollPos
SetScrollRange
ShowScrollBar
GetPropW
SendMessageW
RemovePropW
CreateWindowExW
SetPropW
SetRect
GetSystemMetrics
GetSysColorBrush
DrawEdge
OffsetRect
FrameRect
InflateRect
WindowFromDC
GetWindowDC
ReleaseDC
CopyRect
MapWindowPoints
SetTimer
SetCapture
KillTimer
ReleaseCapture
GetMessagePos
SetCursor
IsWindowVisible
EnumChildWindows
ShowWindow
PostMessageA
LoadImageA
UpdateWindow
CallWindowProcA
GetDlgItemTextA
GetClassLongA
wsprintfA

gdi32

IntersectClipRect
SelectClipRgn
SetWindowOrgEx
PlayEnhMetaFile
CreateSolidBrush
GetTextColor
BitBlt
SetTextColor
DeleteDC
StretchBlt
GetDIBits
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CombineRgn
SetStretchBltMode
CreateRectRgn
GetPixel
GetObjectA
GetStockObject
GetObjectW
ExtTextOutW
CreatePatternBrush
SetBrushOrgEx
PatBlt
CreateBitmap
UnrealizeObject
CreateCompatibleBitmap
SetBkColor

shell32

SHGetPathFromIDListA
SHGetMalloc
SHBrowseForFolderA

Exports

Exports

InitButtons
MakeFormTransparent
RemoveFormBorder
SelectFolder
SetButtonsSkin
SubclassCheckBox
SubclassLabel
SubclassRadioButton
UnInitButtons
UnSubclassLabel

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

154903d617e825e7d4f76664593675fd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetACP
lstrlenA
lstrcmpA
GetModuleHandleA
GlobalFree
MulDiv
lstrcpynA
GlobalAlloc
lstrcpyA

user32

SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
SetWindowTextA
LoadIconA
GetDC
ShowWindow
SendMessageA

gdi32

DeleteObject
CreateFontIndirectA
GetDeviceCaps

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 697B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Math.dll
.dll windows:4 windows x86 arch:x86

6a7dba1ca35af83a9a3593fbf002fb1e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapFree
lstrcmpA
lstrlenA
GlobalFree
lstrcatA
GlobalAlloc
lstrcpynA
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetVersion
RaiseException
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
lstrcpyA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetLastError
SetFilePointer
HeapAlloc
VirtualAlloc
HeapReAlloc
LCMapStringA
GetStringTypeW
GetOEMCP
LoadLibraryA
GetStringTypeA
FlushFileBuffers
CloseHandle
LCMapStringW
SetStdHandle
RtlUnwind

Exports

Exports

Script

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 851B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UAC.dll
.dll windows:4 windows x86 arch:x86

55a6a096df3564193c302728985d6bda

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateProcessA
GlobalAlloc
lstrlenA
GetVersionExA
SetLastError
GetProcAddress
lstrcmpiA
GetCurrentThreadId
GetCommandLineA
UnmapViewOfFile
WaitForSingleObject
GetCurrentProcessId
GetLastError
DuplicateHandle
SetCurrentDirectoryA
MapViewOfFile
Sleep
OpenProcess
GetExitCodeProcess
GetModuleHandleA
GetExitCodeThread
CreateThread
CreateFileMappingA
CreateEventA
MultiByteToWideChar
FormatMessageA
LocalFree
GlobalFree
CloseHandle
GetModuleFileNameA
lstrcatA
GetPrivateProfileIntA
GetPrivateProfileStringA
SetEvent
LoadLibraryA

user32

DialogBoxParamA
CharNextA
CallNextHookEx
SetForegroundWindow
IsWindowVisible
GetClassNameA
SetWindowsHookExA
DispatchMessageA
TranslateMessage
IsDialogMessageA
PeekMessageA
MsgWaitForMultipleObjects
DefWindowProcA
PostMessageA
CreateWindowExA
GetWindowThreadProcessId
CallWindowProcA
SetWindowPos
GetWindowRect
UnhookWindowsHookEx
GetClientRect
FindWindowExA
LoadIconA
CreateDialogParamA
GetWindowLongA
SendMessageW
MessageBoxA
EndDialog
SetWindowLongA
DestroyWindow
EnableWindow
ShowWindow
wsprintfA
GetDlgItem
SendMessageA
LoadStringA
LoadImageA

advapi32

GetUserNameA
OpenSCManagerA
CloseServiceHandle
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
QueryServiceStatus
OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

Exports

Exports

_

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/background.ole
.jpg
$PLUGINSDIR/background_small.ole
.jpg
$PLUGINSDIR/button.bmp
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

5bdcdde5acd7b395f3f3d19ebbb8c6cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_mbschr
_adjust_fdiv
malloc
_initterm
free
strlen
strchr
strrchr
_mbsrchr
strtoul
memset
_mbsstr
strtol

kernel32

GlobalFree
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrcmpiA
CreateFileA
GetFileSize
lstrlenA
WriteFile
ReadFile
lstrcmpA
lstrcpynA
lstrcatA
GetLastError
DeleteFileA
CloseHandle
SleepEx
SetFilePointer
GetTickCount

user32

MessageBoxA
GetParent
ShowWindow
SetWindowLongA
IsWindow
SetWindowTextA
SendDlgItemMessageA
GetDlgItem
PostMessageA
GetWindowTextA
SendMessageA
SetDlgItemTextA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindowVisible
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
GetWindowLongA

wininet

HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

ddbd50fe6279559edf7d1f1d89b42c2c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc

user32

DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
GetPropA
CharPrevA
DrawFocusRect
GetWindowLongA
DrawTextA
GetClientRect
GetDlgItem
GetSysColor
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
MapWindowPoints
RemovePropA
GetWindowTextA

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

46f8b6973f33717335c0f6d8087de67b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
lstrlenA
GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
lstrcpynA
ReadFile
PeekNamedPipe
GetTickCount
lstrcpyA
CreateProcessA
GetStartupInfoA
GetProcAddress
GetVersion
DeleteFileA
lstrcmpiA
GetCurrentProcess
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
CreatePipe
GlobalLock
lstrcatA

user32

SendMessageA
OemToCharBuffA
FindWindowExA
CharNextA
wsprintfA
CharPrevA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 458B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsResize.dll
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

Add
GetPos
GetPosPx
GetSize
GetSizePx
Set
SetRTL
Top

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 602B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/readme.rtf
.rtf
$PLUGINSDIR/~Temp-LicenseFile$2
$TEMP/DWHelper_$0.exe
.exe windows:5 windows x86 arch:x86

c2ee5572d775415aca3e31ea3347a062

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2015, 00:00

Not After

18/11/2018, 23:59

Subject

SERIALNUMBER=C3712890,CN=Secure Installer Inc,O=Secure Installer Inc,L=Pleasanton,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f7:ed:32:fc:48:f9:f4:51:2b:a2:cb:20:01:04:98:36:45:4c:49:3c
Signer

Actual PE Digest

f7:ed:32:fc:48:f9:f4:51:2b:a2:cb:20:01:04:98:36:45:4c:49:3c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\RBAdmin\.jenkins\workspace\DriverWhiz_Production_2.8.2\dr\DriverRestore\InstallHelper\bin\Release\DWInstallHelper.pdb

Imports

winhttp

WinHttpOpen
WinHttpSendRequest
WinHttpConnect
WinHttpReadData
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpCloseHandle

kernel32

InterlockedExchange
InterlockedDecrement
MultiByteToWideChar
CreateProcessW
WaitForSingleObject
OpenProcess
TerminateProcess
Process32FirstW
LoadLibraryA
CreateToolhelp32Snapshot
CloseHandle
GetComputerNameW
GetTempPathW
HeapFree
GetProcessHeap
GetLastError
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
CreateFileA
InterlockedCompareExchange
InitializeCriticalSection
CreateFileW
Process32NextW
TlsFree
GetLocaleInfoW
GetLocaleInfoA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
HeapSize
IsValidCodePage
GetOEMCP
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetStartupInfoW
RaiseException
HeapAlloc
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
SetEndOfFile
InterlockedIncrement
SetLastError
GetCurrentThreadId
WideCharToMultiByte
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ReadFile
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Sleep
SetFilePointer
ExitProcess
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
RtlUnwind
GetACP

user32

GetSystemMetrics

advapi32

RegSetValueExA
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW

Sections

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/dotNetFx40_Full_setup.exe
.exe windows:5 windows x86 arch:x86

02483cd76378259a50b7b66146b45f06

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d6:d5:21:44:87:a4:87:f6:84:c8:27:2e:90:f4:8d:98:d2:12:c9:41
Signer

Actual PE Digest

d6:d5:21:44:87:a4:87:f6:84:c8:27:2e:90:f4:8d:98:d2:12:c9:41

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

boxstub.pdb

Imports

advapi32

CryptGenRandom
CryptReleaseContext
DecryptFileW
CryptAcquireContextA

kernel32

Sleep
WaitForSingleObject
GetExitCodeProcess
CloseHandle
SetFileAttributesW
InitializeCriticalSection
CreateEventA
CreateThread
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetCommandLineW
CreateProcessW
CompareStringW
LocalFree
QueryDosDeviceW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
CreateFileW
DeviceIoControl
SetErrorMode
CreateDirectoryW
RemoveDirectoryW
MoveFileExW
LoadLibraryW
GetProcAddress
GetSystemDirectoryW
GetVersion
GetLastError
SetEnvironmentVariableW
ExitThread
GetTickCount
GetEnvironmentVariableW
GetModuleHandleW
lstrlenW
WaitForMultipleObjects
ResetEvent
GetSystemInfo
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetEndOfFile
DuplicateHandle
ReadFile
SetFilePointerEx
GlobalFree
GlobalAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
LCMapStringW
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetStringTypeW
HeapSize
HeapReAlloc
IsProcessorFeaturePresent
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileA
GetLocalTime
GetComputerNameW
lstrlenA
FormatMessageW
GetSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
DeleteFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentDirectoryW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
GetProcessHeap
RaiseException

comctl32

ord17

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

shell32

CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW
GetTopWindow
GetWindowThreadProcessId
GetWindow
SendMessageA
PostMessageW
SendMessageW
DialogBoxParamA
GetDlgItem
SetWindowTextW
EndDialog
PostQuitMessage
DialogBoxParamW
SetWindowLongW
GetWindowLongW
LoadStringW
CharUpperW

cabinet

ord22
ord23
ord20

oleaut32

SysAllocString
VariantClear

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Exports

Exports

?dwPlaceholder@@3PAEA
_DecodePointerInternal@4
_EncodePointerInternal@4

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boxld01
Size: 512B - Virtual size: 194B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DPInst32.exe
.exe windows:6 windows x86 arch:x86

0bbb04de18f86a2d1ac8d1d580c5be48

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

b5:3c:25:6a:47:ff:f8:34:a3:0f:d0:7e:68:b8:45:4a:55:63:bd:08
Signer

Actual PE Digest

b5:3c:25:6a:47:ff:f8:34:a3:0f:d0:7e:68:b8:45:4a:55:63:bd:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

DpInst.pdb

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
IsTextUnicode
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetEntriesInAclW
DeleteService
StartServiceW
ControlService
OpenSCManagerW
CloseServiceHandle
OpenServiceW
QueryServiceStatus
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
CheckTokenMembership

kernel32

DeleteFileW
ReleaseMutex
SetFilePointer
HeapFree
GetProcessHeap
HeapAlloc
CreateMutexW
FreeLibrary
FreeConsole
SetConsoleCursorPosition
GetFileAttributesW
ReadConsoleOutputW
UnmapViewOfFile
SetConsoleMode
GetConsoleMode
GetStdHandle
GetProcAddress
LoadLibraryW
WriteConsoleOutputW
WriteConsoleW
IsValidLocale
lstrcmpW
lstrlenW
lstrcmpiW
GetTempFileNameW
FindFirstFileW
FindNextFileW
FindClose
CopyFileW
SetFileAttributesW
FormatMessageW
RaiseException
GetFileSize
CreateFileMappingW
FillConsoleOutputCharacterW
MapViewOfFile
CreateThread
Sleep
InterlockedDecrement
InterlockedIncrement
WriteFile
CreateFileW
GetConsoleScreenBufferInfo
WaitForMultipleObjects
InterlockedCompareExchange
SetEvent
CreateEventW
LocalReAlloc
DeviceIoControl
GetExitCodeProcess
VerSetConditionMask
VerifyVersionInfoW
CreateDirectoryW
RemoveDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetFullPathNameW
GetSystemWindowsDirectoryW
MoveFileExW
SearchPathW
GetSystemDefaultUILanguage
LoadLibraryExW
CreateFileA
GetLocaleInfoW
SetEndOfFile
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetConsoleCP
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
ReadFile
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetThreadLocale
SetThreadLocale
GetUserDefaultUILanguage
GetVersionExW
GetLocalTime
GetWindowsDirectoryW
SetCurrentDirectoryW
GetStringTypeA
WaitForSingleObject
GetCPInfo
UnhandledExceptionFilter
TerminateProcess
OutputDebugStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameW
GetModuleFileNameA
ExitProcess
GetModuleHandleA
SetUnhandledExceptionFilter
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
GetStartupInfoW
GetEnvironmentVariableW
CompareStringW
WideCharToMultiByte
InterlockedExchange
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCommandLineW
LocalAlloc
GlobalFree
LocalFree
MultiByteToWideChar
GetCurrentProcess
GetLastError
CloseHandle
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceLanguagesW
GetSystemDirectoryW

gdi32

SetLayout
DeleteDC
GetObjectW
CreateCompatibleBitmap
CreateBitmap
SelectObject
StartPage
EndPage
StartDocW
EndDoc
GetTextMetricsW
GetDeviceCaps
CreateFontIndirectW
DeleteObject
CreateCompatibleDC

user32

AllowSetForegroundWindow
ShowWindow
CreateWindowExW
DefWindowProcW
PostQuitMessage
GetUserObjectInformationW
GetProcessWindowStation
GetIconInfo
DrawIconEx
CreateIconIndirect
LoadIconW
LoadBitmapW
DrawTextExW
LoadImageW
GetSystemMetrics
GetSysColor
DestroyWindow
GetWindowLongW
SendDlgItemMessageW
InvalidateRect
SetWindowTextW
SystemParametersInfoW
GetDC
ReleaseDC
SetWindowLongW
SetDlgItemTextW
GetParent
PostMessageW
IsDlgButtonChecked
CheckDlgButton
SetFocus
CallWindowProcW
DestroyIcon
DialogBoxParamW
GetDlgItem
SendMessageW
MessageBoxW
RegisterClassExW
UnregisterClassA
CharLowerW
CharPrevW
EndDialog

ntdll

NtOpenProcessToken
RtlNtStatusToDosError
NtQueryInformationToken
RtlUnwind
NtClose
NtOpenThreadToken

shell32

SHGetFolderPathW
ShellExecuteExW
ord59
CommandLineToArgvW

setupapi

SetupDiOpenClassRegKey
SetupInstallFilesFromInfSectionW
SetupPromptReboot
SetupInstallFromInfSectionW
SetupInstallServicesFromInfSectionW
SetupDiGetActualSectionToInstallW
SetupFindNextLine
SetupFindNextMatchLineW
SetupOpenInfFileW
SetupGetLineCountW
SetupCloseInfFile
SetupFindFirstLineW
SetupGetStringFieldW
pSetupSetGlobalFlags
pSetupGetGlobalFlags
SetupGetFieldCount
SetupGetIntField
SetupOpenAppendInfFileW
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsW
SetupDiGetSelectedDriverW
SetupDiGetDriverInfoDetailW
SetupDiCreateDeviceInfoList
SetupDiClassNameFromGuidW
SetupDiGetDeviceInstanceIdW
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiSetDeviceRegistryPropertyW
SetupDiOpenDeviceInfoW
SetupDiSetSelectedDevice
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyW
SetupGetTargetPathW
SetupQueueCopyIndirectW
SetupQueueCopyW
SetupOpenFileQueue
SetupInitDefaultQueueCallbackEx
SetupDefaultQueueCallbackW
SetupCommitFileQueueW
SetupTermDefaultQueueCallback
SetupCloseFileQueue
SetupCopyOEMInfW
CM_Enumerate_Classes
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Get_Device_IDW
CMP_WaitNoPendingInstallEvents
CM_Setup_DevNode
SetupDiDestroyDeviceInfoList
CM_Query_And_Remove_SubTreeW

wintrust

CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

ole32

CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateInstance
StringFromCLSID

oleaut32

VariantInit
VariantClear
VariantChangeType
SysAllocString
SysFreeString

comctl32

ImageList_ReplaceIcon
CreatePropertySheetPageW
ImageList_Create
ImageList_SetBkColor
PropertySheetW

comdlg32

GetSaveFileNameW
PrintDlgExW

crypt32

CertGetCTLContextProperty
CertFreeCTLContext
CryptQueryObject
CertFreeCertificateContext

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 391KB - Virtual size: 390KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 348KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DPInst64.exe
.exe windows:6 windows x64 arch:x64

4584aed10fdc1d558a53d7cc2371df14

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

89:33:8d:36:ef:11:03:b8:62:ee:1a:e6:a7:80:0b:58:5e:c0:9f:ca
Signer

Actual PE Digest

89:33:8d:36:ef:11:03:b8:62:ee:1a:e6:a7:80:0b:58:5e:c0:9f:ca

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

DpInst.pdb

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
IsTextUnicode
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetEntriesInAclW
OpenServiceW
OpenSCManagerW
QueryServiceStatus
DeleteService
CloseServiceHandle
ControlService
StartServiceW
RegDeleteValueW
CheckTokenMembership
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW

kernel32

SetFilePointer
HeapAlloc
GetProcessHeap
HeapFree
CreateMutexW
GetConsoleMode
SetConsoleMode
GetConsoleScreenBufferInfo
ReadConsoleOutputW
FillConsoleOutputCharacterW
SetConsoleCursorPosition
ReleaseMutex
FreeLibrary
WriteConsoleOutputW
WriteConsoleW
LoadLibraryW
GetProcAddress
GetStdHandle
IsValidLocale
VirtualProtect
Sleep
GetFileAttributesW
DeleteFileW
FindClose
FindNextFileW
RaiseException
lstrcmpiW
lstrcmpW
FindFirstFileW
CopyFileW
lstrlenW
SetFileAttributesW
FormatMessageW
GetTempFileNameW
MapViewOfFile
FreeConsole
CreateFileMappingW
GetFileSize
WaitForMultipleObjects
CreateEventW
SetEvent
SetEndOfFile
LocalReAlloc
DeviceIoControl
GetSystemDirectoryW
VerifyVersionInfoW
VerSetConditionMask
GetShortPathNameW
RemoveDirectoryW
MoveFileExW
CreateDirectoryW
GetModuleFileNameW
GetFullPathNameW
GetCurrentDirectoryW
GetSystemWindowsDirectoryW
GetSystemDefaultUILanguage
SearchPathW
SetLastError
GetLocaleInfoW
LoadLibraryExW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
OutputDebugStringA
GetStartupInfoW
GetEnvironmentVariableW
CompareStringW
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapSize
HeapReAlloc
HeapDestroy
CreateThread
SetThreadLocale
GetThreadLocale
WriteFile
CreateFileW
LocalFree
FindResourceW
GlobalFree
SetCurrentDirectoryW
LocalAlloc
GetUserDefaultUILanguage
EnumResourceLanguagesW
GetCurrentProcess
GetLastError
MultiByteToWideChar
GetVersionExW
GetCommandLineW
CloseHandle
GetLocalTime
FindResourceExW
GetExitCodeProcess
WaitForSingleObject
LoadResource
LockResource
SizeofResource
GetWindowsDirectoryW
UnmapViewOfFile

gdi32

SelectObject
CreateBitmap
CreateCompatibleBitmap
GetObjectW
DeleteDC
SetLayout
CreateCompatibleDC
EndPage
StartPage
EndDoc
StartDocW
GetTextMetricsW
CreateFontIndirectW
DeleteObject
GetDeviceCaps

user32

MessageBoxW
CreateIconIndirect
DrawIconEx
GetIconInfo
LoadIconW
LoadBitmapW
PostQuitMessage
SendMessageW
CharPrevW
CharLowerW
UnregisterClassA
DefWindowProcW
EndDialog
RegisterClassExW
CreateWindowExW
ShowWindow
AllowSetForegroundWindow
DialogBoxParamW
GetProcessWindowStation
GetUserObjectInformationW
GetDlgItem
DestroyIcon
ReleaseDC
InvalidateRect
SetWindowTextW
SetDlgItemTextW
PostMessageW
GetParent
GetSystemMetrics
GetSysColor
IsDlgButtonChecked
CheckDlgButton
SetFocus
CallWindowProcW
DestroyWindow
GetWindowLongPtrW
SetWindowLongW
SetWindowLongPtrW
SystemParametersInfoW
SendDlgItemMessageW
LoadImageW
GetDC
DrawTextExW

msvcrt

_resetstkoflw
__C_specific_handler
memset
_wcsupr
_wcslwr
_errno
__CxxFrameHandler
fread
feof
realloc
fclose
_wfopen
??2@YAPEAX_K@Z
wcsstr
_wcsicmp
_wtol
_vscwprintf
free
malloc
??_V@YAXPEAX@Z
??3@YAXPEAX@Z
__wgetmainargs
_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
??1type_info@@UEAA@XZ
memcpy
memmove
_CxxThrowException
mbtowc
__mb_cur_max
isleadbyte
_iob
_snprintf
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
_wcsnicmp
_vsnwprintf
wcsncmp
bsearch
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
iswalpha
??_U@YAPEAX_K@Z
wcschr
wcspbrk
wcsrchr
iswdigit
_isatty
fwprintf
_itoa
memcmp

ntdll

RtlNtStatusToDosError
NtOpenProcessToken
NtClose
NtOpenThreadToken
RtlVirtualUnwind
RtlLookupFunctionEntry
NtQueryInformationToken
RtlCaptureContext

shell32

ShellExecuteExW
ord59
SHGetFolderPathW
CommandLineToArgvW

setupapi

SetupFindNextLine
pSetupSetGlobalFlags
pSetupGetGlobalFlags
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupGetTargetPathW
SetupDiSetSelectedDevice
SetupDiSetClassInstallParamsW
SetupDiGetDriverInfoDetailW
SetupOpenFileQueue
SetupDiGetSelectedDriverW
SetupDiCallClassInstaller
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
CM_Get_DevNode_Status
SetupDiOpenDevRegKey
SetupDiGetClassDevsW
SetupFindNextMatchLineW
SetupDiSetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoList
SetupDiClassNameFromGuidW
SetupDiOpenDeviceInfoW
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetActualSectionToInstallW
SetupTermDefaultQueueCallback
SetupDefaultQueueCallbackW
SetupCommitFileQueueW
SetupInitDefaultQueueCallbackEx
CMP_WaitNoPendingInstallEvents
SetupDiOpenClassRegKey
SetupGetStringFieldW
SetupGetLineCountW
SetupOpenAppendInfFileW
SetupFindFirstLineW
SetupGetIntField
SetupGetFieldCount
SetupOpenInfFileW
SetupCloseInfFile
SetupDiDestroyDeviceInfoList
SetupInstallFilesFromInfSectionW
SetupPromptReboot
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Locate_DevNodeW
CM_Query_And_Remove_SubTreeW
CM_Setup_DevNode
CM_Get_Device_IDW
CM_Enumerate_Classes
SetupCopyOEMInfW
SetupQueueCopyW
SetupCloseFileQueue

wintrust

CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

ole32

StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantChangeType
VariantInit
VariantClear
SysAllocString
SysFreeString

comctl32

ImageList_SetBkColor
PropertySheetW
ImageList_Create
CreatePropertySheetPageW
ImageList_ReplaceIcon

comdlg32

PrintDlgExW
GetSaveFileNameW

crypt32

CertFreeCTLContext
CertGetCTLContextProperty
CryptQueryObject
CertFreeCertificateContext

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 517KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 348KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DTD/xhtml-lat1.ent
DTD/xhtml-special.ent
DTD/xhtml-symbol.ent
DTD/xhtml1-strict.dtd
DWUninstall.exe
.exe windows:4 windows x86 arch:x86

b78ecf47c0a3e24a6f4af114e2d1f5de

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2015, 00:00

Not After

18/11/2018, 23:59

Subject

SERIALNUMBER=C3712890,CN=Secure Installer Inc,O=Secure Installer Inc,L=Pleasanton,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7d:84:bb:8c:93:2a:4e:87:5a:d4:f3:d2:0c:0c:d0:32:40:a5:9b:6e
Signer

Actual PE Digest

7d:84:bb:8c:93:2a:4e:87:5a:d4:f3:d2:0c:0c:d0:32:40:a5:9b:6e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEnvironmentVariableA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
GetFileAttributesA
SetFileAttributesA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
GetFullPathNameA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
CloseHandle
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
lstrcmpiA
SetFileTime
lstrcmpA
ExpandEnvironmentStringsA
GlobalUnlock
GetDiskFreeSpaceA
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc

user32

ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA

advapi32

RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DriverWhiz.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2015, 00:00

Not After

18/11/2018, 23:59

Subject

SERIALNUMBER=C3712890,CN=Secure Installer Inc,O=Secure Installer Inc,L=Pleasanton,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:f0:f0:02:1d:9b:5a:dc:b8:47:1b:a8:a9:61:08:95:c3:52:fb:52
Signer

Actual PE Digest

39:f0:f0:02:1d:9b:5a:dc:b8:47:1b:a8:a9:61:08:95:c3:52:fb:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\RBAdmin\.jenkins\workspace\DriverWhiz_Production_2.8.2\dr\DriverRestore\DriverRestore\obj\x86\Release\DriverWhiz.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 702KB - Virtual size: 702KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DriverWhiz.exe.config
.xml
DriversScanner.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2015, 00:00

Not After

18/11/2018, 23:59

Subject

SERIALNUMBER=C3712890,CN=Secure Installer Inc,O=Secure Installer Inc,L=Pleasanton,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

95:a6:0d:93:5d:1a:95:f1:01:38:70:05:cb:a0:56:9f:76:51:ec:bc
Signer

Actual PE Digest

95:a6:0d:93:5d:1a:95:f1:01:38:70:05:cb:a0:56:9f:76:51:ec:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\RBAdmin\.jenkins\workspace\DriverWhiz_Production_2.8.2\dr\DriverRestore\Scanner\obj\Release\DriversScanner.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Interop.IWshRuntimeLibrary.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2015, 00:00

Not After

18/11/2018, 23:59

Subject

SERIALNUMBER=C3712890,CN=Secure Installer Inc,O=Secure Installer Inc,L=Pleasanton,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ff:a8:79:76:18:3c:6b:e3:61:70:04:38:f0:3b:7b:2a:71:37:e3:85
Signer

Actual PE Digest

ff:a8:79:76:18:3c:6b:e3:61:70:04:38:f0:3b:7b:2a:71:37:e3:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Interop.Shell32.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2015, 00:00

Not After

18/11/2018, 23:59

Subject

SERIALNUMBER=C3712890,CN=Secure Installer Inc,O=Secure Installer Inc,L=Pleasanton,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

32:e2:4d:ce:f3:fa:4e:46:34:55:76:f3:18:d0:bb:6b:90:d0:2d:bf
Signer

Actual PE Digest

32:e2:4d:ce:f3:fa:4e:46:34:55:76:f3:18:d0:bb:6b:90:d0:2d:bf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Language-bp.txt
Language-de.txt
Language-en.txt
Language-fr.txt
Language-it.txt
Language.txt
Microsoft.Win32.TaskScheduler.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2015, 00:00

Not After

18/11/2018, 23:59

Subject

SERIALNUMBER=C3712890,CN=Secure Installer Inc,O=Secure Installer Inc,L=Pleasanton,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ce:e8:57:4f:84:78:bb:d3:a9:e7:17:45:56:16:7a:68:d7:95:0c:ef
Signer

Actual PE Digest

ce:e8:57:4f:84:78:bb:d3:a9:e7:17:45:56:16:7a:68:d7:95:0c:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2015, 00:00

Not After

18/11/2018, 23:59

Subject

SERIALNUMBER=C3712890,CN=Secure Installer Inc,O=Secure Installer Inc,L=Pleasanton,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

76:65:3c:86:c3:f7:23:bc:af:e6:57:2d:29:e9:13:e4:67:e3:eb:e5
Signer

Actual PE Digest

76:65:3c:86:c3:f7:23:bc:af:e6:57:2d:29:e9:13:e4:67:e3:eb:e5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\json-71556\trunk\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 359KB - Virtual size: 358KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebUI/it/Language-it.txt
WebUI/it/about.html
WebUI/it/iframe.html
WebUI/it/it.txt
WebUI/it/itGUI.txt
WebUI/it/lib/Donut/DonutChart.js
.js
WebUI/it/lib/Donut/excanvas.js
.js
WebUI/it/lib/Donut/jqplot.donutRenderer.min.js
.js
WebUI/it/lib/Donut/jquery.jqplot.min.css
WebUI/it/lib/Donut/jquery.jqplot.min.js
.js
WebUI/it/lib/css/CustomScrollbar.css
WebUI/it/lib/css/jquery.timeentry.css
WebUI/it/lib/css/main.css
WebUI/it/lib/css/style.css
WebUI/it/lib/css/style_old.css
WebUI/it/lib/css/timepicker/jquery.datepick.css
WebUI/it/lib/css/timepicker/ui.core.css
WebUI/it/lib/css/timepicker/ui.timepickr.css
WebUI/it/lib/fonts/HelveticaNeueMed.eot
WebUI/it/lib/fonts/HelveticaNeueMed.otf
WebUI/it/lib/fonts/HelveticaNeueMed.svg
.xml
WebUI/it/lib/fonts/HelveticaNeueMed.ttf
WebUI/it/lib/fonts/HelveticaNeueMed.woff
WebUI/it/lib/fonts/helvetica-narrow.eot
WebUI/it/lib/fonts/helvetica-narrow.svg
.xml
WebUI/it/lib/fonts/helvetica-narrow.ttf
WebUI/it/lib/fonts/helvetica-narrow.woff
WebUI/it/lib/fonts/helvetica_neue-demo.html
.js
WebUI/it/lib/fonts/helvetica_neue-webfont.eot
WebUI/it/lib/fonts/helvetica_neue-webfont.ttf
WebUI/it/lib/fonts/helvetica_neue-webfont.woff
WebUI/it/lib/fonts/helveticaneue-bold-demo.html
.js
WebUI/it/lib/fonts/helveticaneue-bold-webfont.eot
WebUI/it/lib/fonts/helveticaneue-bold-webfont.svg
.xml
WebUI/it/lib/fonts/helveticaneue-bold-webfont.ttf
WebUI/it/lib/fonts/helveticaneue-bold-webfont.woff
WebUI/it/lib/fonts/helveticaneue-bolditalic-demo.html
.js
WebUI/it/lib/fonts/helveticaneue-bolditalic-webfont.eot
WebUI/it/lib/fonts/helveticaneue-bolditalic-webfont.svg
.xml
WebUI/it/lib/fonts/helveticaneue-bolditalic-webfont.ttf
WebUI/it/lib/fonts/helveticaneue-bolditalic-webfont.woff
WebUI/it/lib/fonts/helveticaneue-demo.html
.js
WebUI/it/lib/fonts/helveticaneue-lightitalic-demo.html
.js
WebUI/it/lib/fonts/helveticaneue-lightitalic-webfont.eot
WebUI/it/lib/fonts/helveticaneue-lightitalic-webfont.svg
.xml
WebUI/it/lib/fonts/helveticaneue-lightitalic-webfont.ttf
WebUI/it/lib/fonts/helveticaneue-lightitalic-webfont.woff
WebUI/it/lib/fonts/helveticaneue-webfont.eot
WebUI/it/lib/fonts/helveticaneue-webfont.svg
.xml
WebUI/it/lib/fonts/helveticaneue-webfont.ttf
WebUI/it/lib/fonts/helveticaneue-webfont.woff
WebUI/it/lib/fonts/helveticaneuemed-demo.html
.js
WebUI/it/lib/fonts/helveticaneuemed-webfont.eot
WebUI/it/lib/fonts/helveticaneuemed-webfont.svg
.xml
WebUI/it/lib/fonts/helveticaneuemed-webfont.ttf
WebUI/it/lib/fonts/helveticaneuemed-webfont.woff
WebUI/it/lib/images/bg/DriverNow.png
.png
WebUI/it/lib/images/bg/Thumbs.db
WebUI/it/lib/images/bg/abour_menu_shadow.png
.png
WebUI/it/lib/images/bg/aside.png
.png
WebUI/it/lib/images/bg/aside1.png
.png
WebUI/it/lib/images/bg/blue.png
.png
WebUI/it/lib/images/bg/blue1.png
.png
WebUI/it/lib/images/bg/call-activation-bg.png
.png
WebUI/it/lib/images/bg/call-activation-page.png
.png
WebUI/it/lib/images/bg/call-activation.png
.png
WebUI/it/lib/images/bg/cat-list_bg.png
.png
WebUI/it/lib/images/bg/cat-list_bg1.png
.png
WebUI/it/lib/images/bg/cat-list_bg1_active.png
.png
WebUI/it/lib/images/bg/cat-list_bg1_hover.png
.png
WebUI/it/lib/images/bg/checkboxcontant_inner.png
.png
WebUI/it/lib/images/bg/com-sys-scan.png
.png
WebUI/it/lib/images/bg/content.png
.png
WebUI/it/lib/images/bg/dark_gray_bg-list.jpg
.jpg
WebUI/it/lib/images/bg/dark_gray_bg-list_active.png
.png
WebUI/it/lib/images/bg/dark_gray_bg-list_hover.png
.png
WebUI/it/lib/images/bg/day_week.png
.png
WebUI/it/lib/images/bg/db_defination.png
.png
WebUI/it/lib/images/bg/detail_pc.png
.png
WebUI/it/lib/images/bg/dr_category_heading-bg.png
.png
WebUI/it/lib/images/bg/dropdown_bg-1.jpg
.jpg
WebUI/it/lib/images/bg/dropdown_bg.jpg
.jpg
WebUI/it/lib/images/bg/home_bottom_bg.png
.png
WebUI/it/lib/images/bg/last_scan.png
.png
WebUI/it/lib/images/bg/light-gray-bg-list.jpg
.jpg
WebUI/it/lib/images/bg/light-gray-bg-list_active.png
.png
WebUI/it/lib/images/bg/light-gray-bg-list_hover.png
.png
WebUI/it/lib/images/bg/page.jpg
.jpg
WebUI/it/lib/images/bg/red&gray_bg.png
.png
WebUI/it/lib/images/bg/red.png
.png
WebUI/it/lib/images/bg/red_bg.png
.png
WebUI/it/lib/images/bg/red_strip.jpg
.jpg
WebUI/it/lib/images/bg/red_strip1.jpg
.jpg
WebUI/it/lib/images/bg/red_strip_active.png
.png
WebUI/it/lib/images/bg/red_strip_hover.png
.png
WebUI/it/lib/images/bg/scanSummery-right-BG.png
.png
WebUI/it/lib/images/bg/scanSummery-underline.png
.png
WebUI/it/lib/images/bg/scanSummery-underline1.png
.png
WebUI/it/lib/images/bg/scanSummery1_bg.png
.png
WebUI/it/lib/images/bg/scanSummeryBG.png
.png
WebUI/it/lib/images/bg/scanSummeryBg_1.png
.png
WebUI/it/lib/images/bg/select_days.png
.png
WebUI/it/lib/images/bg/select_tab.png
.png
WebUI/it/lib/images/bg/setting_tab.png
.png
WebUI/it/lib/images/bg/setting_tab_1.png
.png
WebUI/it/lib/images/bg/shedule.png
.png
WebUI/it/lib/images/bg/tab_hover_lef.png
.png
WebUI/it/lib/images/bg/tab_hover_right.png
.png
WebUI/it/lib/images/bg/toster-bg.png
.png
WebUI/it/lib/images/bg/toster-btn.png
.png
WebUI/it/lib/images/bg/typeshedule.png
.png
WebUI/it/lib/images/bg/updated_tab.png
.png
WebUI/it/lib/images/bg/white_bg_list.jpg
.jpg
WebUI/it/lib/images/bg/white_bg_list_active.png
.png
WebUI/it/lib/images/bg/white_bg_list_hover.png
.png
WebUI/it/lib/images/bg/yellow_bg.png
.png
WebUI/it/lib/images/bg/ylo_strip.jpg
.jpg
WebUI/it/lib/images/bg/ylo_strip1.jpg
.jpg
WebUI/it/lib/images/bg/ylo_strip_active.png
.png
WebUI/it/lib/images/bg/ylo_strip_hover.png
.png
WebUI/it/lib/images/boxshot/DriverRestore.png
.png
WebUI/it/lib/images/boxshot/Thumbs.db
WebUI/it/lib/images/boxshot/driverRestore_1.png
.png
WebUI/it/lib/images/btns/RegisterNow.png
.png
WebUI/it/lib/images/btns/apply.png
.png
WebUI/it/lib/images/btns/apply2.png
.png
WebUI/it/lib/images/btns/complete-scan.png
.png
WebUI/it/lib/images/btns/complete_scan.png
.png
WebUI/it/lib/images/btns/contact-support.png
.png
WebUI/it/lib/images/btns/continue_btn.png
.png
WebUI/it/lib/images/btns/fix_error_now.png
.png
WebUI/it/lib/images/btns/fix_selected_driver.png
.png
WebUI/it/lib/images/btns/install-now.png
.png
WebUI/it/lib/images/btns/install.png
.png
WebUI/it/lib/images/btns/kit_old.png
.png
WebUI/it/lib/images/btns/kit_sp.png
.png
WebUI/it/lib/images/btns/mCSB_buttons.png
.png
WebUI/it/lib/images/btns/mCSB_buttons1.png
.png
WebUI/it/lib/images/btns/ok.png
.png
WebUI/it/lib/images/btns/quit_btn.png
.png
WebUI/it/lib/images/btns/register-now.png
.png
WebUI/it/lib/images/btns/register_btn.png
.png
WebUI/it/lib/images/btns/register_now_1.png
.png
WebUI/it/lib/images/btns/report-problem.png
.png
WebUI/it/lib/images/btns/rescan.png
.png
WebUI/it/lib/images/btns/scan.png
.png
WebUI/it/lib/images/btns/scroller.png
.png
WebUI/it/lib/images/btns/start_new_scan.png
.png
WebUI/it/lib/images/btns/start_scan.png
.png
WebUI/it/lib/images/btns/underline.png
.png
WebUI/it/lib/images/btns/update.png
.png
WebUI/it/lib/images/btns/update_driver.png
.png
WebUI/it/lib/images/btns/update_driver_now.png
.png
WebUI/it/lib/images/btns/update_driver_small.png
.png
WebUI/it/lib/images/btns/update_now.png
.png
WebUI/it/lib/images/btns/update_now1.png
.png
WebUI/it/lib/images/btns/update_now_2.png
.png
WebUI/it/lib/images/btns/update_selected.png
.png
WebUI/it/lib/images/cumputarIcon.png
.png
WebUI/it/lib/images/defaultDeviceImages/biometric-devices.png
.png
WebUI/it/lib/images/defaultDeviceImages/bluetooth-devices.png
.png
WebUI/it/lib/images/defaultDeviceImages/disk-drives.png
.png
WebUI/it/lib/images/defaultDeviceImages/display-adapters.png
.png
WebUI/it/lib/images/defaultDeviceImages/dvd-cd-rom-drives.png
.png
WebUI/it/lib/images/defaultDeviceImages/firewire-devices.png
.png
WebUI/it/lib/images/defaultDeviceImages/floppy-drive.png
.png
WebUI/it/lib/images/defaultDeviceImages/hard-disk-controllers.png
.png
WebUI/it/lib/images/defaultDeviceImages/human-interface-devices.png
.png
WebUI/it/lib/images/defaultDeviceImages/imaging-devices.png
.png
WebUI/it/lib/images/defaultDeviceImages/infrared-devices.png
.png
WebUI/it/lib/images/defaultDeviceImages/keyboards.png
.png
WebUI/it/lib/images/defaultDeviceImages/memory-technology-drivers.png
.png
WebUI/it/lib/images/defaultDeviceImages/mice-other-pointing-devices.png
.png
WebUI/it/lib/images/defaultDeviceImages/modems.png
.png
WebUI/it/lib/images/defaultDeviceImages/monitors.png
.png
WebUI/it/lib/images/defaultDeviceImages/multifunction-pcmcia.png
.png
WebUI/it/lib/images/defaultDeviceImages/network-adapters.png
.png
WebUI/it/lib/images/defaultDeviceImages/pcmcia-devices.png
.png
WebUI/it/lib/images/defaultDeviceImages/ports.png
.png
WebUI/it/lib/images/defaultDeviceImages/printers.png
.png
WebUI/it/lib/images/defaultDeviceImages/scsi-devices.png
.png
WebUI/it/lib/images/defaultDeviceImages/sdhost.png
.png
WebUI/it/lib/images/defaultDeviceImages/smart-card-readers.png
.png
WebUI/it/lib/images/defaultDeviceImages/sound-card.png
.png
WebUI/it/lib/images/defaultDeviceImages/sound-video-game-controllers.png
.png
WebUI/it/lib/images/defaultDeviceImages/system-devices.png
.png
WebUI/it/lib/images/defaultDeviceImages/tape-drives.png
.png
WebUI/it/lib/images/defaultDeviceImages/usb-devices.png
.png
WebUI/it/lib/images/defaultDeviceImages/windows-ce-usb-devices.png
.png
WebUI/it/lib/images/defaultDeviceImages/windows-portable-devices.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/acer.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/alienware.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/aopen.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/archos.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/asus.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/benq.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/brother.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/canon.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/casio.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/coby-electronics.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/coby.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/compaq.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/ctx-international.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/ctx.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/default.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/dell.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/ecs.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/emachines.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/fujitsu.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/gateway.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/gigabyte-technology.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/gigabyte.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/hannspree.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/hp.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/ibm.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/jvc.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/lenovo.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/lg.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/mcafee.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/medion.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/msi.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/nec-display-solutions.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/nec.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/ocz.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/olivetti.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/packard-bell.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/panasonic.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/samsung.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/sharp.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/sony.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/toshiba.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/umax.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/viewsonic.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/vizio.png
.png
WebUI/it/lib/images/defaultsystemimages/desktop/zotac.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/acer.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/alienware.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/aopen.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/archos.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/asus.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/benq.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/brother.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/canon.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/casio.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/coby-electronics.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/coby.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/compaq.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/ctx-international.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/ctx.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/default.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/dell.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/ecs.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/emachines.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/fujitsu.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/gateway.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/gigabyte-technology.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/gigabyte.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/hannspree.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/hp.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/ibm.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/jvc.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/lenovo.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/lg.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/mcafee.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/medion.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/msi.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/nec-display-solutions.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/nec.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/ocz.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/olivetti.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/packard-bell.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/packard.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/panasonic.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/samsung.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/sharp.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/sony.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/toshiba.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/umax.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/viewsonic.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/vizio.png
.png
WebUI/it/lib/images/defaultsystemimages/laptop/zotac.png
.png
WebUI/it/lib/images/download-popup/download/register_v03_bg.png
.png
WebUI/it/lib/images/download-popup/downloaing_update.png
.png
WebUI/it/lib/images/download-popup/update_loading.png
.png
WebUI/it/lib/images/header/logo.png
.png
WebUI/it/lib/images/header/menu/btns.png
.png
WebUI/it/lib/images/header/menu/btns.psd
WebUI/it/lib/images/home/laptop/lenovo.png
.png
WebUI/it/lib/images/home/laptop/lenovo1.png
.png
WebUI/it/lib/images/home/overview/bg.png
.png
WebUI/it/lib/images/home/overview/meter.png
.png
WebUI/it/lib/images/home/overview/meter_1.png
.png
WebUI/it/lib/images/home/overview/scan-meter.png
.png
WebUI/it/lib/images/home/overview/scan-meter_1.png
.png
WebUI/it/lib/images/home/overview/scan-meter_2.png
.png
WebUI/it/lib/images/home/progress/box.png
.png
WebUI/it/lib/images/home/progress/box2.png
.png
WebUI/it/lib/images/home/progress/downloading-file-bar.png
.png
WebUI/it/lib/images/home/progress/green_bar.png
.png
WebUI/it/lib/images/home/progress/green_bar1.png
.png
WebUI/it/lib/images/home/progress/red_bar.png
.png
WebUI/it/lib/images/home/progress/red_bar1.png
.png
WebUI/it/lib/images/home/progress/still_greenbar.png
.png
WebUI/it/lib/images/home/results/scanSmart.png
.png
WebUI/it/lib/images/icons/ajax-loader-small.gif
.gif
WebUI/it/lib/images/icons/arrow-down.gif
.gif
WebUI/it/lib/images/icons/arrow-down.png
.png
WebUI/it/lib/images/icons/arrow-up.gif
.gif
WebUI/it/lib/images/icons/blackcross.png
.png
WebUI/it/lib/images/icons/close.png
.png
WebUI/it/lib/images/icons/dll_error.png
.png
WebUI/it/lib/images/icons/download-icon.png
.png
WebUI/it/lib/images/icons/dr_category_heading-bg.png
.png
WebUI/it/lib/images/icons/driver-icon.png
.png
WebUI/it/lib/images/icons/error.png
.png
WebUI/it/lib/images/icons/error_found.png
.png
WebUI/it/lib/images/icons/error_found_icon1.png
.png
WebUI/it/lib/images/icons/error_found_icon2.png
.png
WebUI/it/lib/images/icons/error_found_icon3.png
.png
WebUI/it/lib/images/icons/errors-big.png
.png
WebUI/it/lib/images/icons/errors-big1.png
.png
WebUI/it/lib/images/icons/errors-big_1.png
.png
WebUI/it/lib/images/icons/feacture_list_circle.png
.png
WebUI/it/lib/images/icons/green-error-big.png
.png
WebUI/it/lib/images/icons/green-error-big1.png
.png
WebUI/it/lib/images/icons/green_no_error.png
.png
WebUI/it/lib/images/icons/green_round.png
.png
WebUI/it/lib/images/icons/hard-disk.png
.png
WebUI/it/lib/images/icons/info-icon.png
.png
WebUI/it/lib/images/icons/info.png
.png
WebUI/it/lib/images/icons/language_select.png
.png
WebUI/it/lib/images/icons/loading-spinner.gif
.gif
WebUI/it/lib/images/icons/loading-spinner_pause.png
.png
WebUI/it/lib/images/icons/no_error_1.png
.png
WebUI/it/lib/images/icons/pc-icon.png
.png
WebUI/it/lib/images/icons/problem.png
.png
WebUI/it/lib/images/icons/quardo_3dr-big.png
.png
WebUI/it/lib/images/icons/quardo_3dr.png
.png
WebUI/it/lib/images/icons/quardo_3dr1.png
.png
WebUI/it/lib/images/icons/question-mark.png
.png
WebUI/it/lib/images/icons/question.png
.png
WebUI/it/lib/images/icons/redCross-big.png
.png
WebUI/it/lib/images/icons/redCross-big1.png
.png
WebUI/it/lib/images/icons/red_round.png
.png
WebUI/it/lib/images/icons/redcross.png
.png
WebUI/it/lib/images/icons/redcross_1.png
.png
WebUI/it/lib/images/icons/repair_successfull.png
.png
WebUI/it/lib/images/icons/search_list.png
.png
WebUI/it/lib/images/icons/star-big.png
.png
WebUI/it/lib/images/icons/star-big1.png
.png
WebUI/it/lib/images/icons/start.png
.png
WebUI/it/lib/images/icons/system_repair_successfull.png
.png
WebUI/it/lib/images/icons/tools.png
.png
WebUI/it/lib/images/icons/win-icon.png
.png
WebUI/it/lib/images/icons/yellow_round.png
.png
WebUI/it/lib/images/loading-icon.gif
.gif
WebUI/it/lib/images/popup/Foot/foot.png
.png
WebUI/it/lib/images/popup/alert/body.png
.png
WebUI/it/lib/images/popup/alert/foot.png
.png
WebUI/it/lib/images/popup/alert/head.png
.png
WebUI/it/lib/images/popup/alert/logo.png
.png
WebUI/it/lib/images/popup/chipset.png
.png
WebUI/it/lib/images/popup/close1.png
.png
WebUI/it/lib/images/popup/close3.png
.png
WebUI/it/lib/images/popup/close4.png
.png
WebUI/it/lib/images/popup/close5.png
.png
WebUI/it/lib/images/popup/download/download_complete.png
.png
WebUI/it/lib/images/popup/download/download_complete_1.png
.png
WebUI/it/lib/images/popup/download/inner_bg.png
.png
WebUI/it/lib/images/popup/download/inner_bg_1.png
.png
WebUI/it/lib/images/popup/download_complete.png
.png
WebUI/it/lib/images/popup/downloaing_update.png
.png
WebUI/it/lib/images/popup/inner_bg-update.png
.png
WebUI/it/lib/images/popup/inner_bg.png
.png
WebUI/it/lib/images/popup/lb_inner_bg.png
.png
WebUI/it/lib/images/popup/lightbox-activation_bg.png
.png
WebUI/it/lib/images/popup/lightbox-update_driver-btm.png
.png
WebUI/it/lib/images/popup/lightbox-update_driver.png
.png
WebUI/it/lib/images/popup/lightbox/buttons.png
.png
WebUI/it/lib/images/popup/lightbox/close-btn.png
.png
WebUI/it/lib/images/popup/lightbox/downloading-file-icon.png
.png
WebUI/it/lib/images/popup/lightbox/downloading-file__inner-bg.png
.png
WebUI/it/lib/images/popup/lightbox/downloading-file_bg.png
.png
WebUI/it/lib/images/popup/lightbox/dr_icon.png
.png
WebUI/it/lib/images/popup/lightbox/dr_lightbox.png
.png
WebUI/it/lib/images/popup/lightbox/driverRestore-logo.png
.png
WebUI/it/lib/images/popup/lightbox/driverRestore-logo1.png
.png
WebUI/it/lib/images/popup/lightbox/lightbox-error.png
.png
WebUI/it/lib/images/popup/lightbox/progress.png
.png
WebUI/it/lib/images/popup/lightbox/progressBar-bg.png
.png
WebUI/it/lib/images/popup/lightbox/question.png
.png
WebUI/it/lib/images/popup/lightbox/sfpc-lightbox-logo.png
.png
WebUI/it/lib/images/popup/lightbox/un-lightbox-bg.png
.png
WebUI/it/lib/images/popup/logo.png
.png
WebUI/it/lib/images/popup/message box/msg-box.png
.png
WebUI/it/lib/images/popup/message_box/msg-box.png
.png
WebUI/it/lib/images/popup/message_box/msg-box1.png
.png
WebUI/it/lib/images/popup/message_box/msg-box1_inner.png
.png
WebUI/it/lib/images/popup/message_box/msg-box_inner.png
.png
WebUI/it/lib/images/popup/message_box/namefield-icon.png
.png
WebUI/it/lib/images/popup/message_box/question-mark.png
.png
WebUI/it/lib/images/popup/register0/foot_2.png
.png
WebUI/it/lib/images/popup/register2/content.png
.png
WebUI/it/lib/images/popup/register2/content_1.png
.png
WebUI/it/lib/images/popup/register2/head.png
.png
WebUI/it/lib/images/popup/register2/inner_content.png
.png
WebUI/it/lib/images/popup/register2/inner_content_1.png
.png
WebUI/it/lib/images/popup/register2/input.png
.png
WebUI/it/lib/images/popup/register2/lock.png
.png
WebUI/it/lib/images/popup/register2/logo.png
.png
WebUI/it/lib/images/popup/register3/loadingBar.gif
.gif
WebUI/it/lib/images/popup/tosters/back_errow.png
.png
WebUI/it/lib/images/popup/tosters/dell-wireless.png
.png
WebUI/it/lib/images/popup/tosters/dell-wireless1.png
.png
WebUI/it/lib/images/popup/tosters/error.png
.png
WebUI/it/lib/images/popup/tosters/inner_upgrade-toster.png
.png
WebUI/it/lib/images/popup/tosters/inner_upgrade-toster1.png
.png
WebUI/it/lib/images/popup/tosters/logo.png
.png
WebUI/it/lib/images/popup/tosters/logo1.png
.png
WebUI/it/lib/images/popup/tosters/next_errow.png
.png
WebUI/it/lib/images/popup/tosters/red_header.png
.png
WebUI/it/lib/images/popup/tosters/upgrade-toster.png
.png
WebUI/it/lib/images/popup/tosters/upgrade-toster1.png
.png
WebUI/it/lib/images/popup/tosters/upgrade-toster3.png
.png
WebUI/it/lib/images/popup/update_loading.png
.png
WebUI/it/lib/images/popup_image/bottom_bg.png
.png
WebUI/it/lib/images/popup_image/buttons.png
.png
WebUI/it/lib/images/popup_image/close-btn.png
.png
WebUI/it/lib/images/popup_image/dr_icon.png
.png
WebUI/it/lib/images/popup_image/dr_update_supporter.png
.png
WebUI/it/lib/images/popup_image/feedback-bg.png
.png
WebUI/it/lib/images/popup_image/msg-box_inner.png
.png
WebUI/it/lib/images/popup_image/msg-box_inner_bottom.png
.png
WebUI/it/lib/images/popup_image/msg-box_inner_top.png
.png
WebUI/it/lib/images/popup_image/thanks4feedback-bg.png
.png
WebUI/it/lib/images/popup_image/thanks4feedback-top_bg.png
.png
WebUI/it/lib/images/popup_image/thanks4feedback_bottom-bg.png
.png
WebUI/it/lib/images/popup_image/top_bg.png
.png
WebUI/it/lib/images/tabs.png
.png
WebUI/it/lib/images/toasters/bg.png
.png
WebUI/it/lib/images/toasters/close4.png
.png
WebUI/it/lib/images/toasters/next-arrow.png
.png
WebUI/it/lib/jquery.customSelect-master/README
WebUI/it/lib/jquery.customSelect-master/component.json
WebUI/it/lib/jquery.customSelect-master/customSelect-arrow.gif
.gif
WebUI/it/lib/jquery.customSelect-master/customSelect-arrow.png
.jpg
WebUI/it/lib/jquery.customSelect-master/dropdown_bg-1.jpg
.jpg
WebUI/it/lib/jquery.customSelect-master/dropdown_bg.jpg
.jpg
WebUI/it/lib/jquery.customSelect-master/dropdown_bg_grey.jpg
.jpg
WebUI/it/lib/jquery.customSelect-master/index.html
.js
WebUI/it/lib/jquery.customSelect-master/jquery.customSelect.js
.js
WebUI/it/lib/jquery.customSelect-master/jquery.customSelect.min.js
.js
WebUI/it/lib/js/About/AboutlView.js
.js
WebUI/it/lib/js/About/Events.js
.js
WebUI/it/lib/js/About/Model.js
.js
WebUI/it/lib/js/Main/Events.js
.js
WebUI/it/lib/js/Main/MainView.js
.js
WebUI/it/lib/js/Main/Model.js
.js
WebUI/it/lib/js/Overview/BannerView.js
.js
WebUI/it/lib/js/Overview/BottomView.js
.js
WebUI/it/lib/js/Overview/ContentView.js
.js
WebUI/it/lib/js/Overview/Events.js
.js
WebUI/it/lib/js/Overview/Model.js
.js
WebUI/it/lib/js/Popups/Activation/Activation.js
.js
WebUI/it/lib/js/Popups/Feedback/Events.js
.js
WebUI/it/lib/js/Popups/Feedback/FeedbackView.js
.js
WebUI/it/lib/js/Popups/Feedback/Model.js
.js
WebUI/it/lib/js/Popups/QuestionForm/QuestionForm.js
.js
WebUI/it/lib/js/Popups/RegisterNow/RegisterNow.js
.js
WebUI/it/lib/js/Popups/RegistrationFlow/ActionView.js
.js
WebUI/it/lib/js/Popups/RegistrationFlow/BottomView.js
.js
WebUI/it/lib/js/Popups/RegistrationFlow/ContainerView.js
.js
WebUI/it/lib/js/Popups/RegistrationFlow/Events.js
.js
WebUI/it/lib/js/Popups/RegistrationFlow/LeftContentView.js
.js
WebUI/it/lib/js/Popups/RegistrationFlow/Model.js
.js
WebUI/it/lib/js/Popups/RegistrationFlow/RightContentView.js
.js
WebUI/it/lib/js/Popups/RegistrationFlow/TopView.js
.js
WebUI/it/lib/js/Popups/TechSupport/Events.js
.js
WebUI/it/lib/js/Popups/TechSupport/TechSupport.js
.js
WebUI/it/lib/js/Popups/UpdateDrivers/Events.js
.js
WebUI/it/lib/js/Popups/UpdateDrivers/Model.js
.js
WebUI/it/lib/js/Popups/UpdateDrivers/UpdateDriversView.js
.js
WebUI/it/lib/js/Settings/settings.js
.js
WebUI/it/lib/js/SystemScan/DriversView.js
.js
WebUI/it/lib/js/SystemScan/Events.js
.js
WebUI/it/lib/js/SystemScan/Model.js
.js
WebUI/it/lib/js/SystemScan/ProgressView.js
.js
WebUI/it/lib/js/SystemScan/ScanSummaryView.js
.js
WebUI/it/lib/js/SystemScan/SystemInfoView.js
.js
WebUI/it/lib/js/Toasters/InstallAvailable/Events.js
.js
WebUI/it/lib/js/Toasters/InstallAvailable/InstallAvailableView.js
.js
WebUI/it/lib/js/Toasters/InstallAvailable/Model.js
.js
WebUI/it/lib/js/Toasters/UpdateFromFolder/Model.js
.js
WebUI/it/lib/js/Toasters/UpdateFromFolder/UpdateFromFolderView.js
.js
WebUI/it/lib/js/Toasters/UpdateFromWeb/Model.js
.js
WebUI/it/lib/js/Toasters/UpdateFromWeb/UpdateFromWebView.js
.js
WebUI/it/lib/js/Toasters/UpdatesAvailable/Events.js
.js
WebUI/it/lib/js/Toasters/UpdatesAvailable/Model.js
.js
WebUI/it/lib/js/Toasters/UpdatesAvailable/UpdatesAvailableView.js
.js
WebUI/it/lib/js/Update/Events.js
.js
WebUI/it/lib/js/Update/Model.js
.js
WebUI/it/lib/js/Update/UpdateView.js
.js
WebUI/it/lib/js/csharpglue.js
.js
WebUI/it/lib/js/expand.js
.js
WebUI/it/lib/js/jquery-1.10.2.min.js
.js
WebUI/it/lib/js/jquery.mCustomScrollbar.concat.min.js
.js
WebUI/it/lib/js/jquery.mCustomScrollbar.css
WebUI/it/lib/js/jquery.min.js
.js
WebUI/it/lib/js/main_router.js
.js
WebUI/it/lib/scripts/custom.js
.js
WebUI/it/lib/scripts/expand.js
.js
WebUI/it/lib/scripts/html5shiv.js
.js
WebUI/it/lib/scripts/jquery-ui-1.10.4.custom.min.js
.js
WebUI/it/lib/scripts/jquery.json-2.4.min.js
.js
WebUI/it/lib/scripts/jquery.min.js
.js
WebUI/it/lib/scripts/jquery.spritely.js
.js
WebUI/it/lib/scripts/jquery.timeentry.js
.js
WebUI/it/lib/scripts/timepicker/jquery.datepick.js
.js
WebUI/it/lib/scripts/timepicker/jquery.strings.js
.js
WebUI/it/lib/scripts/timepicker/jquery.ui.all.js
.js
WebUI/it/lib/scripts/timepicker/jquery.utils.js
.js
WebUI/it/lib/scripts/timepicker/ui.timepickr.js
.js
WebUI/it/main.html
WebUI/it/overview.html
WebUI/it/popups/activation_lightbox.html
WebUI/it/popups/feedback.html
WebUI/it/popups/question_form.html
WebUI/it/popups/register_now.html
WebUI/it/popups/registration_flow.html
.html
WebUI/it/popups/tech_support.html
WebUI/it/popups/update.html
WebUI/it/popups/update_driver.html
WebUI/it/settings.html
.js
WebUI/it/system_scan.html
.js
WebUI/it/toasters/installavailable.html
WebUI/it/toasters/updatefromfolder.html
WebUI/it/toasters/updatefromweb.html
.js
WebUI/it/toasters/updatesavailable.html
driver/DrvAgent32.cat
driver/DrvAgent32.inf
driver/DrvAgent32.sys
.sys windows:4 windows x86 arch:x86

4e72b1b978041eca09c010eef08b325e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:3d:2f:2f:b6:b9:00:5e:29:5e:3c:95:96:b6:44:25:13
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

20/08/2013, 20:02

Not After

21/08/2014, 20:02

Subject

CN=eSupport.com\, Inc,O=eSupport.com\, Inc,L=North Andover,ST=Massachusetts,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:e6:55:96:10:3b:a7:67:a9:fd:2f:2d:1e:22:d5:44:da:d7:3d:33
Signer

Actual PE Digest

28:e6:55:96:10:3b:a7:67:a9:fd:2f:2d:1e:22:d5:44:da:d7:3d:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntoskrnl.exe

RtlInitUnicodeString
IoDetachDevice
IofCallDriver
ZwClose
ZwMapViewOfSection
ObReferenceObjectByHandle
ZwOpenSection
ZwUnmapViewOfSection
KeInsertQueueDpc
MmUnmapIoSpace
KeSynchronizeExecution
KeInitializeDpc
MmFreeContiguousMemory
MmAllocateContiguousMemory
MmGetPhysicalAddress
MmBuildMdlForNonPagedPool
MmMapLockedPages
IoAllocateMdl
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
KeSetEvent
ObfDereferenceObject
IoFreeMdl
MmUnmapLockedPages
IofCompleteRequest
KeInitializeSpinLock
ExAllocatePool
RtlAppendUnicodeStringToString
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
IoAttachDevice
IoRegisterShutdownNotification
IoUnregisterShutdownNotification
memmove
RtlIntegerToUnicodeString
IoConnectInterrupt
IoDisconnectInterrupt
ZwOpenKey
ZwCreateKey
MmMapIoSpace
ExFreePool
ExAllocatePoolWithTag

hal

WRITE_PORT_BUFFER_USHORT
HalGetInterruptVector
HalSetBusDataByOffset
HalTranslateBusAddress
KeStallExecutionProcessor
HalGetBusDataByOffset
HalGetBusData
WRITE_PORT_BUFFER_ULONG
WRITE_PORT_BUFFER_UCHAR
READ_PORT_BUFFER_ULONG
READ_PORT_BUFFER_USHORT
READ_PORT_BUFFER_UCHAR
WRITE_PORT_ULONG
WRITE_PORT_USHORT
WRITE_PORT_UCHAR
READ_PORT_ULONG
READ_PORT_USHORT
READ_PORT_UCHAR
KfReleaseSpinLock
KfAcquireSpinLock

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 192B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 32B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.STL
Size: 32B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 992B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
driver/DrvAgent64.cat
driver/DrvAgent64.inf
driver/DrvAgent64.sys
.sys windows:6 windows x64 arch:x64

08c7f29f5cb29ba70e49879da2e8ddce

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:3d:2f:2f:b6:b9:00:5e:29:5e:3c:95:96:b6:44:25:13
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

20/08/2013, 20:02

Not After

21/08/2014, 20:02

Subject

CN=eSupport.com\, Inc,O=eSupport.com\, Inc,L=North Andover,ST=Massachusetts,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

94:f7:57:5a:6b:b3:78:d0:cf:85:b3:dc:65:94:1c:95:41:5e:7a:80
Signer

Actual PE Digest

94:f7:57:5a:6b:b3:78:d0:cf:85:b3:dc:65:94:1c:95:41:5e:7a:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\tvichw60\users\phdrv\tvicsys64\Free\amd64\Agent64.pdb

Imports

ntoskrnl.exe

KeInitializeDpc
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
IofCallDriver
ExFreePoolWithTag
ExAllocatePool
ZwClose
MmUnmapLockedPages
IoDeleteDevice
KeSetEvent
MmFreeContiguousMemory
MmUnmapIoSpace
IoFreeMdl
ZwUnmapViewOfSection
IoConnectInterrupt
IoDisconnectInterrupt
IoStartNextPacket
KeInsertQueueDpc
MmMapLockedPages
ZwMapViewOfSection
MmBuildMdlForNonPagedPool
MmGetPhysicalAddress
MmMapLockedPagesSpecifyCache
ObReferenceObjectByHandle
ZwOpenSection
IoAllocateMdl
MmAllocateContiguousMemory
KeBugCheckEx
RtlInitUnicodeString
_snwprintf
IoCreateNotificationEvent
IoDeleteSymbolicLink

hal

HalTranslateBusAddress
HalGetInterruptVector
KeStallExecutionProcessor

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
driver/install_driver.exe
.exe windows:4 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:3d:2f:2f:b6:b9:00:5e:29:5e:3c:95:96:b6:44:25:13
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

20/08/2013, 20:02

Not After

21/08/2014, 20:02

Subject

CN=eSupport.com\, Inc,O=eSupport.com\, Inc,L=North Andover,ST=Massachusetts,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

72:af:b3:99:49:c1:70:f2:0c:af:e5:16:38:5d:32:df:2a:b2:b8:fe
Signer

Actual PE Digest

72:af:b3:99:49:c1:70:f2:0c:af:e5:16:38:5d:32:df:2a:b2:b8:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dwc.dll
.dll windows:4 windows x86 arch:x86

bd9201277d94236850289a151f30d02d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2015, 00:00

Not After

18/11/2018, 23:59

Subject

SERIALNUMBER=C3712890,CN=Secure Installer Inc,O=Secure Installer Inc,L=Pleasanton,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

57:79:a3:11:db:42:85:6f:11:fb:51:41:87:a3:81:4b:eb:0c:16:8e
Signer

Actual PE Digest

57:79:a3:11:db:42:85:6f:11:fb:51:41:87:a3:81:4b:eb:0c:16:8e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
GetErrorInfo
SysFreeString
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegEnumValueA
RegEnumKeyA
RegCloseKey
OpenThreadToken
OpenProcessToken
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid

user32

GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExA
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongA
SetCapture
SetActiveWindow
SendMessageW
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageW
PeekMessageA
OffsetRect
OemToCharA
MessageBoxA
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageW
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMessagePos
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClientRect
GetClassLongA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout

kernel32

GetACP
Sleep
VirtualFree
VirtualAlloc
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
CreateDirectoryA
ExitProcess
CompareStringA
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
lstrlenW
lstrlenA
lstrcpyA
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SizeofResource
SetThreadPriority
SetThreadLocale
SetPriorityClass
SetLastError
SetFileTime
SetFilePointer
SetFileAttributesW
SetFileAttributesA
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
RemoveDirectoryA
ReadFile
MultiByteToWideChar
MulDiv
LockResource
LocalFileTimeToFileTime
LoadResource
LoadLibraryA
LeaveCriticalSection
IsValidCodePage
IsDBCSLeadByte
IsBadReadPtr
InitializeCriticalSection
GlobalMemoryStatus
GlobalFree
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetWindowsDirectoryA
GetVersionExA
GetVersion
GetTickCount
GetThreadPriority
GetThreadLocale
GetTempPathA
GetTempFileNameA
GetSystemDirectoryA
GetStdHandle
GetProcAddress
GetPriorityClass
GetModuleHandleA
GetModuleFileNameA
GetLogicalDrives
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
GetCPInfo
GetACP
FreeResource
InterlockedExchange
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DosDateTimeToFileTime
DeviceIoControl
DeleteFileW
DeleteFileA
DeleteCriticalSection
CreateThread
CreateFileW
CreateFileA
CreateEventA
CreateDirectoryA
CopyFileA
CompareStringA
CloseHandle
Sleep
GetThreadLocale
GetThreadLocale
ord31
ord24
ord37
ord36
ord35

gdi32

UnrealizeObject
StretchBlt
SetWindowOrgEx
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
RectVisible
RealizePalette
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectA
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
BitBlt

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ole32

CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize

comctl32

_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc

cfgmgr32

CM_Get_DevNode_Status

setupapi

SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsExA
SetupDiCreateDeviceInfoList

Exports

Exports

dwcCleanupConnDeviceList
dwcExtractFiles
dwcGetComputername
dwcGetCurrentStepDescription
dwcGetScanDeviceXML
dwcGetScanID
dwcGetScanStepsDescription
dwcGetScanXML
dwcGetScanXML_zipped
dwcInitialize
dwcPerformDeviceScan
dwcPerformScan
dwcScanSysInfo
dwcSetCurrentStepDescription
dwcSetScanOptions
dwcSetScanXML
dwcVersion

Sections

.text
Size: 590KB - Virtual size: 590KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 122KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 539B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
icon.ico
settings.xml
.xml
unrar.dll
.dll windows:4 windows x86 arch:x86

244d2f9772f4886a651db44514a2a29b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2015, 00:00

Not After

18/11/2018, 23:59

Subject

SERIALNUMBER=C3712890,CN=Secure Installer Inc,O=Secure Installer Inc,L=Pleasanton,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a8:37:81:52:2e:63:76:c8:ce:f0:cd:03:30:02:38:5d:9e:a1:58:1b
Signer

Actual PE Digest

a8:37:81:52:2e:63:76:c8:ce:f0:cd:03:30:02:38:5d:9e:a1:58:1b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
SetFileSecurityW

kernel32

CloseHandle
CompareStringA
CompareStringW
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
DeviceIoControl
ExitProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FreeEnvironmentStringsA
FreeLibrary
GetACP
GetCPInfo
GetCurrentProcess
GetCurrentThreadId
GetEnvironmentStrings
GetFileAttributesA
GetFileAttributesW
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
IsDBCSLeadByte
LCMapStringA
LoadLibraryA
LocalFileTimeToFileTime
MoveFileA
MultiByteToWideChar
RaiseException
ReadFile
RtlUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
SetHandleCount
Sleep
SystemTimeToFileTime
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WideCharToMultiByte
WriteFile

user32

CharLowerA
CharLowerW
CharToOemA
CharToOemBuffA
CharUpperA
CharUpperW
EnumThreadWindows
MessageBoxA
OemToCharA
OemToCharBuffA
wsprintfA

Exports

Exports

RARCloseArchive
RARGetDllVersion
RAROpenArchive
RAROpenArchiveEx
RARProcessFile
RARProcessFileW
RARReadHeader
RARReadHeaderEx
RARSetCallback
RARSetChangeVolProc
RARSetPassword
RARSetProcessDataProc
___CPPdebugHook

Sections

.text
Size: 131KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f67aeda01a0484282e8c59006b0b352

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4fCertificate

Extended Key Usages

Key Usages

d8:c5:e7:0a:13:a4:e9:67:26:78:b1:ef:21:83:4d:9b:58:aa:06:e1Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 106KB

.ndata Size: - Virtual size: 104KB

.rsrc Size: 9KB - Virtual size: 8KB

0ece15e7d9bb35972aec701f46192460

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 512B - Virtual size: 502B

.data Size: - Virtual size: 108B

.rsrc Size: 1024B - Virtual size: 912B

.reloc Size: 512B - Virtual size: 262B

b7a0648cf67d5ae9aee89c880d26b206

Headers

DLL Characteristics

File Characteristics

Imports

uxtheme

kernel32

user32

gdi32

shell32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 48KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 7KB

154903d617e825e7d4f76664593675fd

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

22:aa:79:df:c5:93:b1:22:22:8f:38:16:1f:c4:41:4f
Certificate

d8:c5:e7:0a:13:a4:e9:67:26:78:b1:ef:21:83:4d:9b:58:aa:06:e1
Signer

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 106KB

.ndata
Size: - Virtual size: 104KB

.rsrc
Size: 9KB - Virtual size: 8KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 512B - Virtual size: 502B

.data
Size: - Virtual size: 108B

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 512B - Virtual size: 262B

.text
Size: 48KB - Virtual size: 48KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 697B

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 364B

.text
Size: 46KB - Virtual size: 45KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 40KB

.reloc
Size: 3KB - Virtual size: 2KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 851B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 1024B - Virtual size: 608B

.text
Size: 10KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 852B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 1024B - Virtual size: 972B

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB