146c4f44edd06b93ba0aa79b5205678e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

146c4f44edd06b93ba0aa79b5205678e_JaffaCakes118
Size

19.1MB
MD5

146c4f44edd06b93ba0aa79b5205678e
SHA1

902cf446efa15e5357dc58ff1fccda389e6e1eaf
SHA256

418db447e612aa711fbae154ecf3a495ffdf866f5ce1a5bdc2034f29c769aa3a
SHA512

481148f5f4597cff4355ce8c3340875caed6d833f064467d43bcbd7bddfcb104804163ce9896f5481e2eca0e502316960f6967c773e92a2b3de2fba4532551ab
SSDEEP

393216:eyx1bCM8BuuSUiv/28CEAL2ODVsMRvWg+1d65e1th1Bpe89xHQ1T:3x1uM8sX/2REASqiMBWd1wCjBZ9xHW

Score

6^/10

pdf evasion

Malware Config

Signatures

Malformed or missing cross-reference table in PDF
Malformed or missing cross-reference tables are often used to evade detection
pdf evasion

Unsigned PE 45 IoCs

Checks for missing Authenticode signature.

resource
146c4f44edd06b93ba0aa79b5205678e_JaffaCakes118
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/CustomLicense.dll
unpack002/$PLUGINSDIR/GetVersion.dll
unpack002/$PLUGINSDIR/KillProcDLL.dll
unpack002/$PLUGINSDIR/Math.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/inetc.dll
unpack002/$PLUGINSDIR/jsonparser.dll
unpack002/$PLUGINSDIR/linker.dll
unpack002/$PLUGINSDIR/md5dll.dll
unpack002/$PLUGINSDIR/nsDialogs.dll
unpack002/$PLUGINSDIR/nsisunz.dll
unpack002/$PLUGINSDIR/sqlwrap.dll
unpack003/$PLUGINSDIR/InstallOptions.dll
unpack003/$PLUGINSDIR/KillProcDLL.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UserInfo.dll
unpack003/$PLUGINSDIR/md5dll.dll
unpack004/$PLUGINSDIR/Base64.dll
unpack004/$PLUGINSDIR/KillProcDLL.dll
unpack004/$PLUGINSDIR/NSISdl.dll
unpack004/$PLUGINSDIR/System.dll
unpack004/$PLUGINSDIR/inetc.dll
unpack004/$PLUGINSDIR/md5dll.dll
unpack004/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Uninstall.exe
unpack001/pdflite.exe
unpack001/pdfprinter/DriverFiles/32/redmonnt.dll
unpack001/pdfprinter/DriverFiles/32/setup.exe
unpack001/pdfprinter/DriverFiles/32/unredmon.exe
unpack001/pdfprinter/DriverFiles/64/PS5UI.DLL
unpack001/pdfprinter/DriverFiles/64/PSCRIPT5.DLL
unpack001/pdfprinter/DriverFiles/64/redmonnt.dll
unpack001/pdfprinter/DriverFiles/64/setup.exe
unpack001/pdfprinter/DriverFiles/64/unredmon.exe
unpack001/pdfprinter/PDFLiteConverter.exe
unpack001/pdfprinter/PDFLiteInstall.dll
unpack001/pdfprinter/gsdll32.dll
unpack001/pdfprinter/pdflite_printer.exe
unpack001/uninstall.exe

NSIS installer 10 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$PLUGINSDIR/amns-pdflite-silent.exe	nsis_installer_1
static1/unpack001/$PLUGINSDIR/amns-pdflite-silent.exe	nsis_installer_2
static1/unpack002/$_106_/AskSearchAsst.exe	nsis_installer_1
static1/unpack002/$_106_/AskSearchAsst.exe	nsis_installer_2
static1/unpack002/$_106_/SearchToolbarUninstall.exe	nsis_installer_1
static1/unpack002/$_106_/SearchToolbarUninstall.exe	nsis_installer_2
static1/unpack001/Uninstall.exe	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_2

Files

146c4f44edd06b93ba0aa79b5205678e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/FindProcDLL.dll
.dll windows:4 windows x86 arch:x86

c480ee4d2a64d4a16edee43fdfe35079

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
HeapCreate
VirtualFree
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
FreeLibrary
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
DisableThreadLibraryCalls
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetACP
GetOEMCP
WriteFile
VirtualAlloc
RtlUnwind
GetStringTypeA
GetStringTypeW
GetCPInfo

user32

wsprintfA

Exports

Exports

FindProc

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/amns-pdflite-silent.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

46:24:1c:de:5c:7b:50:0b:51:c5:f1:32:82:28:f2:a9
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

28/01/2011, 00:00

Not After

27/01/2013, 23:59

Subject

CN=Zugo Ltd,O=Zugo Ltd,POSTALCODE=JE4 9NU,STREET=37 Broad St.+STREET=1st Floor+STREET=PO Box 36,L=St Helier,ST=Jersey,C=JE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:f4:52:67:65:64:df:c9:32:17:fb:d2:9a:a9:c0:f3:6e:54:55:80
Signer

Actual PE Digest

0a:f4:52:67:65:64:df:c9:32:17:fb:d2:9a:a9:c0:f3:6e:54:55:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 228KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/CustomLicense.dll
.dll windows:4 windows x86 arch:x86

363f09c4ee70037c4ff39dc2ebdb0b27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
GlobalFree
CloseHandle
ReadFile
GlobalAlloc
GetFileSize
CreateFileA
lstrcpyA
lstrcpynA

user32

SendMessageA

Exports

Exports

LoadFile

Sections

.text
Size: 512B - Virtual size: 418B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 397B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 98B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/GetVersion.dll
.dll windows:4 windows x86 arch:x86

5e41893d1528e7648e03f81030aca366

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
lstrcmpiA
GetSystemInfo
GlobalAlloc
lstrcpynA
GetModuleHandleA
lstrcatA
GetVersionExA

user32

wsprintfA
GetSystemMetrics

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Exports

Exports

WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsServicePack
WindowsServicePackBuild
WindowsServicePackMajor
WindowsServicePackMinor
WindowsType
WindowsVersion

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 374B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

153027ec3b10bcea606b777657dd3402

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
TerminateProcess
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
FreeLibrary
GlobalFree
lstrcpyA
DisableThreadLibraryCalls

msvcrt

strcmp
_strupr
toupper
strlen
free
_initterm
malloc
_adjust_fdiv
strcpy
_itoa

Exports

Exports

KillProc

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Math.dll
.dll windows:4 windows x86 arch:x86

c1eddc2d743572429fa0b1a79b7ac0fe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
lstrcmpA
lstrlenA
GlobalFree
lstrcatA
GlobalAlloc
lstrcpynA
FlushFileBuffers
RtlUnwind
GetCommandLineA
GetVersion
RaiseException
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetLastError
SetFilePointer
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
CloseHandle

Exports

Exports

Script

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/TrackJSON.json
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

5bdcdde5acd7b395f3f3d19ebbb8c6cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_mbschr
_adjust_fdiv
malloc
_initterm
free
strlen
strchr
strrchr
_mbsrchr
strtoul
memset
_mbsstr
strtol

kernel32

GlobalFree
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrcmpiA
CreateFileA
GetFileSize
lstrlenA
WriteFile
ReadFile
lstrcmpA
lstrcpynA
lstrcatA
GetLastError
DeleteFileA
CloseHandle
SleepEx
SetFilePointer
GetTickCount

user32

MessageBoxA
GetParent
ShowWindow
SetWindowLongA
IsWindow
SetWindowTextA
SendDlgItemMessageA
GetDlgItem
PostMessageA
GetWindowTextA
SendMessageA
SetDlgItemTextA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindowVisible
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
GetWindowLongA

wininet

HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/jsonparser.dll
.dll windows:4 windows x86 arch:x86

9477ce594d6aa3189ce13a8753710458

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
lstrlenA
lstrcpynA
GlobalFree
GlobalAlloc
lstrcpyA

user32

wsprintfA

msvcrt

exit
vprintf
??2@YAPAXI@Z
strlen
sscanf
sprintf
strchr
_strnicmp
_pctype
_lseek
__mb_cur_max
strncpy
memcpy
strcpy
atof
atol
__CxxFrameHandler
_EH_prolog
tolower
isalpha
isdigit
??3@YAXPAX@Z
strcmp
__dllonexit
_onexit
_initterm
_adjust_fdiv
_vsnprintf
malloc
realloc
memset
calloc
free
_read
strtok
_open
_isctype
_strdup
_close
_write

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

Exports

Exports

del
escape
get
load
save
set
startnew
unescape
unload

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/linker.dll
.dll windows:4 windows x86 arch:x86

5b9be84907034b8f0152e51177ceafc3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GetModuleHandleA
lstrcpynA
lstrcpyA
GlobalFree

user32

UpdateWindow
InvalidateRect
SetCapture
SetFocus
PtInRect
GetWindowRect
GetDC
ReleaseCapture
EndPaint
BeginPaint
SetCursor
LoadCursorA
CallWindowProcA
DestroyCursor
SetWindowLongA
CreateCursor
IsWindow
ReleaseDC
SetWindowPos
GetWindowLongA
SendMessageA
GetClientRect
FillRect
GetFocus
DrawFocusRect
DrawTextA
ClientToScreen

gdi32

SetBkMode
SetTextColor
CreateFontIndirectA
GetObjectA
GetStockObject
DeleteObject
SelectObject

shell32

ShellExecuteA

Exports

Exports

Link
Unload

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/md5dll.dll
.dll windows:4 windows x86 arch:x86

e57536e0d3500471d52df7cea0d65a39

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
lstrcpyA
lstrcpynA
GetTickCount
Sleep
lstrcatA
lstrlenA
CloseHandle
ReadFile
CreateFileA

user32

wsprintfA

Exports

Exports

GetFileMD5
GetMD5
GetMD5File
GetMD5Random
GetMD5String

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 134B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nshist.dll
.dll windows:4 windows x86 arch:x86

05b9f1ebdef9b89ef8ee9c4544aec8f9

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

46:24:1c:de:5c:7b:50:0b:51:c5:f1:32:82:28:f2:a9
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

28/01/2011, 00:00

Not After

27/01/2013, 23:59

Subject

CN=Zugo Ltd,O=Zugo Ltd,POSTALCODE=JE4 9NU,STREET=37 Broad St.+STREET=1st Floor+STREET=PO Box 36,L=St Helier,ST=Jersey,C=JE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:5d:10:61:e5:0a:e5:4f:2e:ee:01:5a:6d:50:99:8c:14:c9:02:f5
Signer

Actual PE Digest

06:5d:10:61:e5:0a:e5:4f:2e:ee:01:5a:6d:50:99:8c:14:c9:02:f5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA
GlobalFree
GlobalAlloc
Process32Next
Process32First
lstrcpyA
DeleteFileA
CloseHandle
WriteFile
GetLastError
CreateFileA
lstrlenA
lstrcatA
LoadLibraryA
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
GetTickCount
WideCharToMultiByte
lstrlenW
LocalFree

user32

wvsprintfA

ole32

CoCreateInstance
OleInitialize
OleUninitialize

wininet

HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetQueryOptionA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
InternetCloseHandle
InternetSetOptionA
InternetOpenA

msvcrt

_strdup
_CxxThrowException
_adjust_fdiv
malloc
_initterm
strncat
strstr
realloc
srand
atol
rand
??1type_info@@UAE@XZ
fopen
??2@YAPAXI@Z
??3@YAXPAX@Z
sprintf
__CxxFrameHandler
tolower
strncpy
free
_splitpath
fclose
fread

Exports

Exports

gethist

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsisunz.dll
.dll windows:4 windows x86 arch:x86

0f92772da9c737d2bac38919e9863980

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryA
lstrcpyA
lstrcmpA
lstrcmpiA
GlobalFree
lstrcpynA
GlobalAlloc
lstrcatA
lstrlenA
GetVersion
LeaveCriticalSection
EnterCriticalSection
GetStdHandle
HeapAlloc
GetProcessHeap
HeapFree
GetLastError
CreateFileA
WriteFile
ReadFile
CloseHandle
SetFilePointer

user32

MessageBoxA
DispatchMessageA
TranslateMessage
PeekMessageA
CharPrevA
wsprintfA
SendMessageA
GetDlgItem
FindWindowExA

Exports

Exports

Unzip
UnzipToLog
UnzipToStack
extract_RunDLL

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 706B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/sqlwrap.dll
.dll windows:4 windows x86 arch:x86

d0a8e95f1dc2c9f439b1898a45fa79aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
GetProcAddress
LoadLibraryA
SetCurrentDirectoryA
GetCurrentDirectoryA
lstrcatA
FreeLibrary

user32

wsprintfA

msvcrt

strcpy
_splitpath
free
_initterm
malloc
_adjust_fdiv

Exports

Exports

close
execsqlite
open
raw_close
raw_execsqlite
raw_open

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 394B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R0/bing-zugo.xml
.xml
$_106_/AskSearchAsst.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

28:6f:8a:30:e2:ea:c6:96:5b:93:6f:82:6a:05:30:5d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/06/2008, 00:00

Not After

17/06/2011, 23:59

Subject

CN=Ask.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Distribution,O=Ask.com,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:16:5a:d7:ea:fe:05:11:f9:20:a5:3c:93:ef:0d:b6:3a:30:f3:03
Signer

Actual PE Digest

0e:16:5a:d7:ea:fe:05:11:f9:20:a5:3c:93:ef:0d:b6:3a:30:f3:03

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

153027ec3b10bcea606b777657dd3402

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
TerminateProcess
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
FreeLibrary
GlobalFree
lstrcpyA
DisableThreadLibraryCalls

msvcrt

strcmp
_strupr
toupper
strlen
free
_initterm
malloc
_adjust_fdiv
strcpy
_itoa

Exports

Exports

KillProc

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

afa8e526425f3585465337467d0b5909

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
lstrcpynA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 741B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 673B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/md5dll.dll
.dll windows:4 windows x86 arch:x86

e57536e0d3500471d52df7cea0d65a39

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
lstrcpyA
lstrcpynA
GetTickCount
Sleep
lstrcatA
lstrlenA
CloseHandle
ReadFile
CreateFileA

user32

wsprintfA

Exports

Exports

GetFileMD5
GetMD5
GetMD5File
GetMD5Random
GetMD5String

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 134B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$_30_/searchplugins/ask.uk.xml
$_106_/AskSearchAsst.ini
$_106_/SearchToolbarUninstall.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17/05/2005, 00:00

Not After

16/05/2010, 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c5:2f:d6:f7:88:66:44:35:8c:53:9d:8f:c5:0b:cc:93
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

26/01/2010, 00:00

Not After

26/01/2011, 23:59

Subject

CN=Zugo Ltd,O=Zugo Ltd,POSTALCODE=JE4 9NU,STREET=37 Broad St.+STREET=1st Floor+STREET=PO Box 36,L=St Helier,ST=Jersey,C=JE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1a:b5:95:c4:6a:5a:50:28:84:42:17:45:00:5d:ae:43:ec:18:17:a3
Signer

Actual PE Digest

1a:b5:95:c4:6a:5a:50:28:84:42:17:45:00:5d:ae:43:ec:18:17:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 136KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Base64.dll
.dll windows:4 windows x86 arch:x86

71822a6591db32058c3984a70d90133c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
lstrlenA

Exports

Exports

Decode
Encode

Sections

.text
Size: 1024B - Virtual size: 851B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 261B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

153027ec3b10bcea606b777657dd3402

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
TerminateProcess
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
FreeLibrary
GlobalFree
lstrcpyA
DisableThreadLibraryCalls

msvcrt

strcmp
_strupr
toupper
strlen
free
_initterm
malloc
_adjust_fdiv
strcpy
_itoa

Exports

Exports

KillProc

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

8773e19ae02f331332db1b00671fdecf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_mbschr
_adjust_fdiv
malloc
_initterm
free
_mbsrchr
strtoul
memset
_mbsstr
strtol

kernel32

CloseHandle
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrlenA
WriteFile
ReadFile
lstrcmpA
lstrcpynA
GetLastError
GlobalFree
lstrcmpiA
DeleteFileA
SleepEx
SetFilePointer
GetTickCount
lstrcatA
GetFileSize
CreateFileA

user32

MessageBoxA
GetParent
ShowWindow
SetWindowLongA
GetWindowLongA
SetWindowTextA
IsWindow
GetDlgItem
PostMessageA
GetWindowTextA
SendMessageA
SetDlgItemTextA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindowVisible
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
SendDlgItemMessageA

wininet

HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/md5dll.dll
.dll windows:4 windows x86 arch:x86

e57536e0d3500471d52df7cea0d65a39

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
lstrcpyA
lstrcpynA
GetTickCount
Sleep
lstrcatA
lstrlenA
CloseHandle
ReadFile
CreateFileA

user32

wsprintfA

Exports

Exports

GetFileMD5
GetMD5
GetMD5File
GetMD5Random
GetMD5String

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 134B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_106_/ask.ico
$_106_/icon.ico
$_106_/yahoo-zugo.xml
.xml
$_131_/SearchToolbar.dll
.dll regsvr32 windows:5 windows x86 arch:x86

99a6690758e1d6ccc6d17f261513c7c8

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17/05/2005, 00:00

Not After

16/05/2010, 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c5:2f:d6:f7:88:66:44:35:8c:53:9d:8f:c5:0b:cc:93
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

26/01/2010, 00:00

Not After

26/01/2011, 23:59

Subject

CN=Zugo Ltd,O=Zugo Ltd,POSTALCODE=JE4 9NU,STREET=37 Broad St.+STREET=1st Floor+STREET=PO Box 36,L=St Helier,ST=Jersey,C=JE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:8b:cc:0a:aa:d2:fb:cf:67:0e:f0:0b:a1:f9:08:6d:bc:35:05:1f
Signer

Actual PE Digest

6d:8b:cc:0a:aa:d2:fb:cf:67:0e:f0:0b:a1:f9:08:6d:bc:35:05:1f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Lesha\SearchToolbar\SVN2\Projects\IE\SearchToolbar\Release\SearchToolbar.pdb

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

winhttp

WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen

kernel32

LoadLibraryW
SetLastError
OutputDebugStringA
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
MultiByteToWideChar
FlushInstructionCache
GetCurrentThreadId
SetThreadLocale
GetThreadLocale
LoadLibraryA
GetVersionExW
MulDiv
GetLocalTime
GetCurrentProcessId
lstrcmpW
CreateMutexW
CreateThread
HeapFree
GetProcessHeap
LCMapStringA
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
WriteFile
HeapCreate
lstrcmpiW
GetTimeZoneInformation
WideCharToMultiByte
ExitProcess
Sleep
LCMapStringW
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
lstrlenW
GetCurrentProcess
CloseHandle
GetLastError
GetUserDefaultLangID
DisableThreadLibraryCalls
GetModuleFileNameW
GetStringTypeA
InterlockedDecrement
InterlockedIncrement
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetStringTypeW

user32

FrameRect
IsWindowVisible
MapWindowPoints
ScreenToClient
PostMessageW
MonitorFromPoint
GetMonitorInfoW
DrawFrameControl
DrawTextW
SetMenuItemInfoW
GetMenuItemInfoW
ModifyMenuW
GetMenuItemID
MessageBeep
FillRect
GetWindowThreadProcessId
TrackPopupMenuEx
GetSysColor
PtInRect
GetSystemMetrics
InflateRect
EndPaint
BeginPaint
GetCapture
SystemParametersInfoW
DrawEdge
DrawFocusRect
AdjustWindowRectEx
GetDlgCtrlID
GetParent
GetSysColorBrush
WindowFromPoint
GetMessagePos
GetWindowDC
CharLowerW
RegisterWindowMessageW
SetRectEmpty
UnhookWindowsHookEx
CallNextHookEx
GetClassNameW
UnregisterClassA
SetWindowsHookExW
PeekMessageW
GetSubMenu
IsMenu
LoadMenuW
GetDesktopWindow
GetMenuItemCount
IsWindowEnabled
KillTimer
SetTimer
InvalidateRect
UpdateWindow
GetWindowRect
SetWindowPos
GetMenu
LoadIconW
DestroyIcon
LoadBitmapW
MoveWindow
GetDC
ReleaseDC
ReleaseCapture
SetCursor
SetCursorPos
SetFocus
SetCapture
RedrawWindow
ClientToScreen
GetWindowTextLengthW
GetWindowTextW
DestroyMenu
GetKeyState
TranslateMessage
DispatchMessageW
GetClientRect
CreateWindowExW
GetClassInfoExW
RegisterClassExW
LoadCursorW
ShowWindow
GetFocus
GetWindow
IsWindow
SendMessageW
GetDlgItem
CallWindowProcW
GetWindowLongW
SetWindowLongW
DefWindowProcW
CharNextW
DestroyWindow
GetActiveWindow
OffsetRect

gdi32

BitBlt
CreatePatternBrush
CreatePen
CreateBitmap
MoveToEx
Rectangle
PatBlt
CreateCompatibleBitmap
SetBkColor
SetBrushOrgEx
GetObjectW
SetTextColor
SetBkMode
CreateDIBSection
GetCurrentObject
DeleteDC
GetDeviceCaps
DPtoLP
SelectObject
DeleteObject
LineTo
CreateCompatibleDC
CreateFontIndirectW

advapi32

RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW

shell32

SHGetFolderPathW
ShellExecuteW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleLoadFromStream
WriteClassStm
OleSaveToStream
StringFromCLSID

oleaut32

SysStringByteLen
SysFreeString
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysStringLen
VariantChangeType
SysAllocStringByteLen
VarUI4FromStr
VariantClear
SysAllocString
VariantInit

shlwapi

PathAppendW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_131_/SearchToolbar.xpi
.zip
chrome.manifest
chrome/content/bing-zugo.xml
.xml
chrome/content/index.html
chrome/content/options.js
.js
chrome/content/options.xul
.xml
chrome/content/toolbar.js
.js
chrome/content/toolbar.xul
.xml
chrome/skin/bing.png
.png
chrome/skin/celebrity.png
.png
chrome/skin/drop_images.png
.png
chrome/skin/drop_maps.png
.png
chrome/skin/drop_news.png
.png
chrome/skin/drop_video.png
.png
chrome/skin/drop_videos.png
.png
chrome/skin/drop_web.png
.png
chrome/skin/facebook.png
.png
chrome/skin/favicon.png
.png
chrome/skin/games.png
.png
chrome/skin/hotmail.png
.png
chrome/skin/lifestyle.png
.png
chrome/skin/messenger.png
.png
chrome/skin/msn.png
.png
chrome/skin/news.png
.png
chrome/skin/separator.png
.png
chrome/skin/toolbar.css
chrome/skin/translate.png
.png
chrome/skin/twitter.png
.png
chrome/skin/video.png
.png
chrome/skin/weather.png
.png
components/bingsuggest.js
.js
install.rdf
.xml
$_131_/SearchToolbarUpdater.exe
.exe windows:5 windows x86 arch:x86

cef66f4dc3009c473a35413baee44d17

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17/05/2005, 00:00

Not After

16/05/2010, 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c5:2f:d6:f7:88:66:44:35:8c:53:9d:8f:c5:0b:cc:93
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

26/01/2010, 00:00

Not After

26/01/2011, 23:59

Subject

CN=Zugo Ltd,O=Zugo Ltd,POSTALCODE=JE4 9NU,STREET=37 Broad St.+STREET=1st Floor+STREET=PO Box 36,L=St Helier,ST=Jersey,C=JE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

95:cb:d3:45:4d:55:2b:7d:a0:f6:1e:a9:12:6a:f2:4b:40:84:bc:27
Signer

Actual PE Digest

95:cb:d3:45:4d:55:2b:7d:a0:f6:1e:a9:12:6a:f2:4b:40:84:bc:27

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Lesha\SearchToolbar\SVN2\Projects\IE\SearchToolbarUpdater\Release\SearchToolbarUpdater.pdb

Imports

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW

kernel32

LCMapStringW
GetTempFileNameW
WriteFile
CreateFileW
GetTempPathW
CloseHandle
LCMapStringA
GetStringTypeW
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar

shell32

ShellExecuteW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
README.txt
Uninstall.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data
.rdata
.rsrc/0/version.txt
.rsrc/1033/DIALOG/103
.rsrc/1033/DIALOG/105
.rsrc/1033/DIALOG/106
.rsrc/1033/DIALOG/107
.rsrc/1033/DIALOG/111
.rsrc/1033/GROUP_ICON/103
.rsrc/1033/ICON/1.ico
.rsrc/1033/ICON/2.ico
.rsrc/1033/ICON/3.ico
.rsrc/1033/ICON/4.ico
.rsrc/1033/ICON/5.ico
.rsrc/1033/ICON/6.ico
.rsrc/1033/ICON/7.ico
.rsrc/1033/MANIFEST/1
.xml
.text
icon.ico
license.txt
pdflite.exe
.exe windows:5 windows x86 arch:x86

71f3edfd3d114cd63b68479c9787530c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\pdflite\PDFLite\obj-rel\pdflite.pdb

Imports

advapi32

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW

kernel32

HeapAlloc
HeapFree
GetProcessHeap
CreateThread
GetEnvironmentVariableW
SetUnhandledExceptionFilter
WaitForSingleObject
SetEvent
CreateEventW
GetCurrentThreadId
GetCurrentProcessId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
lstrcpyW
GetDateFormatW
GlobalLock
GlobalAlloc
GetLocaleInfoW
GetTimeFormatW
GlobalUnlock
GetCommandLineW
CopyFileExW
SetErrorMode
GetProfileStringW
FormatMessageW
GetFileAttributesW
MulDiv
GlobalFree
ResetEvent
SetFileAttributesW
ReadDirectoryChangesW
GetOverlappedResult
WaitForMultipleObjects
GlobalDeleteAtom
GlobalAddAtomW
GetTickCount
GetDriveTypeW
GetLogicalDrives
GetUserDefaultUILanguage
GetExitCodeProcess
SetEndOfFile
GetTimeZoneInformation
GetModuleHandleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringA
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetFileAttributesA
CreateFileA
GetStringTypeW
GetCurrentDirectoryA
LCMapStringW
InitializeCriticalSectionAndSpinCount
LoadLibraryA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RaiseException
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetFilePointer
SetHandleCount
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
VirtualAlloc
VirtualFree
HeapCreate
IsDebuggerPresent
TerminateProcess
GetStartupInfoA
GetCommandLineA
CreateDirectoryW
GetDriveTypeA
MoveFileA
GetFileType
SetStdHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleW
UnhandledExceptionFilter
RtlUnwind
HeapReAlloc
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
GetFullPathNameW
FindFirstFileW
WideCharToMultiByte
lstrcpynW
GetModuleFileNameW
CreateFileW
lstrlenW
FindClose
FindNextFileW
CloseHandle
GetWindowsDirectoryW
Sleep
GetFileSize
WriteFile
ReadFile
GetLongPathNameW
GetFileAttributesExW
GetFileInformationByHandle
AllocConsole
FreeLibrary
CreateProcessW
GetCurrentProcess
SetConsoleScreenBufferSize
FormatMessageA
GetSystemDirectoryW
LoadLibraryW
GetStdHandle
GetLastError
GetProcAddress
GetConsoleScreenBufferInfo
LocalFree
CreateProcessA

user32

PostQuitMessage
GetWindowDC
ShowWindowAsync
IsIconic
GetMenuItemID
LoadImageW
SetCapture
KillTimer
IsZoomed
GetKeyState
CopyImage
GetFocus
LoadCursorW
CreateMenu
ModifyMenuW
ShowCaret
IsCharUpperW
CharLowerW
GetCapture
TranslateMessage
LoadAcceleratorsW
GetForegroundWindow
RegisterClassExW
LoadIconW
CheckMenuRadioItem
IntersectRect
GetScrollInfo
AppendMenuW
GetWindowTextW
SystemParametersInfoW
SetClassLongW
EnableMenuItem
MonitorFromWindow
GetSysColor
SetMenu
GetMessageW
HideCaret
SetTimer
TranslateAcceleratorW
DdeInitializeW
DdeCreateStringHandleW
DdeFreeStringHandle
DdeUninitialize
DdeCreateDataHandle
SetRect
MonitorFromRect
GetMonitorInfoW
SendMessageW
GetSystemMetrics
ReleaseDC
OffsetRect
GetDC
DdeClientTransaction
DrawTextW
CallWindowProcW
GetPropW
DrawFrameControl
EndDeferWindowPos
MapWindowPoints
BeginDeferWindowPos
DeferWindowPos
GetDesktopWindow
SetWindowLongW
GetDlgItem
InvalidateRect
UnionRect
GetWindowPlacement
SetPropW
PtInRect
GetParent
GetWindowRect
ScreenToClient
RemovePropW
PostMessageW
MessageBoxW
FillRect
MoveWindow
DefWindowProcW
CreateWindowExW
ShowWindow
GetCursorPos
GetWindowLongW
InflateRect
BeginPaint
SetActiveWindow
SetCursor
DestroyWindow
EndPaint
CopyRect
EnableWindow
SetDlgItemTextW
CheckRadioButton
IsDlgButtonChecked
CheckDlgButton
SetWindowPos
SendDlgItemMessageW
EndDialog
SetFocus
DialogBoxParamW
SetClipboardData
OpenClipboard
EmptyClipboard
wsprintfW
CloseClipboard
DispatchMessageW
GetMessagePos
UnpackDDElParam
CheckMenuItem
GetScrollPos
SetScrollInfo
SetWindowTextW
DestroyMenu
UpdateWindow
IsWindowVisible
ReleaseCapture
AdjustWindowRectEx
DdeConnect
DdeDisconnect
DdeFreeDataHandle
SetParent
ReuseDDElParam
FindWindowW
IsWindowUnicode
GetClientRect
InsertMenuW
GetCursor
ShowScrollBar
IsWindow
LoadBitmapW

gdi32

BitBlt
EndPage
StartPage
CreateFontIndirectW
GetDeviceCaps
CreateDCW
SetMapMode
GetObjectW
StartDocW
EndDoc
GetStockObject
AbortDoc
GetTextExtentPoint32W
SetTextColor
Rectangle
TextOutW
DeleteDC
StretchBlt
GetDIBits
CreateCompatibleDC
CreateCompatibleBitmap
SetDIBits
CreateDIBitmap
MoveToEx
LineTo
SetBkMode
DeleteObject
SelectObject
CreatePen
CreateSolidBrush

comdlg32

CommDlgExtendedError
PrintDlgExW
GetSaveFileNameW
GetOpenFileNameW

shell32

DragFinish
SHGetDesktopFolder
SHBindToParent
SHChangeNotify
SHAddToRecentDocs
DragAcceptFiles
SHGetSpecialFolderPathW
ShellExecuteExW
DragQueryFileW

gdiplus

GdipGetImageWidth
GdipSetPixelOffsetMode
GdiplusShutdown
GdipDeleteBrush
GdipFree
GdipSetClipRegion
GdipGetFontCollectionFamilyList
GdipCreatePath
GdipCloneFontFamily
GdipCloneImage
GdipBitmapLockBits
GdipStringFormatGetGenericTypographic
GdipSetPenStartCap
GdipSetPenLineJoin
GdipSetPenDashOffset
GdiplusStartup
GdipSetInterpolationMode
GdipGetCellAscent
GdipDeleteMatrix
GdipFillPath
GdipCreateFromHDC
GdipCreateFontFamilyFromName
GdipCreateRegion
GdipDeletePrivateFontCollection
GdipFillRectangle
GdipSetCompositingMode
GdipGetWorldTransform
GdipNewPrivateFontCollection
GdipDrawString
GdipCreateImageAttributes
GdipGetGenericFontFamilySansSerif
GdipClonePath
GdipDeleteRegion
GdipTransformPath
GdipGetClipBoundsI
GdipDeletePath
GdipSetPageUnit
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipCreateRegionPath
GdipCreateFont
GdipDisposeImage
GdipCreateMatrix2
GdipAlloc
GdipDisposeImageAttributes
GdipCreateSolidFill
GdipBitmapUnlockBits
GdipIsStyleAvailable
GdipSetPenMiterLimit
GdipDeleteFontFamily
GdipCreatePen2
GdipWidenPath
GdipSetSmoothingMode
GdipGetRegionBounds
GdipCreateRegionRectI
GdipSetWorldTransform
GdipTransformRegion
GdipGetMatrixElements
GdipGetFontCollectionFamilyCount
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipSetClipRectI
GdipSetPenDashArray
GdipGetDpiY
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipDeleteFont
GdipGetClip
GdipDrawPath
GdipCreateMatrix
GdipSetPageScale
GdipSetTextRenderingHint
GdipDrawImagePointsRect
GdipGetFamilyName
GdipPrivateAddFontFile
GdipFillPolygon
GdipAddPathPath
GdipGetEmHeight
GdipDrawImageRectRectI
GdipGetImageHeight
GdipSetImageAttributesColorMatrix
GdipCreatePath2
GdipCloneBrush
GdipDeletePen
GdipTranslateWorldTransform

comctl32

ImageList_Create
InitCommonControlsEx
ImageList_AddMasked
CreatePropertySheetPageW

msimg32

AlphaBlend

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter
ord203

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW

ole32

CoUninitialize
CoTaskMemFree
CoCreateInstance
CoInitialize

shlwapi

PathIsRelativeW
StrStrIW
StrRStrIW
PathAppendW
StrStrW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 882KB - Virtual size: 881KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 508KB - Virtual size: 600KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 766KB - Virtual size: 765KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdfprinter/DriverFiles/32/PDFLitePrn.PPD
pdfprinter/DriverFiles/32/PS5UI.DLL
.dll windows:5 windows x86 arch:x86

a3185d5dbf08adaf264cfcf8529a4fae

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

08:a9:a7:00:6a:77:78:46:b7:dd:a0:57:0c:09:da:5d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

14/02/2001, 00:00

Not After

13/02/2005, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:21:18:ce:00:00:00:00:00:13
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,OU=Copyright (c) 1999 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Not Before

21/06/2000, 19:50

Not After

21/08/2001, 20:00

Subject

CN=Microsoft Windows 2000 Publisher,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:9d:aa:11:d3:30:a8:95:60:ac:fa
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

01/07/1999, 07:00

Not After

15/10/2005, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,OU=Copyright (c) 1999 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt

wcstod
iswctype
_ftol
swprintf
ceil
_wcsicmp
floor
sprintf
wcsrchr
??2@YAPAXI@Z
??3@YAXPAX@Z
_wcsnicmp
_stricmp
vswprintf
memmove
wcscat
wcscmp
wcscpy
qsort
_ultoa
wcslen
strncmp
strrchr
_except_handler3
_strnicmp
isspace
_wtol
strchr

user32

GetWindowLongW
wvsprintfW
MessageBeep
DialogBoxParamW
MessageBoxW
GetDlgItem
ShowWindow
CheckRadioButton
EndDialog
CheckDlgButton
LoadStringW
GetAppCompatFlags2
SetDlgItemTextA
SendMessageW
SendDlgItemMessageW
GetDlgItemTextW
EnableWindow
SetFocus
WinHelpW
SetWindowLongW
SetDlgItemTextW

kernel32

GetTempFileNameW
CreateDirectoryW
LockResource
VirtualAlloc
MultiByteToWideChar
GetACP
InterlockedDecrement
InterlockedIncrement
HeapFree
MoveFileExW
WideCharToMultiByte
LoadResource
ReadFile
WriteFile
CloseHandle
MulDiv
SetErrorMode
LoadLibraryExW
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetLocaleInfoW
CompareFileTime
GetFullPathNameW
VirtualFree
GetCPInfo
GetFileTime
GetSystemTimeAsFileTime
FindResourceW
GetProcAddress
LoadLibraryW
CreateFileW
GetSystemInfo
RaiseException
DeleteCriticalSection
InitializeCriticalSection
LocalFree
HeapAlloc
LocalAlloc
SetLastError
HeapDestroy
GetLastError
HeapCreate
DeleteFileW
FreeLibrary

winspool.drv

SetPrinterDataW
GetPrinterDriverW
GetFormW
EnumFormsW
GetPrinterW
DeletePrinterDataW
GetPrinterDataW
DeleteFormW
SetPrinterW
ClosePrinter
OpenPrinterW
AddFormW

gdi32

ExtEscape
EnumFontFamiliesW
CreateICW
DeleteDC

Exports

Exports

DevQueryPrintEx
DrvConvertDevMode
DrvDeviceCapabilities
DrvDevicePropertySheets
DrvDocumentEvent
DrvDocumentPropertySheets
DrvDriverEvent
DrvPrinterEvent
DrvQueryColorProfile
DrvQueryJobAttributes
DrvSplDeviceCaps
DrvUpgradePrinter

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdfprinter/DriverFiles/32/PSCRIPT.HLP
pdfprinter/DriverFiles/32/PSCRIPT.NTF
pdfprinter/DriverFiles/32/PSCRIPT5.DLL
.dll windows:5 windows x86 arch:x86

1f71fc57633060f9629787b3747702bf

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

08:a9:a7:00:6a:77:78:46:b7:dd:a0:57:0c:09:da:5d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

14/02/2001, 00:00

Not After

13/02/2005, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:21:18:ce:00:00:00:00:00:13
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,OU=Copyright (c) 1999 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Not Before

21/06/2000, 19:50

Not After

21/08/2001, 20:00

Subject

CN=Microsoft Windows 2000 Publisher,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:9d:aa:11:d3:30:a8:95:60:ac:fa
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

01/07/1999, 07:00

Not After

15/10/2005, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,OU=Copyright (c) 1999 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt

wcslen
_ftol
strstr
strncmp
atoi
sprintf
isspace
_strnicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
wcsrchr
wcscat
_wcsicmp
qsort
_ltoa
_ultoa
strncpy
strchr
iswctype
ceil
wcscmp
_except_handler3
wcscpy
longjmp
_setjmp3
_wcsnicmp
strrchr
strtol

winspool.drv

GetJobW
GetPrinterDriverW
WritePrinter
GetPrinterDataW
GetPrinterW
EnumFormsW

kernel32

GetFileTime
MapViewOfFile
CreateFileMappingW
CompareFileTime
GetFileSize
UnmapViewOfFile
FreeLibrary
LoadLibraryExW
SetErrorMode
GetProcAddress
InterlockedIncrement
GetSystemDefaultLangID
GetSystemInfo
VirtualAlloc
HeapAlloc
LockResource
LoadResource
FindResourceW
GetSystemTimeAsFileTime
GetCPInfo
HeapDestroy
VirtualFree
InterlockedDecrement
GetFullPathNameW
GlobalFree
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
CreateFileW
WriteFile
GetTempPathW
CloseHandle
DeleteFileW
DeleteCriticalSection
GetTempFileNameW
LocalFree
InitializeCriticalSection
MulDiv
LocalAlloc
MultiByteToWideChar
SetLastError
RaiseException
GetLastError
HeapCreate

gdi32

XFORMOBJ_bApplyXform
EngAlphaBlend
EngComputeGlyphSet
FONTOBJ_vGetInfo
FONTOBJ_pQueryGlyphAttrs
FONTOBJ_cGetGlyphs
EngGetCurrentCodePage
XLATEOBJ_hGetColorTransform
BRUSHOBJ_hGetColorTransform
BRUSHOBJ_pvGetRbrush
EngFindResource
EngQueryLocalTime
CLIPOBJ_ppoGetPath
EngDeletePath
FONTOBJ_cGetAllGlyphHandles
FONTOBJ_pvTrueTypeFontFile
FONTOBJ_pifi
STROBJ_vEnumStart
STROBJ_bEnumPositionsOnly
PATHOBJ_vEnumStart
PATHOBJ_bEnum
XFORMOBJ_iGetXform
PATHOBJ_vGetBounds
EngLockSurface
EngCopyBits
EngCreateBitmap
XLATEOBJ_iXlate
EngTransparentBlt
EngUnlockSurface
EngBitBlt
EngEraseSurface
EngStretchBltROP
XLATEOBJ_piVector
EngCreatePalette
BRUSHOBJ_pvAllocRbrush
EngFreeModule
EngDeleteSurface
EngDeletePalette
EngAssociateSurface
EngLoadModule
EngCreateDeviceSurface
EngUnicodeToMultiByteN
FONTOBJ_pxoGetXform

user32

LoadStringW
GetAppCompatFlags2

mscms

InternalGetPS2ColorSpaceArray
InternalGetPS2CSAFromLCS
InternalGetPS2PreviewCRD
InternalGetPS2ColorRenderingDictionary

Exports

Exports

DllEntryPoint
DrvDisableDriver
DrvEnableDriver
DrvQueryDriverInfo

Sections

.text
Size: 270KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdfprinter/DriverFiles/32/PSCRPTFE.NTF
pdfprinter/DriverFiles/32/redmon.hlp
pdfprinter/DriverFiles/32/redmonnt.dll
.dll windows:4 windows x86 arch:x86

cda11d631f0a2012429f82c8f63e6a5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

comdlg32

GetSaveFileNameW
GetOpenFileNameW

gdi32

StartPage
SetAbortProc
StartDocW
GetDeviceCaps
CreateFontIndirectW
SelectObject
TextOutW
EndPage
TextOutA
EndDoc
DeleteDC
CreateDCW

user32

DialogBoxParamW
LoadStringW
wsprintfW
WaitForInputIdle
MessageBoxW
BringWindowToTop
SetForegroundWindow
SetDlgItemTextW
GetDlgItemTextW
EndDialog
SetWindowLongW
GetWindowLongW
SetWindowTextW
EnableWindow
GetDlgItem
SendDlgItemMessageW
WinHelpW
SetDlgItemInt
GetDlgItemInt

winspool.drv

EndDocPrinter
AbortPrinter
SetJobW
EnumPortsW
EnumPrintersW
WritePrinter
GetJobW
ClosePrinter
GetPrinterW
StartDocPrinterW
OpenPrinterW

advapi32

GetSidSubAuthority
RegDeleteKeyW
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
GetTokenInformation
DuplicateTokenEx
OpenThreadToken
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
CreateProcessAsUserW
RegOpenKeyExW
RegEnumKeyW
RegSetValueExW

kernel32

ReadFile
lstrcmpiW
GetComputerNameW
GlobalFree
GlobalAlloc
GetEnvironmentStrings
MultiByteToWideChar
SetFilePointer
SetStdHandle
LoadLibraryA
VirtualAlloc
HeapFree
UnhandledExceptionFilter
HeapAlloc
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateMutexW
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
VirtualFree
HeapCreate
WaitForSingleObject
ReleaseMutex
FlushFileBuffers
WriteFile
WideCharToMultiByte
lstrlenW
LocalFree
LocalHandle
FormatMessageW
lstrcatW
lstrcpyW
lstrcpynW
HeapDestroy
PeekNamedPipe
GetExitCodeProcess
GlobalUnlock
CloseHandle
ResetEvent
GlobalLock
SetLastError
FreeEnvironmentStringsA
GetEnvironmentVariableW
GetLastError
GetCurrentThread
CreateThread
CreateEventW
GetCurrentThreadId
FreeEnvironmentStringsW
GetProfileStringW
DuplicateHandle
GetCurrentProcess
CreatePipe
CreateFileW
Sleep
SetEvent
DeleteFileW
GetExitCodeThread
GetWindowsDirectoryW
ExpandEnvironmentStringsW
FreeLibrary
lstrcmpW
ExitProcess
TerminateProcess
GetEnvironmentStringsW
CreateProcessW
GetModuleFileNameW
GlobalHandle
GetProcAddress
LoadLibraryW
GetVersionExW
DisableThreadLibraryCalls
GetCommandLineA
GetModuleHandleA
GetVersion

Exports

Exports

DllEntryPoint
DllMain
InitializePrintMonitor
InitializePrintMonitor2
InitializePrintMonitorUI

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdfprinter/DriverFiles/32/setup.exe
.exe windows:4 windows x86 arch:x86

9c87d7dbc72cab31a3e5565e32907548

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
wsprintfA
LoadStringA

winspool.drv

AddMonitorA
EnumMonitorsA

advapi32

RegOpenKeyExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegQueryValueExA

kernel32

GetModuleHandleA
TerminateProcess
ExitProcess
LoadLibraryA
GetProcAddress
VirtualAlloc
LocalFree
LocalHandle
lstrcatA
FormatMessageA
GetLastError
SetLastError
WritePrivateProfileStringA
GetPrivateProfileStringA
GetWindowsDirectoryA
CopyFileA
lstrcpyA
GetModuleFileNameA
GetSystemDirectoryA
lstrcmpA
lstrlenA
GetVersion
WideCharToMultiByte
GetStartupInfoA
GetCommandLineA
HeapFree
HeapAlloc
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileType
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetStdHandle
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdfprinter/DriverFiles/32/unredmon.exe
.exe windows:4 windows x86 arch:x86

e1136b7a4f478379320f2e1faef37824

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
MessageBoxA
LoadStringA

winspool.drv

DeleteMonitorA
EnumPortsA
EnumMonitorsA

advapi32

RegOpenKeyExA
RegDeleteKeyA
RegCloseKey

kernel32

GetCommandLineA
TerminateProcess
GetCurrentProcess
LoadLibraryA
GetProcAddress
VirtualAlloc
HeapAlloc
LocalFree
LocalHandle
lstrcatA
FormatMessageA
GetLastError
SetLastError
WritePrivateProfileStringA
GetWindowsDirectoryA
MoveFileExA
DeleteFileA
lstrcpyA
GetSystemDirectoryA
lstrcmpA
lstrlenA
GetVersion
GetModuleHandleA
GetStartupInfoA
WideCharToMultiByte
ExitProcess
HeapFree
GetACP
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileType
GetCPInfo
HeapDestroy
GetOEMCP
SetHandleCount
GetStdHandle
RtlUnwind
HeapCreate
VirtualFree
WriteFile

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdfprinter/DriverFiles/64/PDFLitePrn.PPD
pdfprinter/DriverFiles/64/PS5UI.DLL
.dll windows:6 windows x64 arch:x64

cf567974f981488b70cfefbc10911b2c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ps5ui.pdb

Imports

msvcrt

isspace
memset
memcpy
__C_specific_handler
_amsg_exit
free
_initterm
malloc
_XcptFilter
_errno
iswspace
wcstod
iswctype
_wcsicmp
wcsstr
_wtol
_strnicmp
wcschr
ceil
wcsncmp
strncmp
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
_wtoi
_wcsnicmp
_stricmp
_itow
wcsrchr
atoi
memmove
_vsnwprintf
qsort
_ultoa
strchr
strrchr
fprintf
vfprintf
towupper
_purecall
_vsnprintf
floor

user32

GetDlgItem
CheckRadioButton
GetWindowLongPtrW
EndDialog
DialogBoxParamW
LoadStringW
MessageBoxW
MessageBeep
SendDlgItemMessageW
CheckDlgButton
GetDlgItemTextW
SendMessageW
SetFocus
EnableWindow
WinHelpW
SetWindowLongPtrW
GetAppCompatFlags2
ShowWindow
SetDlgItemTextW

ole32

CoTaskMemFree
CreateStreamOnHGlobal
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemAlloc

kernel32

lstrcmpW
HeapDestroy
SetLastError
LocalAlloc
HeapAlloc
HeapCreate
GetLastError
lstrlenW
SetErrorMode
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetModuleHandleW
GetLocaleInfoW
CompareFileTime
VerifyVersionInfoW
LoadLibraryW
GetSystemDirectoryW
VerSetConditionMask
GetFileAttributesExW
GetFileTime
GetSystemInfo
LockResource
VirtualAlloc
RaiseException
VirtualFree
LoadResource
FindResourceW
GetCPInfo
GetFullPathNameW
GetUserDefaultUILanguage
GetACP
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
Sleep
LoadLibraryExW
MultiByteToWideChar
HeapFree
CloseHandle
WriteFile
GetTempFileNameW
CreateFileW
MulDiv
WideCharToMultiByte
FreeLibrary
GetProcAddress
MoveFileExW
DeleteFileW
LocalFree

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

winspool.drv

GetPrinterDataW
DeletePrinterDataW
SetPrinterDataW
GetPrinterW
AddFormW
DeleteFormW
OpenPrinterW
SetPrinterW
ClosePrinter
EnumFormsW
GetFormW
DeviceCapabilitiesW
GetPrinterDriverW

gdi32

CreateICW
EnumFontFamiliesW
CreateDCW
GetDeviceCaps
ExtEscape
DeleteDC

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocStringLen
VariantChangeType
SysAllocString
SysStringLen

Exports

Exports

DevQueryPrintEx
DllCanUnloadNow
DllGetClassObject
DllMain
DrvConvertDevMode
DrvDeviceCapabilities
DrvDevicePropertySheets
DrvDocumentEvent
DrvDocumentPropertySheets
DrvDriverEvent
DrvPopulateFilterServices
DrvPrinterEvent
DrvQueryColorProfile
DrvQueryJobAttributes
DrvResetConfigCache
DrvSplDeviceCaps
DrvUpgradePrinter
MxdcGetPDEVAdjustment

Sections

.text
Size: 517KB - Virtual size: 517KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 276KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdfprinter/DriverFiles/64/PSCRIPT.HLP
pdfprinter/DriverFiles/64/PSCRIPT.NTF
pdfprinter/DriverFiles/64/PSCRIPT5.DLL
.dll windows:6 windows x64 arch:x64

15e8a8ef879679c37860f2dcbb33afda

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

pscript5.pdb

Imports

msvcrt

iswctype
isspace
memset
memcpy
__C_specific_handler
_amsg_exit
free
_initterm
malloc
_XcptFilter
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
_wcsicmp
wcsrchr
qsort
strncpy
strchr
strstr
strncmp
_setjmp
longjmp
strtol
atoi
_vsnprintf
_stricmp
_wcsnicmp
_strnicmp
_purecall
_ltoa
_ultoa
strrchr
ceil

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

winspool.drv

GetPrinterW
GetPrinterDataW
WritePrinter
GetJobW
EnumFormsW
GetPrinterDriverW

kernel32

GetCurrentProcessId
HeapFree
GetSystemInfo
LockResource
VirtualAlloc
RaiseException
VirtualFree
LoadResource
FindResourceW
GetCPInfo
GetFullPathNameW
GetUserDefaultUILanguage
MultiByteToWideChar
HeapAlloc
LoadLibraryExW
FreeLibrary
SetErrorMode
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetFileTime
CompareFileTime
VerifyVersionInfoW
VerSetConditionMask
GetProcAddress
GetSystemDirectoryW
GetModuleHandleW
GetLastError
GetSystemDefaultLangID
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
SetLastError
InitializeCriticalSectionAndSpinCount
LocalAlloc
MulDiv
DeleteCriticalSection
HeapDestroy
LocalFree
DeleteFileW
GetTempPathW
GetTempFileNameW
CloseHandle
WideCharToMultiByte
CreateFileW
WriteFile
GlobalFree
EnterCriticalSection
LeaveCriticalSection
HeapCreate
Sleep
QueryPerformanceCounter
GetTickCount

gdi32

PATHOBJ_vGetBounds
EngAlphaBlend
EngComputeGlyphSet
FONTOBJ_vGetInfo
FONTOBJ_pQueryGlyphAttrs
FONTOBJ_cGetGlyphs
EngGetCurrentCodePage
XLATEOBJ_hGetColorTransform
BRUSHOBJ_hGetColorTransform
BRUSHOBJ_pvGetRbrush
EngFindResource
EngQueryLocalTime
EngDeletePath
CLIPOBJ_ppoGetPath
FONTOBJ_cGetAllGlyphHandles
FONTOBJ_pvTrueTypeFontFile
FONTOBJ_pifi
STROBJ_bEnumPositionsOnly
STROBJ_vEnumStart
PATHOBJ_bEnum
PATHOBJ_vEnumStart
EngLoadModule
XFORMOBJ_iGetXform
XFORMOBJ_bApplyXform
FONTOBJ_pxoGetXform
EngUnicodeToMultiByteN
EngUnlockSurface
EngCopyBits
EngLockSurface
EngCreateBitmap
XLATEOBJ_iXlate
EngTransparentBlt
EngStretchBltROP
EngBitBlt
EngEraseSurface
XLATEOBJ_piVector
BRUSHOBJ_pvAllocRbrush
EngCreatePalette
EngFreeModule
EngDeletePalette
EngDeleteSurface
EngAssociateSurface
EngCreateDeviceSurface

user32

GetAppCompatFlags2
LoadStringW

mscms

InternalGetPS2PreviewCRD
InternalGetPS2ColorRenderingDictionary
InternalGetPS2ColorSpaceArray
InternalGetPS2CSAFromLCS

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize

Exports

Exports

DllMain
DrvDisableDriver
DrvEnableDriver
DrvQueryDriverInfo

Sections

.text
Size: 389KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 192KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdfprinter/DriverFiles/64/PSCRPTFE.NTF
pdfprinter/DriverFiles/64/redmon.hlp
pdfprinter/DriverFiles/64/redmonnt.dll
.dll windows:4 windows x64 arch:x64

3f8e40b4b2b940c51d28b3b34f5492b2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

comdlg32

GetSaveFileNameW
GetOpenFileNameW

gdi32

DeleteDC
TextOutA
EndPage
TextOutW
SelectObject
CreateFontIndirectW
GetDeviceCaps
StartPage
StartDocW
SetAbortProc
CreateDCW
EndDoc

user32

SetDlgItemInt
wsprintfW
BringWindowToTop
SetForegroundWindow
SetDlgItemTextW
GetDlgItemTextW
MessageBoxW
SetWindowLongPtrW
EndDialog
GetWindowLongPtrW
SetWindowTextW
EnableWindow
GetDlgItem
WinHelpW
WaitForInputIdle
DialogBoxParamW
GetDlgItemInt
SendDlgItemMessageW
LoadStringW

winspool.drv

ClosePrinter
SetJobW
GetJobW
OpenPrinterW
AbortPrinter
EndDocPrinter
WritePrinter
EnumPrintersW
StartDocPrinterW
GetPrinterW
EnumPortsW
XcvDataW

advapi32

RegEnumKeyW
CreateProcessAsUserW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenThreadToken
DuplicateTokenEx
GetTokenInformation
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegDeleteKeyW

kernel32

GetStringTypeA
MultiByteToWideChar
GetLocaleInfoA
InitializeCriticalSection
GetStringTypeW
HeapReAlloc
GetOEMCP
GetACP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
RtlUnwindEx
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringA
LCMapStringW
LoadLibraryA
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RaiseException
GetWindowsDirectoryW
WaitForSingleObject
ReleaseMutex
FlushFileBuffers
WriteFile
WideCharToMultiByte
lstrlenW
LocalFree
LocalHandle
FormatMessageW
lstrcatW
lstrcpyW
lstrcpynW
PeekNamedPipe
ReadFile
GetExitCodeProcess
GlobalUnlock
CloseHandle
ResetEvent
GlobalLock
SetLastError
GlobalFree
GlobalAlloc
GetLastError
GetCurrentThread
Sleep
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CreateFileW
GetProfileStringW
lstrcmpW
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateProcessW
DuplicateHandle
GetCurrentProcess
CreatePipe
SetEvent
CreateThread
CreateEventW
CreateMutexW
lstrcmpiW
GetComputerNameW
DeleteFileW
GetExitCodeThread
GetModuleFileNameW
GlobalHandle
GetVersionExW
DisableThreadLibraryCalls
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
TerminateProcess
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
ExitProcess
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA

Exports

Exports

DllEntryPoint
DllMain
InitializePrintMonitor
InitializePrintMonitor2
InitializePrintMonitorUI

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 798B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdfprinter/DriverFiles/64/setup.exe
.exe windows:4 windows x64 arch:x64

8d294cdc61be4b287dc3b6e4a205490f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

wsprintfA
LoadStringA
MessageBoxA

winspool.drv

AddMonitorA
EnumMonitorsA

advapi32

RegCreateKeyA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

kernel32

VirtualQuery
RtlUnwindEx
LocalFree
LocalHandle
lstrcatA
FormatMessageA
GetLastError
SetLastError
WritePrivateProfileStringA
GetPrivateProfileStringA
GetWindowsDirectoryA
CopyFileA
lstrcpyA
GetModuleFileNameA
lstrcmpA
GetSystemDirectoryA
lstrlenA
GetVersion
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
GetCurrentProcess
TerminateProcess
ExitProcess
GetProcAddress
GetModuleHandleA
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
HeapSetInformation
HeapCreate
LeaveCriticalSection
EnterCriticalSection
RaiseException
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
Sleep
InitializeCriticalSection
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapReAlloc
GetLocaleInfoA
VirtualProtect
VirtualAlloc
GetSystemInfo

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pdfprinter/DriverFiles/64/unredmon.exe
.exe windows:4 windows x64 arch:x64

4ce07afe8b04b06e8d26c36adf635e80

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

wsprintfA
LoadStringA
MessageBoxA

winspool.drv

DeleteMonitorA
EnumPortsA
EnumMonitorsA

advapi32

RegDeleteKeyA
RegCloseKey
RegOpenKeyExA

kernel32

VirtualQuery
GetSystemInfo
FreeEnvironmentStringsA
LocalFree
LocalHandle
lstrcatA
FormatMessageA
GetLastError
SetLastError
WritePrivateProfileStringA
GetWindowsDirectoryA
MoveFileExA
DeleteFileA
lstrcpyA
GetSystemDirectoryA
lstrcmpA
lstrlenA
GetVersion
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
GetCurrentProcess
TerminateProcess
ExitProcess
GetProcAddress
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwindEx
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
HeapSetInformation
HeapCreate
LeaveCriticalSection
EnterCriticalSection
RaiseException
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
Sleep
InitializeCriticalSection
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapReAlloc
GetLocaleInfoA
VirtualProtect
VirtualAlloc

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pdfprinter/PDFLiteConverter.exe
.exe windows:5 windows x86 arch:x86

b3ee7d4c9909f0e3072a3f35c66a18f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gsdll32

gsapi_delete_instance
gsapi_exit
gsapi_init_with_args
gsapi_set_stdio
gsapi_new_instance

kernel32

GetModuleFileNameA
CreateFileW
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
MultiByteToWideChar
GetLastError
ReadFile
Sleep
HeapFree
GetProcAddress
GetModuleHandleW
ExitProcess
IsProcessorFeaturePresent
WriteFile
GetModuleFileNameW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
SetFilePointer
SetStdHandle
HeapAlloc
HeapReAlloc
LoadLibraryW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
CloseHandle
WriteConsoleW
LCMapStringW
GetStringTypeW

user32

MessageBoxA

comdlg32

GetSaveFileNameA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shell32

ShellExecuteA

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdfprinter/PDFLiteInstall.dll
.dll windows:5 windows x86 arch:x86

ff787a9ee05d9ebd48351100103b98af

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileW
FlushFileBuffers
DeleteFileA
SetStdHandle
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
LCMapStringW
GetSystemTimeAsFileTime
CopyFileA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
GetLastError
WideCharToMultiByte
MultiByteToWideChar
WriteConsoleW
GetModuleFileNameA
RtlUnwind
RaiseException
GetModuleHandleW
ExitProcess
DecodePointer
GetCurrentThreadId
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryW
WriteFile
GetStdHandle
GetModuleFileNameW
Sleep
SetHandleCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId

user32

MessageBoxA

winspool.drv

DeletePortW
GetPrinterDriverDirectoryA
AddPrinterDriverA
EnumPrintersA
AddPrinterA
XcvDataW
DeletePrinter
SetPrinterDataA
OpenPrinterA
ClosePrinter
DeletePrinterDriverExA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

Exports

Exports

InstallPrinter
IsInstalled
RemovePrinter

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdfprinter/fonts/COPYING
pdfprinter/fonts/ChangeLog
pdfprinter/fonts/README
pdfprinter/fonts/README.tweaks
pdfprinter/fonts/a010013l.afm
pdfprinter/fonts/a010013l.pfb
pdfprinter/fonts/a010013l.pfm
pdfprinter/fonts/a010015l.afm
pdfprinter/fonts/a010015l.pfb
pdfprinter/fonts/a010015l.pfm
pdfprinter/fonts/a010033l.afm
pdfprinter/fonts/a010033l.pfb
pdfprinter/fonts/a010033l.pfm
pdfprinter/fonts/a010035l.afm
pdfprinter/fonts/a010035l.pfb
pdfprinter/fonts/a010035l.pfm
pdfprinter/fonts/b018012l.afm
pdfprinter/fonts/b018012l.pfb
pdfprinter/fonts/b018012l.pfm
pdfprinter/fonts/b018015l.afm
pdfprinter/fonts/b018015l.pfb
pdfprinter/fonts/b018015l.pfm
pdfprinter/fonts/b018032l.afm
pdfprinter/fonts/b018032l.pfb
pdfprinter/fonts/b018032l.pfm
pdfprinter/fonts/b018035l.afm
pdfprinter/fonts/b018035l.pfb
pdfprinter/fonts/b018035l.pfm
pdfprinter/fonts/c059013l.afm
pdfprinter/fonts/c059013l.pfb
pdfprinter/fonts/c059016l.afm
pdfprinter/fonts/c059016l.pfb
pdfprinter/fonts/c059033l.afm
pdfprinter/fonts/c059033l.pfb
pdfprinter/fonts/c059036l.afm
pdfprinter/fonts/c059036l.pfb
pdfprinter/fonts/d050000l.afm
pdfprinter/fonts/d050000l.pfb
pdfprinter/fonts/fonts.dir
pdfprinter/fonts/fonts.scale
pdfprinter/fonts/n019003l.afm
pdfprinter/fonts/n019003l.pfb
pdfprinter/fonts/n019003l.pfm
pdfprinter/fonts/n019004l.afm
pdfprinter/fonts/n019004l.pfb
pdfprinter/fonts/n019004l.pfm
pdfprinter/fonts/n019023l.afm
pdfprinter/fonts/n019023l.pfb
pdfprinter/fonts/n019023l.pfm
pdfprinter/fonts/n019024l.afm
pdfprinter/fonts/n019024l.pfb
pdfprinter/fonts/n019024l.pfm
pdfprinter/fonts/n019043l.afm
pdfprinter/fonts/n019043l.pfb
pdfprinter/fonts/n019044l.afm
pdfprinter/fonts/n019044l.pfb
pdfprinter/fonts/n019063l.afm
pdfprinter/fonts/n019063l.pfb
pdfprinter/fonts/n019064l.afm
pdfprinter/fonts/n019064l.pfb
pdfprinter/fonts/n019064l.pfm
pdfprinter/fonts/n021003l.afm
pdfprinter/fonts/n021003l.pfb
pdfprinter/fonts/n021003l.pfm
pdfprinter/fonts/n021004l.afm
pdfprinter/fonts/n021004l.pfb
pdfprinter/fonts/n021004l.pfm
pdfprinter/fonts/n021023l.afm
pdfprinter/fonts/n021023l.pfb
pdfprinter/fonts/n021023l.pfm
pdfprinter/fonts/n021024l.afm
pdfprinter/fonts/n021024l.pfb
pdfprinter/fonts/n021024l.pfm
pdfprinter/fonts/n022003l.afm
pdfprinter/fonts/n022003l.pfb
pdfprinter/fonts/n022004l.afm
pdfprinter/fonts/n022004l.pfb
pdfprinter/fonts/n022023l.afm
pdfprinter/fonts/n022023l.pfb
pdfprinter/fonts/n022024l.afm
pdfprinter/fonts/n022024l.pfb
pdfprinter/fonts/p052003l.afm
pdfprinter/fonts/p052003l.pfb
pdfprinter/fonts/p052004l.afm
pdfprinter/fonts/p052004l.pfb
pdfprinter/fonts/p052023l.afm
pdfprinter/fonts/p052023l.pfb
pdfprinter/fonts/p052024l.afm
pdfprinter/fonts/p052024l.pfb
pdfprinter/fonts/s050000l.afm
pdfprinter/fonts/s050000l.pfb
pdfprinter/fonts/uninstal.txt
pdfprinter/fonts/z003034l.afm
pdfprinter/fonts/z003034l.pfb
pdfprinter/fonts/z003034l.pfm
pdfprinter/gsdll32.dll
.dll windows:4 windows x86 arch:x86

1a2dfdd5d20bc489fc4034233ee31f37

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

comdlg32

PrintDlgA

gdi32

GetTextFaceA
SelectObject
CreateFontIndirectA
GetTextMetricsA
GetTextExtentPointA
DeleteDC
GetBitmapBits
TextOutA
SetBkMode
SetTextColor
PatBlt
SetMapMode
GetMapMode
CreateCompatibleDC
CreateBitmap
SetDIBitsToDevice
RealizePalette
SelectPalette
EndPage
StretchDIBits
StartPage
CreateICA
EndDoc
AbortDoc
ResetDCA
CreateDCA
StartDocA
SetAbortProc
GetDeviceCaps
DeleteObject
CreatePalette

user32

SendDlgItemMessageA
EndDialog
PostMessageA
MessageBoxA
DialogBoxParamA
ReleaseDC
GetDC
MessageBeep
DispatchMessageA
TranslateMessage
IsDialogMessageA
PeekMessageA
ShowWindow
SetWindowTextA
GetDlgItem
DestroyWindow
CreateDialogParamA

winspool.drv

EnumPrintersA
ClosePrinter
EndDocPrinter
WritePrinter
AbortPrinter
StartDocPrinterA
DocumentPropertiesA
DeviceCapabilitiesA
StartPagePrinter
OpenPrinterA
EndPagePrinter

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameA

ws2_32

select
closesocket
send
recv
WSAGetLastError
WSASetLastError
WSAStartup
ntohl
inet_ntoa
htonl
getservbyname
htons
inet_addr
gethostbyname
gethostbyaddr
getservbyport
ntohs
gethostname
connect
setsockopt
socket
recvfrom
sendto

kernel32

QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCurrentDirectoryA
GetFullPathNameA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetConsoleOutputCP
WriteConsoleA
LoadLibraryW
HeapSize
GetExitCodeProcess
FlushFileBuffers
GetTimeZoneInformation
RaiseException
GetStartupInfoA
SetHandleCount
VirtualAlloc
VirtualFree
GetLocaleInfoW
CompareStringA
SetEnvironmentVariableA
CompareStringW
MultiByteToWideChar
HeapCreate
HeapDestroy
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
TerminateProcess
GetModuleFileNameA
GetVersionExA
GetCommandLineA
GetDriveTypeA
MoveFileA
GetProcessHeap
SetEndOfFile
UnlockFile
LockFile
Sleep
GetFileAttributesA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetVersion
lstrlenA
GetLastError
CreateProcessA
GetStdHandle
CloseHandle
DuplicateHandle
CreatePipe
GetCurrentProcess
CreateFileA
GetTempFileNameA
GetTempPathA
GetProfileStringA
GetLocaleInfoA
FindClose
FindNextFileA
FindFirstFileA
GetSystemTime
FatalAppExitA
WaitForSingleObject
WideCharToMultiByte
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
ReleaseMutex
CreateMutexA
CreateSemaphoreA
ReleaseSemaphore
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GlobalSize
ReadFile
WriteFile
SetFilePointer
GetFileSize
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
CreateFileW
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetCurrentProcessId
GetTickCount
GetModuleHandleA
ExitProcess
HeapFree
HeapAlloc
SetStdHandle
GetFileType
RtlUnwind
GetSystemTimeAsFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
DeleteFileA
ExitThread
ResumeThread
CreateThread
HeapReAlloc
WriteConsoleW
GetModuleFileNameW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetConsoleCP
GetConsoleMode

Exports

Exports

DllEntryPoint
DllMain
gsapi_delete_instance
gsapi_exit
gsapi_init_with_args
gsapi_new_instance
gsapi_revision
gsapi_run_file
gsapi_run_string
gsapi_run_string_begin
gsapi_run_string_continue
gsapi_run_string_end
gsapi_run_string_with_length
gsapi_set_display_callback
gsapi_set_poll
gsapi_set_stdio
gsapi_set_visual_tracer
gsdll_copy_dib
gsdll_copy_palette
gsdll_draw
gsdll_execute_begin
gsdll_execute_cont
gsdll_execute_end
gsdll_exit
gsdll_get_bitmap_row
gsdll_init
gsdll_lock_device
gsdll_revision

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9.2MB - Virtual size: 9.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdfprinter/lib/EndOfTask.ps
pdfprinter/lib/FAPIconfig-FCO
pdfprinter/lib/FCOfontmap-PCLPS3
pdfprinter/lib/FCOfontmap-PS3
pdfprinter/lib/Fontmap.ATB
pdfprinter/lib/Fontmap.ATM
pdfprinter/lib/Fontmap.OS2
pdfprinter/lib/Fontmap.OSF
pdfprinter/lib/Fontmap.SGI
pdfprinter/lib/Fontmap.Sol
pdfprinter/lib/Fontmap.URW-136.T1
pdfprinter/lib/Fontmap.URW-136.TT
pdfprinter/lib/Fontmap.Ult
pdfprinter/lib/Fontmap.VMS
pdfprinter/lib/Info-macos.plist
.xml
pdfprinter/lib/PDFA_def.ps
pdfprinter/lib/PDFX_def.ps
pdfprinter/lib/acctest.ps
pdfprinter/lib/addxchar.ps
pdfprinter/lib/afmdiff.awk
.sh linux
pdfprinter/lib/align.ps
pdfprinter/lib/bdftops
.sh linux
pdfprinter/lib/bdftops.bat
pdfprinter/lib/bdftops.cmd
pdfprinter/lib/bdftops.ps
pdfprinter/lib/bj8.rpd
pdfprinter/lib/bj8gc12f.upp
pdfprinter/lib/bj8hg12f.upp
pdfprinter/lib/bj8oh06n.upp
pdfprinter/lib/bj8pa06n.upp
pdfprinter/lib/bj8pp12f.upp
pdfprinter/lib/bj8ts06n.upp
pdfprinter/lib/bjc610a0.upp
pdfprinter/lib/bjc610a1.upp
pdfprinter/lib/bjc610a2.upp
pdfprinter/lib/bjc610a3.upp
pdfprinter/lib/bjc610a4.upp
pdfprinter/lib/bjc610a5.upp
pdfprinter/lib/bjc610a6.upp
pdfprinter/lib/bjc610a7.upp
pdfprinter/lib/bjc610a8.upp
pdfprinter/lib/bjc610b1.upp
pdfprinter/lib/bjc610b2.upp
pdfprinter/lib/bjc610b3.upp
pdfprinter/lib/bjc610b4.upp
pdfprinter/lib/bjc610b6.upp
pdfprinter/lib/bjc610b7.upp
pdfprinter/lib/bjc610b8.upp
pdfprinter/lib/caption.ps
pdfprinter/lib/cat.ps
pdfprinter/lib/cbjc600.ppd
pdfprinter/lib/cbjc800.ppd
pdfprinter/lib/cdj550.upp
pdfprinter/lib/cdj690.upp
pdfprinter/lib/cdj690ec.upp
pdfprinter/lib/cid2code.ps
pdfprinter/lib/decrypt.ps
pdfprinter/lib/dnj750c.upp
pdfprinter/lib/dnj750m.upp
pdfprinter/lib/docie.ps
pdfprinter/lib/dumphint
.sh linux
pdfprinter/lib/dumphint.bat
pdfprinter/lib/dumphint.ps
.pdf
pdfprinter/lib/dvipdf
.sh linux
pdfprinter/lib/eps2eps
.sh linux
pdfprinter/lib/eps2eps.bat
pdfprinter/lib/eps2eps.cmd
pdfprinter/lib/fixmswrd.pl
.pl .sh linux
pdfprinter/lib/font2c
.sh linux
pdfprinter/lib/font2c.bat
pdfprinter/lib/font2c.cmd
pdfprinter/lib/font2c.ps
pdfprinter/lib/font2pcl.ps
pdfprinter/lib/ghostpdf.inf
pdfprinter/lib/ghostpdf.ppd
pdfprinter/lib/gs_ce_e.ps
pdfprinter/lib/gs_cmdl.ps
pdfprinter/lib/gs_fform.ps
pdfprinter/lib/gs_il2_e.ps
pdfprinter/lib/gs_kanji.ps
pdfprinter/lib/gs_ksb_e.ps
pdfprinter/lib/gs_l.xbm
pdfprinter/lib/gs_l.xpm
pdfprinter/lib/gs_l_m.xbm
pdfprinter/lib/gs_lgo_e.ps
pdfprinter/lib/gs_lgx_e.ps
pdfprinter/lib/gs_m.xbm
pdfprinter/lib/gs_m.xpm
pdfprinter/lib/gs_m_m.xbm
pdfprinter/lib/gs_pfile.ps
pdfprinter/lib/gs_rdlin.ps
pdfprinter/lib/gs_s.xbm
pdfprinter/lib/gs_s.xpm
pdfprinter/lib/gs_s_m.xbm
pdfprinter/lib/gs_t.xbm
pdfprinter/lib/gs_t.xpm
pdfprinter/lib/gs_t_m.xbm
pdfprinter/lib/gs_wl1_e.ps
pdfprinter/lib/gs_wl2_e.ps
pdfprinter/lib/gs_wl5_e.ps
pdfprinter/lib/gsbj
.sh linux
pdfprinter/lib/gsbj.bat
pdfprinter/lib/gsdj
.sh linux
pdfprinter/lib/gsdj.bat
pdfprinter/lib/gsdj500
.sh linux
pdfprinter/lib/gsdj500.bat
pdfprinter/lib/gslj
.sh linux
pdfprinter/lib/gslj.bat
pdfprinter/lib/gslp
.sh linux
pdfprinter/lib/gslp.bat
pdfprinter/lib/gslp.ps
.vbs
pdfprinter/lib/gsnd
.sh linux
pdfprinter/lib/gsnd.bat
pdfprinter/lib/gsndt.bat
pdfprinter/lib/gsnup.ps
pdfprinter/lib/gssetgs.bat
pdfprinter/lib/gst.bat
pdfprinter/lib/gstt.bat
pdfprinter/lib/ht_ccsto.ps
pdfprinter/lib/image-qa.ps
pdfprinter/lib/impath.ps
pdfprinter/lib/jispaper.ps
pdfprinter/lib/jobseparator.ps
pdfprinter/lib/landscap.ps
pdfprinter/lib/level1.ps
pdfprinter/lib/lines.ps
pdfprinter/lib/lp386.bat
pdfprinter/lib/lp386r2.bat
pdfprinter/lib/lpgs.bat
pdfprinter/lib/lpr2.bat
pdfprinter/lib/lprsetup.sh
.sh linux
pdfprinter/lib/markhint.ps
pdfprinter/lib/markpath.ps
pdfprinter/lib/mkcidfm.ps
pdfprinter/lib/necp2x.upp
pdfprinter/lib/necp2x6.upp
pdfprinter/lib/opdfread.ps
pdfprinter/lib/packfile.ps
pdfprinter/lib/pcharstr.ps
pdfprinter/lib/pdf2dsc
pdfprinter/lib/pdf2dsc.bat
pdfprinter/lib/pdf2dsc.ps
pdfprinter/lib/pdf2ps
.sh linux
pdfprinter/lib/pdf2ps.bat
pdfprinter/lib/pdf2ps.cmd
pdfprinter/lib/pdfopt
.sh linux
pdfprinter/lib/pdfopt.bat
pdfprinter/lib/pdfopt.ps
pdfprinter/lib/pdfwrite.ps
.pdf
pdfprinter/lib/pf2afm
.sh linux
pdfprinter/lib/pf2afm.bat
pdfprinter/lib/pf2afm.cmd
pdfprinter/lib/pf2afm.ps
pdfprinter/lib/pfbtopfa
.sh linux
pdfprinter/lib/pfbtopfa.bat
pdfprinter/lib/pfbtopfa.ps
pdfprinter/lib/pftogsf.bat
pdfprinter/lib/ppath.ps
pdfprinter/lib/pphs
.sh linux
pdfprinter/lib/pphs.ps
pdfprinter/lib/prfont.ps
pdfprinter/lib/printafm
.sh linux
pdfprinter/lib/printafm.ps
pdfprinter/lib/ps2ai.ps
pdfprinter/lib/ps2ascii
.sh linux
pdfprinter/lib/ps2ascii.bat
pdfprinter/lib/ps2ascii.cmd
pdfprinter/lib/ps2ascii.ps
pdfprinter/lib/ps2epsi
.sh linux
pdfprinter/lib/ps2epsi.bat
pdfprinter/lib/ps2epsi.cmd
pdfprinter/lib/ps2epsi.ps
pdfprinter/lib/ps2pdf
.sh linux
pdfprinter/lib/ps2pdf.bat
pdfprinter/lib/ps2pdf.cmd
pdfprinter/lib/ps2pdf12
.sh linux
pdfprinter/lib/ps2pdf12.bat
pdfprinter/lib/ps2pdf12.cmd
pdfprinter/lib/ps2pdf13
.sh linux
pdfprinter/lib/ps2pdf13.bat
pdfprinter/lib/ps2pdf13.cmd
pdfprinter/lib/ps2pdf14
.sh linux
pdfprinter/lib/ps2pdf14.bat
pdfprinter/lib/ps2pdf14.cmd
pdfprinter/lib/ps2pdfwr
.sh linux
pdfprinter/lib/ps2pdfxx.bat
.bat .vbs
pdfprinter/lib/ps2ps
.sh linux
pdfprinter/lib/ps2ps.bat
pdfprinter/lib/ps2ps.cmd
pdfprinter/lib/ps2ps2
.sh linux
pdfprinter/lib/ps2ps2.bat
pdfprinter/lib/ps2ps2.cmd
pdfprinter/lib/pv.sh
.sh linux
pdfprinter/lib/quit.ps
pdfprinter/lib/ras1.upp
pdfprinter/lib/ras24.upp
pdfprinter/lib/ras3.upp
pdfprinter/lib/ras32.upp
pdfprinter/lib/ras4.upp
pdfprinter/lib/ras8m.upp
pdfprinter/lib/rinkj-2200-setup
pdfprinter/lib/rollconv.ps
pdfprinter/lib/showchar.ps
pdfprinter/lib/showpage.ps
pdfprinter/lib/st640ih.upp
pdfprinter/lib/st640ihg.upp
pdfprinter/lib/st640p.upp
pdfprinter/lib/st640pg.upp
pdfprinter/lib/st640pl.upp
pdfprinter/lib/st640plg.upp
pdfprinter/lib/stc.upp
pdfprinter/lib/stc1520h.upp
pdfprinter/lib/stc2.upp
pdfprinter/lib/stc200_h.upp
pdfprinter/lib/stc2_h.upp
pdfprinter/lib/stc2s_h.upp
pdfprinter/lib/stc300.upp
pdfprinter/lib/stc300bl.upp
pdfprinter/lib/stc300bm.upp
pdfprinter/lib/stc500p.upp
pdfprinter/lib/stc500ph.upp
pdfprinter/lib/stc600ih.upp
pdfprinter/lib/stc600p.upp
pdfprinter/lib/stc600pl.upp
pdfprinter/lib/stc640p.upp
pdfprinter/lib/stc800ih.upp
pdfprinter/lib/stc800p.upp
pdfprinter/lib/stc800pl.upp
pdfprinter/lib/stc_h.upp
pdfprinter/lib/stc_l.upp
pdfprinter/lib/stcany.upp
pdfprinter/lib/stcany_h.upp
pdfprinter/lib/stcinfo.ps
pdfprinter/lib/stcolor.ps
pdfprinter/lib/stocht.ps
pdfprinter/lib/traceimg.ps
pdfprinter/lib/traceop.ps
pdfprinter/lib/type1enc.ps
pdfprinter/lib/type1ops.ps
pdfprinter/lib/uninfo.ps
pdfprinter/lib/unix-lpr.sh
.sh linux
pdfprinter/lib/unprot.ps
pdfprinter/lib/viewcmyk.ps
pdfprinter/lib/viewgif.ps
pdfprinter/lib/viewjpeg.ps
pdfprinter/lib/viewmiff.ps
pdfprinter/lib/viewpbm.ps
pdfprinter/lib/viewpcx.ps
pdfprinter/lib/viewps2a.ps
pdfprinter/lib/viewrgb.ps
pdfprinter/lib/wftopfa
.sh linux
pdfprinter/lib/wftopfa.ps
pdfprinter/lib/winmaps.ps
pdfprinter/lib/wmakebat.bat
pdfprinter/lib/wrfont.ps
pdfprinter/lib/zeroline.ps
pdfprinter/pdflite_printer.exe
.exe windows:5 windows x86 arch:x86

f5079d2890c0ce690b5e38d5ec191e2a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Work\projects\pdf_printer\convertor\Release\pdflite_printer.pdb

Imports

kernel32

GetProcAddress
LoadLibraryA
GetStringTypeW
MultiByteToWideChar
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
HeapFree
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
HeapSize
HeapAlloc
HeapReAlloc
LCMapStringW
IsProcessorFeaturePresent

user32

MessageBoxA

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninstall.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data
.rdata
.rsrc/0/version.txt
.rsrc/1033/DIALOG/103
.rsrc/1033/DIALOG/105
.rsrc/1033/DIALOG/106
.rsrc/1033/DIALOG/107
.rsrc/1033/DIALOG/111
.rsrc/1033/GROUP_ICON/103
.rsrc/1033/ICON/1.ico
.rsrc/1033/ICON/2.ico
.rsrc/1033/ICON/3.ico
.rsrc/1033/ICON/4.ico
.rsrc/1033/ICON/5.ico
.rsrc/1033/ICON/6.ico
.rsrc/1033/ICON/7.ico
.rsrc/1033/MANIFEST/1
.xml
.text

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 151KB

.ndata Size: - Virtual size: 92KB

.rsrc Size: 285KB - Virtual size: 285KB

c480ee4d2a64d4a16edee43fdfe35079

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 9KB - Virtual size: 10KB

.reloc Size: 1KB - Virtual size: 1KB

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 25KB

.reloc Size: 1024B - Virtual size: 836B

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

099c0646ea7282d232219f8807883be0

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

46:24:1c:de:5c:7b:50:0b:51:c5:f1:32:82:28:f2:a9Certificate

Extended Key Usages

Key Usages

0a:f4:52:67:65:64:df:c9:32:17:fb:d2:9a:a9:c0:f3:6e:54:55:80Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 151KB

.ndata
Size: - Virtual size: 92KB

.rsrc
Size: 285KB - Virtual size: 285KB

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 9KB - Virtual size: 10KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 25KB

.reloc
Size: 1024B - Virtual size: 836B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

46:24:1c:de:5c:7b:50:0b:51:c5:f1:32:82:28:f2:a9
Certificate

0a:f4:52:67:65:64:df:c9:32:17:fb:d2:9a:a9:c0:f3:6e:54:55:80
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 228KB

.rsrc
Size: 28KB - Virtual size: 27KB

.text
Size: 512B - Virtual size: 418B

.rdata
Size: 512B - Virtual size: 397B

.data
Size: 512B - Virtual size: 20B

.reloc
Size: 512B - Virtual size: 98B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 374B

.text
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 172B

.text
Size: 46KB - Virtual size: 45KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 40KB

.reloc
Size: 3KB - Virtual size: 2KB