424bdaa04eb41e476635b469ae9d3210_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

424bdaa04eb41e476635b469ae9d3210_JaffaCakes118
Size

7.7MB
MD5

424bdaa04eb41e476635b469ae9d3210
SHA1

362ee9834f0f4b92eecc61a311cb73030e068348
SHA256

b5591974fbaea3946c23957d5b7a1793055560df3739eb40e05ad9d8ead9e084
SHA512

794328a3c7c85f044fa55f140902c886862be7e530d8d418c137d7e97ff70b92baabe56484e99e1989ff7f02e023cb44680af07c1c3e0a2225b3409819aa07f3
SSDEEP

196608:vFFO4vCHfsXatGGDWv2D8yb3GgioWn+Q3BT7yOEX13:vbO4qHfC/GymzQxTc13

Score

3^/10

Malware Config

Signatures

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
424bdaa04eb41e476635b469ae9d3210_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/ProcHandler.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsisunz.dll
unpack001/ESResources.dll
unpack001/sqlite3.dll
unpack001/sslogupload.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

424bdaa04eb41e476635b469ae9d3210_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$COMMONFILES/supportsoft/bin/$R0
.dll windows:5 windows x86 arch:x86

765e602861bc5d288fcf3ed246916809

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:a9:cc:01:74:7a:11:b1:ea:af:10:3c:8d:9a:9e:6c
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/06/2015, 00:00

Not After

31/08/2018, 23:59

Subject

CN=OPSWAT\, Inc.,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fa:73:b4:0f:4f:75:18:79:13:28:7f:bf:59:4c:0e:5b:db:9c:7f:99
Signer

Actual PE Digest

fa:73:b4:0f:4f:75:18:79:13:28:7f:bf:59:4c:0e:5b:db:9c:7f:99

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

mpr

WNetCancelConnection2A

psapi

GetModuleFileNameExA

userenv

GetProfilesDirectoryA

user32

FindWindowA

advapi32

InitializeSecurityDescriptor

shell32

ord680

ole32

CoGetClassObject

oleaut32

VariantTimeToSystemTime

msvcp100

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

msvcr100

atof

shlwapi

PathIsDirectoryA

version

VerQueryValueA

Exports

Exports

AVManagerObjectCreate
AVManagerObjectCreate2
AVManagerObjectFree
AVManagerObjectFree2
CleanupCertificateVerification
GetSdkVersion
SetCertificateVerification
_QHEnableOnAccessScan@8
_QHFreeThreatHistoryListA@8
_QHFreeThreatHistoryListW@8
_QHGetAppLanguageA@16
_QHGetAppLanguageW@16
_QHGetDigitalCertSignerA@12
_QHGetDigitalCertSignerW@12
_QHGetEngineVersionA@12
_QHGetEngineVersionW@12
_QHGetExpDate@8
_QHGetLastFullScanTime@8
_QHGetProductInstallDirA@12
_QHGetProductInstallDirW@12
_QHGetSigDatabaseDirA@12
_QHGetSigDatabaseDirW@12
_QHGetSigDatabaseTime@8
_QHGetSigDatabaseVersionA@12
_QHGetSigDatabaseVersionW@12
_QHGetThreatHistoryA@8
_QHGetThreatHistoryW@8
_QHInitUpdate@4
_QHInitiateFileScanA@8
_QHInitiateFileScanW@8
_QHInitiateFolderScanA@8
_QHInitiateFolderScanW@8
_QHInitiateFullScan@4
_QHIsAVInstalled@4
_QHIsFullScanRunning@4
_QHIsLicenseExpired@4
_QHIsOnAccessScanEnabled@4
_QHIsUpdateInProgress@4
_QHOpenScanner@4

Sections

.text
Size: 1020KB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$COMMONFILES/supportsoft/bin/efc.dat
$COMMONFILES/supportsoft/bin/pinfo.dat
.zip
VERSION
pinfo.dat
$COMMONFILES/supportsoft/bin/pmap.dat
.zip
VERSION
pmap.xml
$COMMONFILES/supportsoft/bin/scpt.dat
.zip
360Safe.lua
ALLIT.lua
APSDK.lua
ATT.lua
Altaro_OopsBackup.lua
AmericaOnline.lua
AntivirusCommon.lua
Ashampoo.lua
Avast.lua
Avg.lua
Avira.lua
Backblaze.lua
BackupClientCommon.lua
BakBone.lua
Barracuda.lua
Bitdefender.lua
Bomgar.lua
Brosix.lua
BullGuard.lua
Carbonite.lua
CentralCommand.lua
CheckPoint.lua
CheckPoint_EndpointAV.lua
Citrix.lua
Citrix_GoToMeeting.lua
Comodo.lua
ComputerAssociatesInternational.lua
Cox.lua
CreateSoftware.lua
DAccessControlCommon.lua
DefenderPro.lua
DesktopSharingCommon.lua
DriveCrypt.lua
Eastlink.lua
Egnyte.lua
EmsiSoftware.lua
Eset.lua
ExeCommon.lua
FastNeuron.lua
Filseclab.lua
FirewallCommon.lua
GData.lua
GFI.lua
GFI2.lua
Genie9.lua
Google.lua
HDEncryptionCommon.lua
IAntiphishing_Anvisoft.lua
IAntiphishing_BitDefender.lua
IAntiphishing_BullGuard.lua
IAntiphishing_CheckPoint.lua
IAntiphishing_CocCoc.lua
IAntiphishing_Google.lua
IAntiphishing_K7SecureWeb.lua
IAntiphishing_Kaspersky.lua
IAntiphishing_MicroWorld.lua
IAntispyware_AvanquestPublishingUSA.lua
IAntispyware_MalwarebytesCorporation.lua
IAntispyware_Netgate.lua
IAntispyware_SaferNetworkingLtd.lua
IAntispyware_TrendMicro.lua
IAntispyware_USTechSupport.lua
IAntispyware_YetAnotherCleaner.lua
IAntivirus_ALWIL.lua
IAntivirus_AVSOFTTechnologies.lua
IAntivirus_AgnitumLtd.lua
IAntivirus_AhnLab.lua
IAntivirus_Anvisoft.lua
IAntivirus_ArcaBit.lua
IAntivirus_AuslogicsSoftwarePtyLtd.lua
IAntivirus_Avetix.lua
IAntivirus_Avira.lua
IAntivirus_Baidu.lua
IAntivirus_BeeDoctor.lua
IAntivirus_BeyondTrust.lua
IAntivirus_BitDefender.lua
IAntivirus_BizSecureLab.lua
IAntivirus_BkavCorporation.lua
IAntivirus_BullGuard.lua
IAntivirus_CMCInformationSecurity.lua
IAntivirus_Comodo.lua
IAntivirus_Crawler.lua
IAntivirus_Cylance.lua
IAntivirus_DefenderProLLC.lua
IAntivirus_DigitalDefender.lua
IAntivirus_DoctorWeb.lua
IAntivirus_ESTsoftCorp.lua
IAntivirus_F-Secure.lua
IAntivirus_F-Secure2.lua
IAntivirus_Faronics.lua
IAntivirus_FortinetInc.lua
IAntivirus_GDataSoftwareAG.lua
IAntivirus_GFI.lua
IAntivirus_GenXTechnologies.lua
IAntivirus_GridinSoftLLC.lua
IAntivirus_HAURI.lua
IAntivirus_HDDLAB.lua
IAntivirus_IkarusAntivirus.lua
IAntivirus_ImmunetFreeAntivirus.lua
IAntivirus_K7AntiVirusPemium.lua
IAntivirus_KingsoftCorp.lua
IAntivirus_Kromtech.lua
IAntivirus_MSecure.lua
IAntivirus_MaxSecure.lua
IAntivirus_Maya_Software_Technologies.lua
IAntivirus_McAfee.lua
IAntivirus_MicroWorld.lua
IAntivirus_MicrosoftCorp.lua
IAntivirus_N-ableTechnologies.lua
IAntivirus_NeoTechnology.lua
IAntivirus_NictaTechSoftware.lua
IAntivirus_PCCleaner.lua
IAntivirus_PCTools.lua
IAntivirus_PaloAltoNetworkTraps.lua
IAntivirus_PandaSoftware.lua
IAntivirus_ParetoLogic.lua
IAntivirus_ProlandSoftware.lua
IAntivirus_QuickGuardTechnologies.lua
IAntivirus_Radialpoint.lua
IAntivirus_Roboscan.lua
IAntivirus_Rogers.lua
IAntivirus_SPAMfighter.lua
IAntivirus_ScandiumSecurity.lua
IAntivirus_SecurityCoverageInc.lua
IAntivirus_SourceNextCorp.lua
IAntivirus_Symantec.lua
IAntivirus_TELUS.lua
IAntivirus_TGSoft.lua
IAntivirus_TechGuardTechnologies.lua
IAntivirus_Telefonica.lua
IAntivirus_ThreatTrack_Security_Inc.lua
IAntivirus_TotalDefense.lua
IAntivirus_TrendMicro.lua
IAntivirus_TrustPort.lua
IAntivirus_USTechSupport.lua
IAntivirus_UnThreatAntivirus.lua
IAntivirus_VirginMediaSecurity.lua
IAntivirus_VirusBuster.lua
IAntivirus_WebrootSoftwareInc.lua
IAntivirus_WindowsDefender.lua
IAntivirus_WorkScapeTechnologies.lua
IAntivirus_ZeoBITLLC.lua
IAntivirus_iS3.lua
IBackupClient_2BrightSparks.lua
IBackupClient_Acronis.lua
IBackupClient_Altaro.lua
IBackupClient_Avira.lua
IBackupClient_Barracuda.lua
IBackupClient_BitDefender_TS.lua
IBackupClient_BoxInc.lua
IBackupClient_BullGuard.lua
IBackupClient_CAARCserve.lua
IBackupClient_ChengduYiwoTechDevelopment.lua
IBackupClient_Cibecs.lua
IBackupClient_CodeFortyTwoSoftware.lua
IBackupClient_Codelathe.lua
IBackupClient_ComodoGroup.lua
IBackupClient_ComputerAssociatesInternationalInc.lua
IBackupClient_CortexITLabsPTY.lua
IBackupClient_DropBox.lua
IBackupClient_DruvaSoftware.lua
IBackupClient_FSecure.lua
IBackupClient_GRSoftware.lua
IBackupClient_Google.lua
IBackupClient_IBM.lua
IBackupClient_LangmeierSofware.lua
IBackupClient_Lenovo.lua
IBackupClient_LuisCobian.lua
IBackupClient_MegaLimited.lua
IBackupClient_MicrosoftCorp.lua
IBackupClient_OlivierPETRUCCI.lua
IBackupClient_ParagonSoftwareGroup.lua
IBackupClient_Softland.lua
IBackupClient_SpiderOak.lua
IBackupClient_Symantec.lua
IBackupClient_Telefonica.lua
IBackupClient_VNTTJSC.lua
IBackupClient_VembuTechnologies.lua
IBackupClient_Zmanda.lua
IBackupClient_iCloud.lua
IBrowser_DeepnetExplorer.lua
IBrowser_FlashPeak.lua
IBrowser_Google.lua
IBrowser_Microsoft.lua
IBrowser_MoreQuick.lua
IBrowser_Mozilla.lua
IBrowser_MozillaFoundation.lua
IDataLossPrevention_CicadaSecurity.lua
IDataLossPrevention_McAfee.lua
IDataLossPrevention_RSADLPEndpointAgent.lua
IFirewall_ALLIT.lua
IFirewall_AhnLab.lua
IFirewall_ArcaBit.lua
IFirewall_BeijingRisingTechnologyLtd.lua
IFirewall_BitDefender.lua
IFirewall_BizSecureLab.lua
IFirewall_BkavCorporation.lua
IFirewall_EarthLinkInc.lua
IFirewall_F-Secure.lua
IFirewall_GDataSoftwareAG.lua
IFirewall_McAfee.lua
IFirewall_Rogers.lua
IFirewall_ScandiumSecurity.lua
IFirewall_SecurityCoverageInc.lua
IFirewall_SoftSphereTechnologies.lua
IFirewall_Sophos.lua
IFirewall_TELUS.lua
IHdEncryption_BitDefender_TS.lua
IHdEncryption_JeticoInc.lua
IHdEncryption_Rogers.lua
IHdEncryption_TrendMicro.lua
IHdEncryption_WinMagicInc.lua
IInstantMessenger_CeruleanStudios.lua
IInstantMessenger_GoogleTalk.lua
IInstantMessenger_ICQ.lua
IInstantMessenger_SkypeTechnologiesSA.lua
IInstantMessenger_Viber.lua
IMSDK.lua
IOBit.lua
IP2p_ApexDC.lua
IP2p_BitTorrent.lua
IP2p_CaffeeSoft.lua
IP2p_FrostWire.lua
IP2p_Gwren.lua
IP2p_OnekitInternetSL.lua
IP2p_RebrandSoftware.lua
IP2p_Samsung.lua
IP2p_TipiSoftware.lua
IP2p_VipRumorLLC.lua
IPatchManagement_DellInc.lua
IPatchManagement_GFI.lua
IPatchManagement_LANDeskSoftware.lua
IPatchManagement_ManageEngineDesktopCentral.lua
IPatchManagement_McAfee.lua
IPatchManagement_ThreatTrackSecurityInc.lua
ISoftwareProduct_ALYac.lua
ISoftwareProduct_Agnitum.lua
ISoftwareProduct_AhnLab.lua
ISoftwareProduct_ArcaBit.lua
ISoftwareProduct_AresDevelopmentGroup.lua
ISoftwareProduct_Avira.lua
ISoftwareProduct_Baidu.lua
ISoftwareProduct_BeijingEastern.lua
ISoftwareProduct_BeyondTrust.lua
ISoftwareProduct_BigFix.lua
ISoftwareProduct_BitDefender.lua
ISoftwareProduct_BitLord.lua
ISoftwareProduct_BkavCorporation.lua
ISoftwareProduct_BullGuard.lua
ISoftwareProduct_ByteLinkerInc.lua
ISoftwareProduct_CMCInformationSecurity.lua
ISoftwareProduct_CaffeeSoft.lua
ISoftwareProduct_ChoopanRattanapoka.lua
ISoftwareProduct_CodeLathe.lua
ISoftwareProduct_Comcast.lua
ISoftwareProduct_ComputerAssociatesInternational.lua
ISoftwareProduct_Cysec.lua
ISoftwareProduct_DESlock.lua
ISoftwareProduct_DefenderProLLC.lua
ISoftwareProduct_DelugeTeam.lua
ISoftwareProduct_DigitalDefender.lua
ISoftwareProduct_Discordia.lua
ISoftwareProduct_DoctorWeb.lua
ISoftwareProduct_F-Secure.lua
ISoftwareProduct_Facebook.lua
ISoftwareProduct_FenrirInc.lua
ISoftwareProduct_Fortinet.lua
ISoftwareProduct_GTBTechnologies.lua
ISoftwareProduct_GoForSharing.lua
ISoftwareProduct_Gwren.lua
ISoftwareProduct_HDDLAB.lua
ISoftwareProduct_Hauri.lua
ISoftwareProduct_IBM.lua
ISoftwareProduct_ICQ.lua
ISoftwareProduct_IkarusAntivirus.lua
ISoftwareProduct_Innobate.lua
ISoftwareProduct_JeticoInc.lua
ISoftwareProduct_JuniperNetworks.lua
ISoftwareProduct_KingsoftCorp.lua
ISoftwareProduct_Kromtech.lua
ISoftwareProduct_Live2SupportInc.lua
ISoftwareProduct_MalwarebytesCorporation.lua
ISoftwareProduct_McAfee.lua
ISoftwareProduct_MediaGet.lua
ISoftwareProduct_MetaMachine.lua
ISoftwareProduct_MicroWorld.lua
ISoftwareProduct_MicrosoftCorp.lua
ISoftwareProduct_MusicLab.lua
ISoftwareProduct_NCPEngineeringGmbH.lua
ISoftwareProduct_NableTechnologiesInc.lua
ISoftwareProduct_NanoSecurity.lua
ISoftwareProduct_Netgate.lua
ISoftwareProduct_NewTechnologyWaveInc.lua
ISoftwareProduct_NictaTechSoftware.lua
ISoftwareProduct_P2PRocketLLC.lua
ISoftwareProduct_PCToolsSoftware.lua
ISoftwareProduct_PWI.lua
ISoftwareProduct_PandaSoftware.lua
ISoftwareProduct_PandoNetwork.lua
ISoftwareProduct_ParagonSoftwareGroup.lua
ISoftwareProduct_ParticipatoryCultureFoundation.lua
ISoftwareProduct_PiipCorporation.lua
ISoftwareProduct_PrivateGroup.lua
ISoftwareProduct_ProlandSoftware.lua
ISoftwareProduct_RSADataLossPrevention.lua
ISoftwareProduct_RebrandSoftware.lua
ISoftwareProduct_RetroShareTeam.lua
ISoftwareProduct_Roboscan.lua
ISoftwareProduct_Rogers.lua
ISoftwareProduct_SPAMfighter.lua
ISoftwareProduct_Samsung.lua
ISoftwareProduct_ScandiumSecurity.lua
ISoftwareProduct_Secunia.lua
ISoftwareProduct_SecurityCoverageInc.lua
ISoftwareProduct_SkyDriveStore.lua
ISoftwareProduct_SkypeTechnologiesSA.lua
ISoftwareProduct_SoftSphereTechnologies.lua
ISoftwareProduct_Sophos.lua
ISoftwareProduct_SparkTechnologyLLC.lua
ISoftwareProduct_Symantec.lua
ISoftwareProduct_TELUS.lua
ISoftwareProduct_TGSoft.lua
ISoftwareProduct_Telefonica.lua
ISoftwareProduct_ThreatTrack_Security_Inc.lua
ISoftwareProduct_TipiSoftware.lua
ISoftwareProduct_TixatiSoftware.lua
ISoftwareProduct_TorrentSwapper.lua
ISoftwareProduct_TrendMicro.lua
ISoftwareProduct_TruxShare.lua
ISoftwareProduct_TurboBT.lua
ISoftwareProduct_USTechSupport.lua
ISoftwareProduct_VipRumorLLC.lua
ISoftwareProduct_VirginMediaSecurity.lua
ISoftwareProduct_VirusBuster.lua
ISoftwareProduct_WindowsDefender.lua
ISoftwareProduct_WindowsFirewall.lua
ISoftwareProduct_WireStack.lua
ISoftwareProduct_YuuWaa.lua
ISoftwareProduct_eMuleProject.lua
ISoftwareProduct_iS3.lua
ISoftwareProduct_transmission.lua
IURLFiltering_ArcaBit.lua
IURLFiltering_ProfilTechnology.lua
IURLFiltering_ThreatTrackSecurityInc.lua
IVpnClient_CheckPoint.lua
IVpnClient_Fortinet.lua
IVpnClient_JuniperNetworksInc.lua
IWebBrowser_GoogleInc.lua
Ikarus.lua
IsoftwareProduct_Anvisoft.lua
IsoftwareProduct_ZeoBITLLC.lua
Jiangmin.lua
JustSystem.lua
K7Computing.lua
K7Computing2.lua
Kaspersky.lua
Kaspersky2.lua
Lavasoft.lua
LuaCommon.lua
LuaCommon2.lua
LuaCommon3.lua
LuaCommon4.lua
LuisCobian.lua
Lumension.lua
McAfee.lua
MicroWorld.lua
Microsoft_IE.lua
Microsoft_Virtual_PC.lua
Microsoft_Windows_Intune.lua
Mozilla.lua
NetMotion.lua
Norman.lua
OPSWAT.lua
Opera.lua
P2pCommon.lua
PCSecurityShield.lua
Preventon.lua
QEMU.lua
Quickheal.lua
Safari.lua
SafeSync.lua
Shavlik.lua
SoftwareProductCommon.lua
SugarSync.lua
Symantec.lua
Symantec2.lua
TenebrilAS.lua
TheExodusTeam.lua
TheSwiftTeam.lua
TheaMSNTeam.lua
Thirtyseven4.lua
TobitSoftware.lua
TrendMicro.lua
Troppus.lua
TrustPort.lua
TrusteerRapport.lua
UltraBac.lua
VERSION
VMware.lua
Verdasys_DigitalGuardian.lua
VirusBuster.lua
WebSense.lua
Webroot.lua
Wontok.lua
ZoneAlarmBackup.lua
eEye.lua
iAntivirus_MicrosoftSecurityEssentials.lua
iolo.lua
ooVoo.lua
utils_debug.lua
utils_error.lua
utils_files.lua
utils_general.lua
utils_json.lua
utils_os.lua
utils_process.lua
utils_reg.lua
utils_string.lua
utils_table.lua
utils_time.lua
$COMMONFILES/supportsoft/bin/tables.dat
.zip
VERSION
tables.xml
$COMMONFILES/supportsoft/bin/vmap.dat
.zip
VERSION
ndll.xml
$PLUGINSDIR/GatherInfo.ini
$PLUGINSDIR/GatherRegInfoNoEmail.ini
$PLUGINSDIR/GatherRegisterationInfo.ini
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ProcHandler.dll
.dll windows:5 windows x86 arch:x86

0949e5fcf0cd6af182d08632350ed79f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
TerminateProcess
OpenProcess
Module32Next
Module32First
Process32First
CreateToolhelp32Snapshot
GetLastError
GetExitCodeProcess
WaitForSingleObject
Process32Next
FreeLibrary
GetProcAddress
LoadLibraryA
SetEndOfFile
CreateFileW
CreateFileA
SetStdHandle
WriteConsoleW
LoadLibraryW
OutputDebugStringA
GetCurrentProcess
GetVersionExA
GlobalAlloc
lstrcpynA
lstrcpyA
CreateProcessA
GlobalFree
InterlockedIncrement
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
ExitProcess
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
GetLocaleInfoW
HeapReAlloc
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetProcessHeap

user32

GetWindowTextA
SendMessageA
EnumWindows

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
RegEnumKeyA

Exports

Exports

Base64DecodeContext
CanInstallAskToolbar
FindAppByPartialAppName
FindBcontByAppName
FindDependentApps
GetInstalledApplications
InstallAskToolbar
IsPendingFileRenameOperationsEmpty
KillAppByPartialAppName
KillBcontByAppName
KillProcessByModuleName
SOREFInitializeReferrer

Sections

.text
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

d83f71e61ee459ee63ca3e829966a9dc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
lstrcpyA
lstrcpynA
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
PeekNamedPipe
GetTickCount
CreateProcessA
GetStartupInfoA
CreatePipe
GetVersionExA
GetModuleHandleA
DeleteFileA
lstrcmpiA
lstrlenA
lstrcatA
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
GetProcAddress
GlobalLock
GetCurrentProcess

user32

SendMessageA
OemToCharBuffA
CharNextA
wsprintfA
CharPrevA
FindWindowExA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 410B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsisunz.dll
.dll windows:4 windows x86 arch:x86

0f92772da9c737d2bac38919e9863980

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryA
lstrcpyA
lstrcmpA
lstrcmpiA
GlobalFree
lstrcpynA
GlobalAlloc
lstrcatA
lstrlenA
GetVersion
LeaveCriticalSection
EnterCriticalSection
GetStdHandle
HeapAlloc
GetProcessHeap
HeapFree
GetLastError
CreateFileA
WriteFile
ReadFile
CloseHandle
SetFilePointer

user32

MessageBoxA
DispatchMessageA
TranslateMessage
PeekMessageA
CharPrevA
wsprintfA
SendMessageA
GetDlgItem
FindWindowExA

Exports

Exports

Unzip
UnzipToLog
UnzipToStack
extract_RunDLL

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 706B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ESResources.dll
.dll windows:5 windows x86 arch:x86

2e168f9fee36c65804acc85d4752ed9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\p4\sprt\project\clienttools_easysupport\trunk\tools\easysupport\out\bin\release_esfree\Win32\ESResources.pdb

Imports

kernel32

GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetLastError
InterlockedDecrement
GetProcAddress
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
LoadLibraryW
WriteFile
GetModuleFileNameW
RtlUnwind
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapSize
IsProcessorFeaturePresent

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
client/accountInfo.htm
.html
client/default_instore_support.htm
.html .js polyglot
client/default_instore_support_img.jpg
.jpg
client/default_live_support_cancelled.htm
.html .js polyglot
client/default_live_support_cancelled_img.jpg
.jpg
client/default_live_support_suspended.htm
.html .js polyglot
client/default_live_support_suspended_img.jpg
.jpg
client/default_promo.htm
.html .js polyglot
client/default_promo_img.jpg
.jpg
client/escont.xml
client/esfree_liveSupport.htm
.js
client/esfree_scan.htm
.js
client/esfree_shell.htm
.js
client/help/help-helper.js
.js
client/help/help.html
.html
client/help/help_header_image.gif
client/inc/controllers/accountInfo_controller.js
.js
client/inc/controllers/esfree_liveSupport_controller.js
.js
client/inc/controllers/esfree_scan_controller.js
.js
client/inc/controllers/esfree_shells_controller.js
.js
client/inc/controllers/liveSupportFree_controller.js
.js
client/inc/controllers/liveSupport_controller.js
.js
client/inc/controllers/scan_controller.js
.js
client/inc/controllers/schedule_controller.js
.js
client/inc/controllers/shells_controller.js
.js
client/inc/controllers/toaster_shells_controller.js
.js
client/inc/helper.js
.js
client/inc/models/accountInfo.js
.js
client/inc/models/esfree_liveSupport.js
.js
client/inc/models/esfree_scan.js
.js
client/inc/models/esfree_shell.js
.js
client/inc/models/liveSupport.js
.js
client/inc/models/liveSupportFree.js
.js
client/inc/models/scan.js
.js
client/inc/models/schedule.js
.js
client/inc/models/shell.js
.js
client/inc/models/toaster_shell.js
.js
client/inc/tempLocalization.js
.js
client/inc/views/accountInfos.js
.js
client/inc/views/esfree_liveSupports.js
.js
client/inc/views/esfree_scans.js
.js
client/inc/views/esfree_shells.js
.js
client/inc/views/liveSupportFrees.js
.js
client/inc/views/liveSupports.js
.js
client/inc/views/scans.js
.js
client/inc/views/schedules.js
.js
client/inc/views/shells.js
.js
client/inc/views/toaster_shells.js
.js
client/lbr_report.xsl
client/lbr_scan_details.xsl
client/liveSupport.htm
.js
client/liveSupportFree.htm
.js
client/scan.htm
.js
client/schedule.htm
client/shell.htm
.js
client/style/accountInfo.css
client/style/common.css
client/style/esfree_liveSupport.css
client/style/esfree_scan.css
client/style/esfree_shell.css
client/style/img/arrow.gif
.gif
client/style/img/big_UI_bottom_bg.gif
.gif
client/style/img/bottom-promo.gif
.gif
client/style/img/btn_back_to_report.gif
.gif
client/style/img/btn_back_to_results.gif
.gif
client/style/img/btn_close.gif
.gif
client/style/img/btn_continue_scan.gif
.gif
client/style/img/btn_home.gif
.gif
client/style/img/btn_no.gif
.gif
client/style/img/cancel_btn.gif
.gif
client/style/img/chat_btn.gif
.gif
client/style/img/chat_btn_disabled.gif
.gif
client/style/img/chat_icon.gif
.gif
client/style/img/data.gif
.gif
client/style/img/data_fair.gif
.gif
client/style/img/data_good.gif
.gif
client/style/img/data_poor.gif
.gif
client/style/img/download_btn.gif
.gif
client/style/img/edit_account_info.gif
.gif
client/style/img/feedback_btn.gif
.gif
client/style/img/feedback_list_image.gif
.gif
client/style/img/feedback_page_bg.gif
.gif
client/style/img/feedback_submit_btn.gif
.gif
client/style/img/help_icon.gif
.gif
client/style/img/info_icon.gif
.gif
client/style/img/loading.gif
.gif
client/style/img/loading_16x16.gif
.gif
client/style/img/menuBg.gif
.gif
client/style/img/performance.gif
.gif
client/style/img/performance_fair.gif
.gif
client/style/img/performance_good.gif
.gif
client/style/img/performance_poor.gif
.gif
client/style/img/phone_icon.gif
.gif
client/style/img/popup_container.gif
.gif
client/style/img/progressBar_bg.gif
.gif
client/style/img/progressBar_fg.gif
.gif
client/style/img/queContBg.gif
.gif
client/style/img/re_scan_my_pc.gif
.gif
client/style/img/recommend_btn.gif
.gif
client/style/img/refresh.gif
.gif
client/style/img/repair_all.gif
.gif
client/style/img/report_header_image.gif
client/style/img/report_icon.ico
client/style/img/report_recBoxBg.gif
.gif
client/style/img/retry_btn.gif
.gif
client/style/img/save_schedule_btn.gif
.gif
client/style/img/scan_my_pc.gif
.gif
client/style/img/scoreArea_repairing.gif
.gif
client/style/img/scoreArea_scan.gif
.gif
client/style/img/scoreArea_scanning.gif
.gif
client/style/img/scoreArea_status_fair.gif
.gif
client/style/img/scoreArea_status_good.gif
.gif
client/style/img/scoreArea_status_poor.gif
.gif
client/style/img/security.gif
.gif
client/style/img/security_fair.gif
.gif
client/style/img/security_good.gif
.gif
client/style/img/security_poor.gif
.gif
client/style/img/shell_bg.gif
.gif
client/style/img/show_less.gif
.gif
client/style/img/show_more.gif
.gif
client/style/img/small_alert_head.gif
.gif
client/style/img/splash_screen.gif
.gif
client/style/img/start_remote_session_btn.gif
.gif
client/style/img/start_remote_session_btn_disabled.gif
.gif
client/style/img/step_1.gif
.gif
client/style/img/step_2.gif
.gif
client/style/img/step_3.gif
.gif
client/style/img/system.gif
.gif
client/style/img/system_fair.gif
.gif
client/style/img/system_good.gif
.gif
client/style/img/system_poor.gif
.gif
client/style/img/talk_to_pte.gif
.gif
client/style/img/toaster_alert_bg.gif
.gif
client/style/img/toaster_alert_close_btn.gif
.gif
client/style/img/toaster_bottom_bg.gif
.gif
client/style/img/toaster_head_bg.gif
.gif
client/style/img/toaster_icon_1.ico
client/style/img/toaster_icon_2.ico
client/style/img/toaster_icon_3.ico
client/style/img/toaster_icon_4.ico
client/style/img/toaster_icon_default.ico
client/style/img/uninstall_btn.gif
.gif
client/style/img/upgrade_retry_btn.gif
.gif
client/style/img/warning.gif
.gif
client/style/img/win8.gif
.gif
client/style/img/win8check_fair.gif
.gif
client/style/img/win8check_good.gif
.gif
client/style/img/win8check_poor.gif
.gif
client/style/img/win8check_unknown.gif
.gif
client/style/liveSupport.css
client/style/liveSupportFree.css
client/style/popUp.css
client/style/progressBar.css
client/style/scan.css
client/style/schedule.css
client/style/shell.css
client/style/tenant.css
client/style/toaster_shell.css
client/toaster_escont.xml
client/toaster_shell.htm
common/inc/cont.js
.js
common/inc/jamal.js
.js
common/inc/jquery.js
.js
common/inc/jquery.json.js
.js
common/inc/jqueryFade.js
.js
common/inc/jqueryui/jquery-ui.js
.js
common/inc/jqueryui/theme/jquery.ui.accordion.css
common/inc/jqueryui/theme/jquery.ui.all.css
common/inc/jqueryui/theme/jquery.ui.base.css
common/inc/jqueryui/theme/jquery.ui.core.css
common/inc/jqueryui/theme/jquery.ui.theme.css
common/inc/jqueryui/theme/jqueryui-override.css
common/inc/progressBar.js
.js
common/inc/sprt.js
.js
easySupport.ico
esService.exe
.exe windows:5 windows x86 arch:x86

79ed02bd512199c15c6234026f246951

Code Sign

6e:87:4d:81:6d:04:9e:b0:67:1a:91:f9:7d:d0:3e:95
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

15/01/2016, 00:00

Not After

06/08/2016, 23:59

Subject

CN=Support.com\, Inc.,O=Support.com\, Inc.,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:f9:ee:7c:b3:fb:60:77:b2:39:af:99:a5:8d:19:b0:2d:31:44:a8:25:ca:bb:82:dd:10:7f:10:a8:6a:4e:83
Signer

Actual PE Digest

47:f9:ee:7c:b3:fb:60:77:b2:39:af:99:a5:8d:19:b0:2d:31:44:a8:25:ca:bb:82:dd:10:7f:10:a8:6a:4e:83

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\p4\sprt\project\clienttools_easysupport\trunk\tools\easysupport\out\bin\release_esfree\Win32\esService.pdb

Imports

rpcrt4

UuidCreate
UuidCreateNil
UuidToStringW

dbghelp

MiniDumpWriteDump

wininet

InternetGetConnectedState
InternetCheckConnectionW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

kernel32

FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
SetUnhandledExceptionFilter
GetModuleHandleW
OutputDebugStringA
ResetEvent
CreateEventW
LoadLibraryW
GetPrivateProfileStringA
GetProcAddress
WaitForSingleObject
GetExitCodeThread
CreateThread
IsWow64Process
OpenMutexW
GetDriveTypeW
GetLogicalDriveStringsW
GetModuleFileNameW
TlsGetValue
GetCurrentThread
TlsSetValue
TlsAlloc
GetThreadTimes
TlsFree
ResumeThread
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetPrivateProfileStringW
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
GetDateFormatW
GetTimeFormatW
GetVersionExW
OutputDebugStringW
FormatMessageA
GetFileAttributesW
GetFileAttributesExW
SetFilePointerEx
SetEnvironmentVariableA
CompareStringW
SetStdHandle
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetTimeZoneInformation
DeleteTimerQueueTimer
CreateTimerQueueTimer
GetLastError
GetTickCount
CreateTimerQueue
CreateFileW
GetCurrentThreadId
GetCurrentProcess
CloseHandle
SetEvent
GetCurrentProcessId
RaiseException
GetLocalTime
CopyFileW
DeleteCriticalSection
InitializeCriticalSection
GetSystemTime
lstrlenA
Sleep
DeleteFileA
lstrlenW
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
ExpandEnvironmentStringsW
InterlockedDecrement
GetCommandLineW
HeapSetInformation
GetStartupInfoW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitThread
GetSystemTimeAsFileTime
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
InterlockedIncrement
GetLocaleInfoW
MoveFileA
TerminateProcess
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
ExitProcess
HeapSize
IsDebuggerPresent
UnhandledExceptionFilter
SetLastError
IsProcessorFeaturePresent
GetCPInfo
LCMapStringW
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetFullPathNameW
FileTimeToLocalFileTime
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
LocalFree
CreateDirectoryW
SystemTimeToFileTime
CompareFileTime
HeapAlloc
GetProcessHeap
HeapFree
ConnectNamedPipe
WaitNamedPipeW
WaitForMultipleObjectsEx
GetOverlappedResult
ReadFileEx
CancelIo
DisconnectNamedPipe
TerminateThread
SetNamedPipeHandleState
CreateNamedPipeW
CreateWaitableTimerW
SetWaitableTimer
WaitForMultipleObjects
FileTimeToSystemTime
InitializeCriticalSectionAndSpinCount
ReleaseMutex
CreateFileA
CreateMutexW
SetFileAttributesW
lstrcpynW
GetComputerNameW

user32

wsprintfA
KillTimer
GetMessageW
wsprintfW
PostThreadMessageW
SetTimer
LoadStringW
CharNextW
CharUpperW
MessageBoxW
DispatchMessageW
PeekMessageW
TranslateMessage
MsgWaitForMultipleObjects
LoadStringA

advapi32

CryptDestroyKey
RegCloseKey
GetLengthSid
SetTokenInformation
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
RegisterServiceCtrlHandlerExW
CreateServiceW
ChangeServiceConfig2W
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetServiceStatus
DuplicateTokenEx
GetTokenInformation
CreateProcessAsUserW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CryptDecrypt
CryptReleaseContext
CryptEncrypt
CryptSetKeyParam
CryptImportKey
CryptAcquireContextW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
ControlService
DeleteService
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
ConvertSidToStringSidW

ole32

CoInitializeSecurity
CoCreateGuid
CoReleaseServerProcess
CoAddRefServerProcess
CoInitialize
CLSIDFromProgID
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

SysStringByteLen
GetErrorInfo
SysAllocString
VarBstrCat
VarBstrCmp
SysStringLen
SysAllocStringLen
VariantCopy
SysAllocStringByteLen
VariantInit
VariantClear
SysFreeString

shlwapi

StrTrimW

shell32

SHGetFolderPathW

Sections

.text
Size: 750KB - Virtual size: 749KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
escont.exe
.exe windows:5 windows x86 arch:x86

bed1028468eb6caba25ee06cce5b6794

Code Sign

6e:87:4d:81:6d:04:9e:b0:67:1a:91:f9:7d:d0:3e:95
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

15/01/2016, 00:00

Not After

06/08/2016, 23:59

Subject

CN=Support.com\, Inc.,O=Support.com\, Inc.,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2b:8c:85:0f:53:eb:61:c1:37:aa:4c:93:96:e6:12:c0:88:78:6a:ab:5a:44:53:f3:d7:75:63:31:cf:7b:be:11
Signer

Actual PE Digest

2b:8c:85:0f:53:eb:61:c1:37:aa:4c:93:96:e6:12:c0:88:78:6a:ab:5a:44:53:f3:d7:75:63:31:cf:7b:be:11

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\p4\sprt\project\clienttools_easysupport\trunk\tools\easysupport\out\bin\release_esfree\Win32\escont.pdb

Imports

dbghelp

MiniDumpWriteDump

netapi32

NetApiBufferFree
NetUserGetInfo

kernel32

GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpW
MulDiv
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
SetLastError
GetCurrentProcessId
SetEvent
CloseHandle
WaitForSingleObject
CreateThread
CreateEventW
CreateFileW
WideCharToMultiByte
SetUnhandledExceptionFilter
GetCommandLineW
CreateMutexW
GetVersionExW
GetTickCount
InitializeCriticalSection
TlsGetValue
GetCurrentThread
TlsSetValue
ResetEvent
TlsAlloc
GetThreadTimes
TlsFree
ResumeThread
FormatMessageA
GetACP
GetStdHandle
HeapCreate
GetCurrentDirectoryW
GetFileType
PeekNamedPipe
GetFileInformationByHandle
ExitProcess
HeapSize
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetCPInfo
LCMapStringW
HeapReAlloc
VirtualQuery
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
MoveFileA
GetStartupInfoW
HeapSetInformation
FindFirstFileExW
GetProcAddress
RtlUnwind
DecodePointer
EncodePointer
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetFullPathNameW
ReadFile
FileTimeToSystemTime
FileTimeToLocalFileTime
FindClose
CreateNamedPipeW
SetNamedPipeHandleState
TerminateThread
WriteFile
DisconnectNamedPipe
CancelIo
ReadFileEx
GetOverlappedResult
WaitForMultipleObjectsEx
WaitNamedPipeW
ConnectNamedPipe
HeapFree
GetProcessHeap
HeapAlloc
CreateDirectoryW
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
RaiseException
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSectionAndSpinCount
Sleep
DeleteFileA
lstrlenA
lstrcmpiW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
GetLastError
lstrlenW
GetModuleHandleW
GetFileAttributesW
CopyFileW
GetModuleFileNameW
GetOEMCP
SetHandleCount
IsValidCodePage
LocalFree
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetDriveTypeW
SetEnvironmentVariableA
CompareStringW
GetStringTypeW
SetStdHandle
SetEndOfFile
GetTimeZoneInformation
WriteConsoleW
CreateFileA

user32

CharNextW
SendMessageW
TrackPopupMenuEx
SetForegroundWindow
UnregisterClassA
BringWindowToTop
IsIconic
GetForegroundWindow
FlashWindowEx
MessageBoxW
GetMessageW
GetKeyState
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
GetActiveWindow
DestroyWindow
GetDlgItem
InvalidateRgn
InvalidateRect
SetCapture
ClientToScreen
CreateAcceleratorTableW
GetDC
ReleaseDC
GetDesktopWindow
GetClassNameW
RedrawWindow
IsWindow
BeginPaint
FillRect
EndPaint
IsChild
SetFocus
GetFocus
GetSysColor
DestroyAcceleratorTable
CallWindowProcW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SetWindowLongW
DefWindowProcW
GetClassInfoExW
LoadCursorW
RegisterClassExW
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
UpdateWindow
MoveWindow
PostMessageW
CreateWindowExW
ReleaseCapture
GetClientRect
EndDeferWindowPos
GetWindowRect
ScreenToClient
DeferWindowPos
BeginDeferWindowPos
SetWindowPos
SystemParametersInfoW
PostQuitMessage
RegisterWindowMessageW
GetSystemMetrics
LoadImageW
LoadIconW
GetWindowLongW
LoadMenuW
GetSubMenu
SetMenuItemInfoW
GetCursorPos
IsWindowVisible
ShowWindow
PostThreadMessageW

gdi32

GetObjectW
GetDeviceCaps
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetStockObject

advapi32

OpenSCManagerW
OpenServiceW
QueryServiceStatus
ControlService
CloseServiceHandle
StartServiceW
GetUserNameW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

shell32

Shell_NotifyIconW
SHAppBarMessage

ole32

CoUninitialize
CoInitialize
CoRevokeClassObject
CoRegisterClassObject
OleLockRunning
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

BSTR_UserSize
SysAllocStringLen
VariantInit
VariantClear
BSTR_UserMarshal
SysStringByteLen
OleCreateFontIndirect
RegisterTypeLi
UnRegisterTypeLi
BSTR_UserUnmarshal
SysAllocStringByteLen
BSTR_UserFree
SysAllocString
SysFreeString
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
SysStringLen

rpcrt4

UuidCreateNil
UuidCreate
UuidToStringW
NdrCStdStubBuffer2_Release
NdrDllUnregisterProxy
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrOleAllocate
NdrOleFree
NdrStubCall2
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrStubForwardingFunction

Sections

.text
Size: 350KB - Virtual size: 350KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 59B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SHARED_E
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
solutions/browser-chrome_clear_cookies_nonxp.xml
.xml
solutions/browser-chrome_clear_cookies_xp.xml
.xml
solutions/browser-disable_script_debugger.xml
.xml
solutions/browser-ff2_configure_website_cetificates.xml
.xml
solutions/browser-ff3_clear_auto_complete_forms.xml
.xml
solutions/browser-ff3_configure_website_cetificates.xml
.xml
solutions/browser-ff3_delete_cookies.xml
.xml
solutions/browser-ff_clear_auto_complete_forms.xml
.xml
solutions/browser-ff_clear_cache.xml
.xml
solutions/browser-ff_clear_downloadhistory.xml
.xml
solutions/browser-ff_clear_history.xml
.xml
solutions/browser-ff_configure_website_cetificates.xml
.xml
solutions/browser-ffuser_caches.xml
solutions/browser-ffx_clear_auto_complete_forms.xml
.xml
solutions/browser-ffx_delete_cookies.xml
.xml
solutions/browser-ffx_disable-site-tracking.xml
.xml
solutions/browser-ffx_disable_password_retention.xml
.xml
solutions/browser-ffx_enable_pop-up_blocker.xml
.xml
solutions/browser-ffx_set_cache_size.xml
.xml
solutions/browser-ie6_clear_auto_complete_forms.xml
.xml
solutions/browser-ie7_clear_auto_complete_forms.xml
.xml
solutions/browser-iex-clear_history.xml
.xml
solutions/browser-iex-default_privacy_setting.xml
.xml
solutions/browser-iex-delete_cookies.xml
.xml
solutions/browser-iex-enable_open_link_newtab.xml
.xml
solutions/browser-iex-reset_zone_security.xml
.xml
solutions/browser-iex-restore_advanced_setting.xml
.xml
solutions/browser-iex_clear_auto_complete_forms.xml
.xml
solutions/browser-iex_clear_cache.xml
.xml
solutions/browser-iex_clear_url_dropdown_list.xml
.xml
solutions/browser-iex_configure_simultaneous_downloads.xml
.xml
solutions/browser-iex_enable_popup_blocker.xml
.xml
solutions/browser-iex_optimize_security_setting.xml
.xml
solutions/browser-iex_reset_privacy_setting_to_medium.xml
.xml
solutions/browser-iex_set_cache_size.xml
.xml
solutions/browser-lso_cookies.xml
solutions/browser-silverlight_cache.xml
solutions/browser-user_data.xml
solutions/config/ScanOutputDataConfig.xml
solutions/config/ScoreConfig.xml
.xml
solutions/config/ssagent.xml
.xml
solutions/cpu-check_speed.xml
.xml
solutions/databackup-check-status.xml
.xml
solutions/hw-nvsta_enable_cdrom_autoplay.xml
.xml
solutions/hw-vsta_enable_cdrom_autoplay.xml
.xml
solutions/istask-scheduled.xml
.xml
solutions/media-player-optimization.xml
.xml
solutions/os-adjust_animation_effects.xml
.xml
solutions/os-adjust_font_smoothening.xml
.xml
solutions/os-adjust_schedtask_polling.xml
.xml
solutions/os-check_invalid_shortcuts.xml
.xml
solutions/os-clean_chkdsk_files.xml
.xml
solutions/os-clean_system_prefetch.xml
.xml
solutions/os-clean_windowsold_files.xml
.xml
solutions/os-disable_hibernation.xml
.xml
solutions/os-disable_network_printer_folder_autosearch.xml
.xml
solutions/os-disable_paging_executive.xml
.xml
solutions/os-disable_windows_sidebar.xml
.xml
solutions/os-empty_recycle_bin.xml
.xml
solutions/os-enable-system-restore.xml
.xml
solutions/os-enable_boot_defragment.xml
.xml
solutions/os-erase_recently_used_document_list.xml
.xml
solutions/os-erase_recently_used_program_list_using_run_command.xml
.xml
solutions/os-greenpc-setting.xml
.xml
solutions/os-improve_internal_data_transfer_rate.xml
.xml
solutions/os-nvsta_adjust_menu_appearance.xml
.xml
solutions/os-nvsta_adjust_visual_effects.xml
.xml
solutions/os-nvsta_configure_recycle_bin_size.xml
.xml
solutions/os-nvsta_disable_disk_performance_monitor.xml
.xml
solutions/os-nvsta_set_dns_cache.xml
.xml
solutions/os-optimized_networksettings.xml
.xml
solutions/os-remove_temp_files_from_all_user_profiles.xml
.xml
solutions/os-remove_windows_mail_splash_screen.xml
.xml
solutions/os-set_protocol_setting.xml
.xml
solutions/os-set_system_prefetch.xml
.xml
solutions/os-set_usb_polling_interval.xml
.xml
solutions/os-vst_turn_off_welcome_center.xml
.xml
solutions/os-vsta_configure_recycle_bin_size.xml
.xml
solutions/os-vsta_set_critical_windows_vista_services.xml
.xml
solutions/os-win10_set_critical_windows_win10_services.xml
.xml
solutions/os-win7_set_critical_windows_win7_services.xml
.xml
solutions/os-win7_show_desktop_shortcuts.xml
.xml
solutions/os-win8-autoend-nonresponsive-task.xml
.xml
solutions/os-win8-disable-logontext-shadow.xml
.xml
solutions/os-win8-hide_lock_screen.xml
.xml
solutions/os-win8-run-startup-script-auto.xml
.xml
solutions/os-win8-show_all_folder_in_explorer.xml
.xml
solutions/os-win8-speedup-shutdown.xml
.xml
solutions/os-win81_set_critical_windows_win81_services.xml
.xml
solutions/os-win8_set_critical_windows_win8_services.xml
.xml
solutions/os-winupdate_check.xml
.xml
solutions/os-wireless_check.xml
.xml
solutions/security-check_antispyware.xml
.xml
solutions/security-check_antivirus.xml
.xml
solutions/security-check_firewall.xml
.xml
solutions/security-runantivirus_scan.xml
.xml
solutions/service-disable_adaptive_brightness_service.xml
.xml
solutions/service-disable_application_layer_gateway_service.xml
.xml
solutions/service-disable_biometric_service.xml
.xml
solutions/service-disable_bitLocker_drive_encryption_service.xml
.xml
solutions/service-disable_bluetooth_support_service.xml
.xml
solutions/service-disable_branch_cache_service.xml
.xml
solutions/service-disable_certificate_propagation_service.xml
.xml
solutions/service-disable_credential_manager_service.xml
.xml
solutions/service-disable_dfs_replication_service.xml
.xml
solutions/service-disable_diagnostic_policy_service.xml
.xml
solutions/service-disable_diagnostic_service_host_service.xml
.xml
solutions/service-disable_diagnostic_system_host_service.xml
.xml
solutions/service-disable_distributed_link_tracking_client_service.xml
.xml
solutions/service-disable_indexing_service.xml
.xml
solutions/service-disable_internet_connection_sharing_service.xml
.xml
solutions/service-disable_linklayer_topology_discovery_mapper_service.xml
.xml
solutions/service-disable_messenger_service.xml
.xml
solutions/service-disable_microsoft_iscsi_initiator_service.xml
.xml
solutions/service-disable_netlogon_service.xml
.xml
solutions/service-disable_netmeeting_remote_desktop_sharing.xml
.xml
solutions/service-disable_network_access_protection_agent_service.xml
.xml
solutions/service-disable_parental_controls_service.xml
.xml
solutions/service-disable_problem_reports_and_solutions_control_panel_support.xml
.xml
solutions/service-disable_remote_desktop_help_session_manager.xml
.xml
solutions/service-disable_remote_registry_service.xml
.xml
solutions/service-disable_routing_and_remote_access_service.xml
.xml
solutions/service-disable_smart_card_removal_policy_service.xml
.xml
solutions/service-disable_smart_card_service.xml
.xml
solutions/service-disable_snmp_trap_service.xml
.xml
solutions/service-disable_telnet.xml
.xml
solutions/service-disable_terminal_services.xml
.xml
solutions/service-disable_winhttp_web_proxy_auto_discovery_service.xml
.xml
solutions/service-nvsta_disable_error_reporting_service.xml
solutions/service-set_logical_disk_manager_service.xml
.xml
solutions/service-vsta_disable_error_reporting_service.xml
solutions/sw-clear_office_setup_files.xml
.xml
solutions/sw-erase_windows_media_player_recently_used_files.xml
.xml
solutions/sw-nvsta_erase_qtp_recently_used_files.xml
.xml
solutions/sw-nvsta_erase_realplayer_recently_used_files.xml
.xml
solutions/system-check_memory.xml
.xml
solutions/system-check_os.xml
.xml
solutions/system-check_primaryharddrive.xml
.xml
solutions/system-check_videocard.xml
.xml
solutions/system-get_directx_info.xml
.xml
solutions/system-get_total_disk_space.xml
.xml
solutions/test/Set Protocol Setting (NA).reg
solutions/test/Set Protocol Setting 1.reg
solutions/test/Set Protocol Setting 2.reg
solutions/test/browser-iex_configure_simultaneous_downloads.notoptimal.reg
solutions/test/browser-iex_configure_simultaneous_downloads.optimal.reg
solutions/test/browser-iex_enable_popup_blocker.notoptimal.reg
solutions/test/browser-iex_enable_popup_blocker.optimal.reg
solutions/test/os-improve_internal_data_transfer_rate.notoptimal.reg
solutions/test/os-improve_internal_data_transfer_rate.optimal.reg
solutions/test/os-nvsta_adjust_visual_effects_notoptimal.reg
solutions/test/os-nvsta_adjust_visual_effects_optimal.reg
solutions/updatedefragtask.xml
.xml
sqlite3.dll
.dll windows:4 windows x86 arch:x86

ac76ff326bd870d1d025d789843c266a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileW
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
GetCurrentProcessId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetVersionExA
InitializeCriticalSection
InterlockedCompareExchange
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
SetEndOfFile
SetFilePointer
Sleep
TlsGetValue
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile

msvcrt

__dllonexit
_errno
_iob
_winmajor
abort
calloc
fflush
free
fwrite
localtime
malloc
memcmp
memmove
memset
qsort
realloc
strcmp
strncmp
vfprintf

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_config
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_step
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strnicmp
sqlite3_table_column_metadata
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_utf8_to_mbcs
winCurrentTime
winDlClose
winDlSym

Sections

.text
Size: 372KB - Virtual size: 372KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/35
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/51
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/63
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/77
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/89
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 512B - Virtual size: 269B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/113
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/124
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ssagent.exe
.exe windows:5 windows x86 arch:x86

2147f8d223b14eb21526f6bbd0452b67

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:79:2d:13:1d:6f:0f:90:32:15:c1:cc:23:26:a5:0c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/07/2013, 00:00

Not After

06/08/2016, 23:59

Subject

CN=Support.com\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Support.com\, Inc.,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\p4\sprt\project\client\v77\src\Release\ssagent.pdb

Imports

wininet

PrivacySetZonePreferenceW
FindCloseUrlCache
FindFirstUrlCacheEntryA
DeleteUrlCacheEntry
FindNextUrlCacheEntryA

powrprof

IsPwrHibernateAllowed
CallNtPowerInformation

dbghelp

MiniDumpWriteDump

sqlite3

sqlite3_open
sqlite3_changes
sqlite3_errmsg
sqlite3_finalize
sqlite3_step
sqlite3_column_count
sqlite3_free
sqlite3_mprintf
sqlite3_close
sqlite3_exec
sqlite3_busy_timeout
sqlite3_prepare_v2

secur32

GetUserNameExA

kernel32

UnhandledExceptionFilter
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetProcAddress
GetModuleHandleA
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrcmpiA
EnterCriticalSection
LeaveCriticalSection
IsDBCSLeadByte
GetModuleFileNameA
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetCurrentProcessId
CreateEventA
CloseHandle
GetCurrentThreadId
SetEvent
GetTempPathA
CopyFileA
CreateDirectoryA
GetCurrentProcess
CreateFileA
OutputDebugStringA
SetUnhandledExceptionFilter
GetCommandLineA
WaitForSingleObject
GetFileAttributesA
FindNextFileA
FindFirstFileA
GetTickCount
GetFileSize
ExpandEnvironmentStringsA
DeleteFileA
SetFileAttributesA
GetDiskFreeSpaceExA
LoadLibraryA
SystemTimeToFileTime
GetSystemTime
IsDebuggerPresent
Sleep
IsWow64Process
LocalFree
LocalAlloc
CompareStringA
GetVersionExA
FindClose
GetPrivateProfileStringA
VirtualAlloc
ReadFile
FileTimeToSystemTime
LoadLibraryW
MoveFileExA
RemoveDirectoryA
CreatePipe
GetStdHandle
DuplicateHandle
CreateProcessA
ExpandEnvironmentStringsW
GetFileAttributesW
GetProcessAffinityMask
SetThreadAffinityMask
GetCurrentThread
InitializeCriticalSection
HeapAlloc
GetProcessHeap
HeapFree
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
GetTimeZoneInformation
GetSystemPowerStatus
GetLocalTime
GetSystemDirectoryA
GetWindowsDirectoryA
GetCPInfo
LCMapStringW
GetDateFormatA
GetTimeFormatA
MoveFileA
FindFirstFileExA
GetDriveTypeA
HeapReAlloc
GetStartupInfoW
HeapSetInformation
RtlUnwind
VirtualQuery
TerminateProcess
ExitProcess
WriteFile
HeapCreate
HeapSize
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
DecodePointer
SetHandleCount
GetFileType
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetFilePointer
FlushFileBuffers
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryW
GetStringTypeW
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleW
GetDriveTypeW
SetEndOfFile
CompareStringW
SetEnvironmentVariableA
CreateFileW
EncodePointer
InterlockedExchange
GetModuleFileNameW
GetSystemInfo
GetModuleHandleW
VirtualProtect

user32

SendMessageA
MessageBoxA
IsWindow
CharNextA
FindWindowA
PostThreadMessageA
DispatchMessageA
PeekMessageA
wsprintfA
wsprintfW

advapi32

GetUserNameA
RegCreateKeyA
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
CopySid
GetTokenInformation
OpenProcessToken
RegGetKeySecurity
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumKeyA
RegSetKeySecurity
QueryServiceConfigA
ControlService
StartServiceA
ChangeServiceConfig2A
ChangeServiceConfigA
CloseServiceHandle
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegEnumValueA
RegQueryInfoKeyA
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA

ole32

CoReleaseServerProcess
CoAddRefServerProcess
CLSIDFromProgID
CoInitialize
CoUninitialize
CoInitializeEx
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CLSIDFromString
CoSetProxyBlanket
CoTaskMemFree
OleInitialize
CoCreateInstance

shell32

SHGetFolderPathA
SHGetPathFromIDListA
SHGetFolderLocation
ShellExecuteExW
SHQueryRecycleBinA
SHEmptyRecycleBinA

oleaut32

SafeArrayUnaccessData
SafeArrayAccessData
VariantChangeType
VariantCopy
SysAllocString
SysAllocStringLen
VariantClear
VariantInit
VarBstrCmp
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree
LoadTypeLi
SysFreeString
SysStringLen
VarUI4FromStr
LoadRegTypeLi

urlmon

CoInternetCreateZoneManager

rpcrt4

RpcStringFreeA
NdrCStdStubBuffer2_Release
UuidToStringA
UuidFromStringA
NdrStubCall2
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
IUnknown_Release_Proxy

wintrust

WinVerifyTrust

version

GetFileVersionInfoSizeA

Exports

Exports

SSSANGLexerNew
SSSANGLexerNewSSD
SSSANGParserNew
SSSANGParserNewSSD
antlr3BaseRecognizerNew
antlr3BitsetCopy
antlr3BitsetList
antlr3BitsetLoad
antlr3BitsetNew
antlr3BitsetOf
antlr3BitsetSetAPI
antlr3CommonTokenDebugStreamSourceNew
antlr3CommonTokenNew
antlr3CommonTokenStreamNew
antlr3CommonTokenStreamSourceNew
antlr3EnumNew
antlr3ExceptionNew
antlr3Hash
antlr3HashTableNew
antlr3IntStreamNew
antlr3IntTrieNew
antlr3LexerNew
antlr3LexerNewStream
antlr3ListNew
antlr3MTExceptionNew
antlr3NewAsciiStringCopyStream
antlr3NewAsciiStringInPlaceStream
antlr3NewUCS2StringInPlaceStream
antlr3ParserNew
antlr3ParserNewStream
antlr3ParserNewStreamDbg
antlr3RecognitionExceptionNew
antlr3SetTokenAPI
antlr3StackNew
antlr3StringFactoryNew
antlr3TokenFactoryNew
antlr3TokenStreamNew
antlr3UCS2StringFactoryNew
antlr3VectorFactoryNew
antlr3VectorNew
antlr3dfapredict
antlr3dfaspecialStateTransition
antlr3dfaspecialTransition

Sections

.text
Size: 710KB - Virtual size: 710KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 51B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 622KB - Virtual size: 622KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sslogupload.exe
.exe windows:5 windows x86 arch:x86

2bf155c4f8aa4a3fe70e756cabf62a6e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\p4\sprt\project\client\v39\src\Release\sslogupload.pdb

Imports

kernel32

GetCommandLineA
CreateEventA
CloseHandle
ResetEvent
WaitForSingleObject
DeleteFileA
SetEvent
Sleep
InterlockedDecrement
SetFilePointerEx
WriteFile
ReadFile
CreateFileW
FlushFileBuffers
GetLastError
GetFileAttributesExW
WideCharToMultiByte
MultiByteToWideChar
FormatMessageA
lstrlenA
HeapFree
GetProcessHeap
SetEndOfFile
GetLocaleInfoW
LoadLibraryA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateFileA
InitializeCriticalSectionAndSpinCount
IsValidLocale
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoA
HeapAlloc
RtlUnwind
RaiseException
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
SetHandleCount
GetStdHandle
GetFileType
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointer
GetModuleFileNameA
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetModuleHandleA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
InitializeCriticalSection

ole32

CoCreateInstance
CoInitializeSecurity
CoUninitialize
CoInitializeEx
CLSIDFromProgID

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

Sections

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 84KB

.rsrc Size: 48KB - Virtual size: 48KB

765e602861bc5d288fcf3ed246916809

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

1c:a9:cc:01:74:7a:11:b1:ea:af:10:3c:8d:9a:9e:6cCertificate

Extended Key Usages

Key Usages

fa:73:b4:0f:4f:75:18:79:13:28:7f:bf:59:4c:0e:5b:db:9c:7f:99Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

mpr

psapi

userenv

user32

advapi32

shell32

ole32

oleaut32

msvcp100

msvcr100

shlwapi

version

Exports

Exports

Sections

.text Size: 1020KB - Virtual size: 5.4MB

.rsrc Size: 8KB - Virtual size: 12KB

.reloc Size: 512B - Virtual size: 512B

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 84KB

.rsrc
Size: 48KB - Virtual size: 48KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

1c:a9:cc:01:74:7a:11:b1:ea:af:10:3c:8d:9a:9e:6c
Certificate

fa:73:b4:0f:4f:75:18:79:13:28:7f:bf:59:4c:0e:5b:db:9c:7f:99
Signer

.text
Size: 1020KB - Virtual size: 5.4MB

.rsrc
Size: 8KB - Virtual size: 12KB

.reloc
Size: 512B - Virtual size: 512B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 92KB - Virtual size: 92KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 8KB - Virtual size: 7KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 410B

.text
Size: 16KB - Virtual size: 14KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 706B

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 11KB - Virtual size: 11KB

.reloc
Size: 2KB - Virtual size: 1KB