dmmiedit[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

dmmiedit.rar
Size

4.8MB
MD5

8b208733982fdc4fdff15eeac71003e7
SHA1

0f4594481cfee15d604ba32bff7f063ede69b655
SHA256

224cce847f4245c96e8a855cc25999e819aafac84c33e816252a1787348b8f8e
SHA512

1539de416d85e23af949ca3c8a0d75cbd9204e8d771fbd8abec5f0ef1e57eafd5e983022ff140c532e10b9ac874c026e0f87d6372e2956d626071b056612bd22
SSDEEP

98304:RuLgwbgPFGE+i+oGs3wAVM+SolakfSH71dWc3zcTRUx0B9+D1SwNQ6N8W0j8T:RDwb9oG7AcQxSCQzsUx0B9EzNQ6WAT

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DMIEDIT.EXE
unpack001/DMIEDITx64.EXE
unpack001/bit.exe

Files

dmmiedit.rar
.rar
AMI_AptioV_DMIEDIT_GUI_User_Guide_NDA.pdf
.pdf
DMIEDIT.EXE
.exe windows:5 windows x86 arch:x86

94a15243b64f8836e8a90164f8331bb2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TrackPopupMenu
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
GetScrollInfo
SetScrollInfo
CallWindowProcA
GetWindowPlacement
UnhookWindowsHookEx
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
EndDialog
SetWindowsHookExA
CallNextHookEx
ValidateRect
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
WinHelpA
GetActiveWindow
GetDlgCtrlID
LoadIconA
GetCapture
LoadAcceleratorsA
SetActiveWindow
IsWindowVisible
IsIconic
InsertMenuItemA
GetClassInfoA
IntersectRect
SetRectEmpty
GetMenu
BringWindowToTop
SetMenu
ShowWindow
TranslateAcceleratorA
GetWindowTextLengthA
GetWindowTextA
GetScrollPos
SetScrollPos
GetWindow
SetFocus
ShowOwnedPopups
GetCursorPos
SetWindowPos
WindowFromPoint
ScreenToClient
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
GetMenuStringA
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
RegisterWindowMessageA
PostMessageA
GetClassNameA
GetDlgItem
EqualRect
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
GetKeyState
wsprintfA
SystemParametersInfoA
BlockInput
ExitWindowsEx
RegisterClassExA
GetFocus
ScrollWindow
MapWindowPoints
GetMessagePos
GetMessageTime
GetTopWindow
SendDlgItemMessageA
GetForegroundWindow
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
EnableWindow
UpdateWindow
ReleaseCapture
IsWindow
GetSysColor
RedrawWindow
ReleaseDC
PeekMessageA
InvalidateRect
SetWindowLongA
MessageBoxA
InflateRect
GetDC
PtInRect
SendMessageA
GetClientRect
MessageBeep
GetParent
SetCapture
PostQuitMessage
GetWindowRect
SetCursor
CopyRect
ModifyMenuA
DestroyIcon
InsertMenuA
GetSystemMetrics
RemoveMenu
GetMenuItemCount
AppendMenuA
GetSysColorBrush
CreatePopupMenu
GetMenuItemInfoA
GetDesktopWindow
TabbedTextOutA
GetMenuState
SetRect
DrawTextExA
DrawEdge
GrayStringA
CreateMenu
LoadBitmapA
DeleteMenu
DrawIconEx
GetSubMenu
DrawTextA
GetMenuItemID
FillRect
GetWindowLongA
OffsetRect
SetDlgItemTextA
IsDialogMessageA
SetWindowTextA
MoveWindow
DestroyCursor
LoadCursorA
SetCursorPos
IsRectEmpty
DrawIcon
SetWindowRgn
SetTimer
KillTimer
GetSystemMenu
SetParent
IsZoomed
UnregisterClassA
RemovePropA
GetPropA
SetPropA
GetClassLongA
IsChild
CharUpperA
CopyAcceleratorTableA
PostThreadMessageA
GetTabbedTextExtentA
GetDCEx
LockWindowUpdate
RegisterClipboardFormatA

kernel32

ExitProcess
HeapFree
HeapAlloc
GetTimeZoneInformation
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapReAlloc
RtlUnwind
RaiseException
VirtualAlloc
ExitThread
FreeEnvironmentStringsW
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
InitializeCriticalSectionAndSpinCount
HeapCreate
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStringsW
QueryPerformanceCounter
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
CreateFileW
GetUserDefaultLCID
SetThreadExecutionState
GetLastError
CreateMutexA
SetConsoleCtrlHandler
FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryA
GetVersionExA
DeleteFileA
GetCurrentDirectoryA
CreateFileA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
DeviceIoControl
GetWindowsDirectoryA
GetSystemDirectoryA
Sleep
GetFullPathNameA
CreateThread
LocalFree
CreateNamedPipeA
WriteFile
ReadFile
FindResourceA
lstrlenA
LoadResource
WideCharToMultiByte
SizeofResource
lstrcatA
LockResource
WinExec
lstrcpyA
WaitForSingleObject
GetCPInfo
MultiByteToWideChar
lstrlenW
SetLastError
lstrcmpiA
GetVersion
FreeResource
GlobalLock
GlobalUnlock
GetCurrentProcessId
MulDiv
FormatMessageA
GlobalAlloc
GlobalFree
lstrcmpA
InterlockedExchange
CompareStringA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThreadId
GetCurrentThread
GlobalDeleteAtom
GlobalAddAtomA
GlobalGetAtomNameA
SetThreadPriority
ResumeThread
SetEvent
SuspendThread
CreateEventA
GetModuleFileNameW
InterlockedDecrement
lstrcmpW
GlobalFindAtomA
GetFileAttributesA
SetFileTime
GetFileTime
GetTempFileNameA
GetDiskFreeSpaceA
MoveFileA
GetStringTypeExA
GetThreadLocale
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
FindClose
FindFirstFileA
GetVolumeInformationA
GetShortPathNameA
SetErrorMode
FileTimeToSystemTime
SystemTimeToFileTime
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GetModuleHandleW
InterlockedIncrement
GlobalFlags
WritePrivateProfileStringA
GetOEMCP
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetFileSizeEx
GetTickCount
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
ReadConsoleInputA
SetConsoleMode
GetEnvironmentStrings

advapi32

RegDeleteKeyA
RegQueryValueA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
OpenSCManagerA
DeleteService
ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
RegQueryValueExA
RegSetValueA
RegEnumKeyA
RegOpenKeyA
SetFileSecurityA
GetFileSecurityA
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegCloseKey

shell32

DragFinish
DragQueryFileA
SHGetFileInfoA
ExtractIconA
ShellExecuteA

gdi32

GetTextExtentPoint32A
SelectObject
CreateSolidBrush
ExtTextOutA
GetPixel
RectVisible
CreatePen
Escape
PtVisible
Ellipse
Rectangle
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
SetPixel
CreateFontA
CreateDIBSection
DeleteDC
GetBkMode
PatBlt
GetTextExtentPoint32W
BitBlt
GetCurrentObject
CreateDCA
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetBkMode
CreateFontIndirectA
GetObjectA
GetStockObject
GetDeviceCaps
TextOutA
GetWindowOrgEx
GetTextExtentPointA
GetTextFaceA
GetTextAlign
GetTextColor
GetStretchBltMode
GetROP2
GetPolyFillMode
GetBkColor
GetNearestColor
CombineRgn
SetRectRgn
StretchDIBits
GetCharWidthA
GetTextMetricsA
LPtoDP
CreateEllipticRgn
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
DPtoLP
GetViewportOrgEx
CreateRectRgnIndirect
CreatePatternBrush
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
StartDocA
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetStretchBltMode
SetROP2
SetPolyFillMode

comdlg32

GetSaveFileNameA
GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter
GetJobA

shlwapi

PathIsUNCA
PathStripToRootA
PathFindFileNameA
PathFindExtensionA
PathRemoveFileSpecW

ole32

CoInitializeEx
CoUninitialize
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
CoTaskMemFree
CoCreateInstance

oleaut32

SysAllocStringLen
VariantInit
VariantChangeType
VariantClear

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

Sections

.text
Size: 630KB - Virtual size: 630KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 897KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DMIEDIT.txt
DMIEDITx64.EXE
.exe windows:5 windows x64 arch:x64

0ce5a4a81eb3ebc0d116d3bbad16546d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

MapWindowPoints
ScrollWindow
TrackPopupMenu
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
GetScrollInfo
SetScrollInfo
CallWindowProcA
GetWindowPlacement
UnhookWindowsHookEx
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
EndDialog
SetWindowsHookExA
CallNextHookEx
ValidateRect
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
WinHelpA
GetActiveWindow
GetDlgCtrlID
LoadIconA
GetCapture
GetMessagePos
SetActiveWindow
IsWindowVisible
IsIconic
InsertMenuItemA
GetClassInfoA
IntersectRect
SetRectEmpty
GetMenu
BringWindowToTop
SetMenu
ShowWindow
TranslateAcceleratorA
GetWindowTextLengthA
GetWindowTextA
GetScrollPos
SetScrollPos
GetWindow
SetFocus
ShowOwnedPopups
GetCursorPos
SetWindowPos
WindowFromPoint
ScreenToClient
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
GetMenuStringA
GetWindowThreadProcessId
RegisterWindowMessageA
IsWindowEnabled
wsprintfA
SystemParametersInfoA
BlockInput
ExitWindowsEx
RegisterClassExA
GetMessageTime
SetWindowLongPtrA
GetWindowLongPtrA
GetTopWindow
GetForegroundWindow
LoadAcceleratorsA
RemovePropA
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
GetPropA
UpdateWindow
ReleaseCapture
IsWindow
GetSysColor
RedrawWindow
ReleaseDC
PeekMessageA
InvalidateRect
SetWindowLongA
InflateRect
GetDC
PtInRect
SendMessageA
GetClientRect
MessageBeep
GetParent
SetCapture
PostQuitMessage
GetWindowRect
MessageBoxA
SetCursor
CopyRect
ModifyMenuA
DestroyIcon
InsertMenuA
GetSystemMetrics
RemoveMenu
GetMenuItemCount
AppendMenuA
GetSysColorBrush
CreatePopupMenu
GetMenuItemInfoA
GetDesktopWindow
TabbedTextOutA
GetMenuState
SetRect
DrawTextExA
DrawEdge
GrayStringA
CreateMenu
LoadBitmapA
DeleteMenu
DrawIconEx
GetSubMenu
DrawTextA
GetMenuItemID
FillRect
GetWindowLongA
OffsetRect
CharUpperA
GetFocus
GetKeyState
EndDeferWindowPos
BeginDeferWindowPos
DeferWindowPos
EqualRect
GetDlgItem
GetClassNameA
PostMessageA
SetDlgItemTextA
IsDialogMessageA
SetWindowTextA
MoveWindow
DestroyCursor
LoadCursorA
SetCursorPos
IsRectEmpty
DrawIcon
SetWindowRgn
SetTimer
KillTimer
GetSystemMenu
SetParent
IsZoomed
UnregisterClassA
CopyAcceleratorTableA
PostThreadMessageA
GetTabbedTextExtentA
GetDCEx
LockWindowUpdate
SetPropA
GetClassLongPtrA
GetClassLongA
IsChild
EnableWindow
SendDlgItemMessageA
RegisterClipboardFormatA
GetLastActivePopup

kernel32

ExitProcess
HeapFree
HeapAlloc
GetTimeZoneInformation
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCommandLineA
HeapReAlloc
RtlUnwindEx
RaiseException
RtlPcToFileHeader
ExitThread
FreeEnvironmentStringsW
HeapQueryInformation
HeapSize
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
InitializeCriticalSectionAndSpinCount
HeapSetInformation
HeapCreate
FreeEnvironmentStringsA
GetEnvironmentStringsW
QueryPerformanceCounter
WriteConsoleA
CreateFileW
SetThreadExecutionState
GetLastError
CreateMutexA
SetConsoleCtrlHandler
FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryA
GetVersionExA
DeleteFileA
GetCurrentDirectoryA
CreateFileA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
DeviceIoControl
GetWindowsDirectoryA
GetSystemDirectoryA
Sleep
GetFullPathNameA
CreateThread
LocalFree
CreateNamedPipeA
WriteFile
ReadFile
FindResourceA
lstrlenA
LoadResource
WideCharToMultiByte
SizeofResource
lstrcatA
LockResource
WinExec
lstrcpyA
WaitForSingleObject
GetCPInfo
MultiByteToWideChar
lstrlenW
SetLastError
lstrcmpiA
GetVersion
FreeResource
GlobalLock
GlobalUnlock
GetCurrentProcessId
MulDiv
FormatMessageA
GlobalAlloc
GlobalFree
lstrcmpA
CompareStringA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThreadId
GetCurrentThread
GlobalDeleteAtom
GlobalAddAtomA
GlobalGetAtomNameA
SetThreadPriority
ResumeThread
SetEvent
SuspendThread
CreateEventA
GetModuleFileNameW
lstrcmpW
GlobalFindAtomA
GetFileAttributesA
SetFileTime
GetFileTime
GetTempFileNameA
GetDiskFreeSpaceA
MoveFileA
GetStringTypeExA
GetThreadLocale
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
FindClose
FindFirstFileA
GetVolumeInformationA
GetShortPathNameA
SetErrorMode
FileTimeToSystemTime
SystemTimeToFileTime
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
InitializeCriticalSection
TlsAlloc
GlobalReAlloc
GlobalHandle
TlsSetValue
LocalReAlloc
DeleteCriticalSection
GetModuleHandleW
GlobalFlags
WritePrivateProfileStringA
GetOEMCP
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetFileSizeEx
GetTickCount
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
ReadConsoleInputA
SetConsoleMode
GetEnvironmentStrings

advapi32

RegCreateKeyA
GetFileSecurityA
SetFileSecurityA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegSetValueA
RegQueryValueExA
RegCloseKey
RegQueryValueA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
OpenSCManagerA
DeleteService
ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
RegSetValueExA
RegCreateKeyExA

shell32

ShellExecuteA
DragQueryFileA
SHGetFileInfoA
ExtractIconA
DragFinish

gdi32

GetTextExtentPoint32A
TextOutA
CreateSolidBrush
ExtTextOutA
GetPixel
RectVisible
CreatePen
Escape
Ellipse
Rectangle
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteObject
SetPixel
GetDeviceCaps
CreateDIBSection
DeleteDC
GetBkMode
CreateFontA
GetTextExtentPoint32W
BitBlt
GetCurrentObject
CreateDCA
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextColor
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
CreateFontIndirectA
GetObjectA
GetStockObject
PatBlt
PtVisible
GetWindowOrgEx
GetTextExtentPointA
GetTextFaceA
GetTextAlign
GetTextColor
GetStretchBltMode
GetROP2
GetPolyFillMode
GetBkColor
GetNearestColor
CombineRgn
SetRectRgn
StretchDIBits
GetCharWidthA
GetTextMetricsA
LPtoDP
CreateEllipticRgn
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
DPtoLP
GetViewportOrgEx
CreateRectRgnIndirect
CreatePatternBrush
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
StartDocA
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
SetTextAlign
MoveToEx
LineTo

comdlg32

GetSaveFileNameA
GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter
GetJobA

shlwapi

PathIsUNCA
PathStripToRootA
PathFindFileNameA
PathFindExtensionA
PathRemoveFileSpecW

ole32

CoInitializeEx
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
CoCreateInstance
CoTaskMemFree
CoUninitialize

oleaut32

SysAllocStringLen
VariantInit
VariantChangeType
VariantClear

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

Sections

.text
Size: 827KB - Virtual size: 827KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 261KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ProcessExplorer.zip
.zip
Eula.txt
procexp.chm
.chm
procexp.exe
.exe windows:6 windows x86 arch:x86

553433ab8c22c54672a94bfb04f1fc03

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:6f:6d:0a:21:ee:4a:4d:f1:16:c6:ed:bf:45:77:ad:16:5b:8f:74:64:47:de:5e:c9:06:c3:31:fb:8d:d8:1c
Signer

Actual PE Digest

83:6f:6d:0a:21:ee:4a:4d:f1:16:c6:ed:bf:45:77:ad:16:5b:8f:74:64:47:de:5e:c9:06:c3:31:fb:8d:d8:1c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\agent\1\s\exe\Win32\Release\procexp.pdb

Imports

shlwapi

SHAutoComplete
ColorHLSToRGB
ColorRGBToHLS
StrStrIW
ord176
StrCmpIW
UrlUnescapeW

iphlpapi

GetExtendedTcpTable
GetExtendedUdpTable

ws2_32

WSAStartup
getservbyport
ntohs
htonl
ntohl
htons
gethostbyaddr

mpr

WNetGetConnectionW

comctl32

ImageList_ReplaceIcon
ImageList_Add
InitCommonControlsEx
ImageList_Destroy
ImageList_DrawEx
ord17
PropertySheetW
ImageList_Create
CreateStatusWindowW
ord413
ImageList_GetIcon
ord410
CreatePropertySheetPageW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

credui

CredUIPromptForCredentialsW

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList

crypt32

CertDuplicateCertificateContext
CertGetNameStringW

aclui

ord1

powrprof

SetSuspendState
IsPwrSuspendAllowed
IsPwrHibernateAllowed

wtsapi32

WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSFreeMemory
WTSDisconnectSession
WTSLogoffSession
WTSSendMessageW

uxtheme

EnableThemeDialogTexture

ntdll

NtOpenThread
NtQuerySystemInformation
NtSetInformationProcess
NtQueryObject
NtCreateKey
NtOpenKey
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
NtQuerySymbolicLinkObject
NtQuerySemaphore
NtQueryEvent
NtResumeProcess
NtQueryInformationProcess
NtQueryInformationThread
NtSuspendProcess
RtlDestroyQueryDebugBuffer
NtSuspendThread
NtLoadDriver
NtResumeThread
NtOpenSymbolicLinkObject
NtQueryMutant
NtQuerySection
RtlUnwind

gdi32

RectInRegion
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetTextColor
GetStockObject
Polyline
SetMapMode
StartDocW
EndDoc
StartPage
EndPage
CreateFontIndirectW
GetTextExtentPoint32W
SetTextAlign
ExtTextOutW
GetTextExtentExPointW
LineTo
Rectangle
RestoreDC
SaveDC
SetROP2
MoveToEx
CreateBitmap
GetDeviceCaps
GetBkMode
GetBkColor
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreateRectRgn
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
GetObjectW
CreateDIBSection
GetTextMetricsW

comdlg32

GetSaveFileNameW
ChooseFontW
GetOpenFileNameW
PrintDlgW
CommDlgExtendedError
ChooseColorW
FindTextW

kernel32

GetLastError
SetErrorMode
InitializeCriticalSection
Sleep
GetCurrentProcess
ExitThread
TlsAlloc
TlsSetValue
CreateProcessW
OpenProcess
GetVersion
GetSystemWindowsDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
IsWow64Process
GetSystemWow64DirectoryW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalFree
FormatMessageA
lstrlenW
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetNumberFormatW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindFirstFileW
GetFileAttributesW
GetPrivateProfileStringW
FreeLibrary
LoadLibraryExW
ReadFile
SetUnhandledExceptionFilter
FindClose
FindNextFileW
LeaveCriticalSection
EnterCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
GetCurrentThread
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
CreateThread
GetExitCodeThread
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
SetLastError
GetVersionExW
GetFileSizeEx
LoadLibraryW
GetTickCount
MulDiv
GlobalAddAtomW
FormatMessageW
GetCommandLineW
GetFileType
LocalAlloc
TerminateThread
GlobalAlloc
GlobalReAlloc
GlobalUnlock
GlobalLock
WriteFile
Module32NextW
DeleteCriticalSection
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
IsBadStringPtrW
OpenEventW
GetEnvironmentVariableW
ReadProcessMemory
lstrcmpiW
SearchPathW
DeleteFileW
SetFilePointer
GetCurrentProcessId
IsProcessorFeaturePresent
GetSystemDirectoryW
VirtualQueryEx
ResumeThread
GetThreadContext
Thread32First
Thread32Next
QueryPerformanceCounter
QueryPerformanceFrequency
ResetEvent
IsBadReadPtr
TerminateProcess
SetPriorityClass
ProcessIdToSessionId
GetProcessId
GlobalMemoryStatusEx
GetLogicalProcessorInformation
GlobalFree
SetProcessWorkingSetSize
PulseEvent
GetComputerNameW
WTSGetActiveConsoleSessionId
GetCurrentDirectoryW
GetDriveTypeW
OutputDebugStringW
DuplicateHandle
DeviceIoControl
VirtualAlloc
VirtualFree
IsProcessInJob
CreateJobObjectW
QueryInformationJobObject
GetThreadGroupAffinity
SetThreadGroupAffinity
GlobalMemoryStatus
GetProcessAffinityMask
SetProcessAffinityMask
GetProcessWorkingSetSize
GetActiveProcessorGroupCount
GetActiveProcessorCount
WideCharToMultiByte
K32GetModuleFileNameExW
K32QueryWorkingSet
K32GetMappedFileNameW
DecodePointer
RaiseException
InitializeCriticalSectionEx
GetNativeSystemInfo
ExpandEnvironmentStringsA
LoadLibraryExA
GetStartupInfoW
GetStringTypeW
GetCurrentThreadId
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
InitializeSListHead
TlsFree
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetConsoleCP
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
GetLongPathNameW
GetFullPathNameW
GetFileTime
GetFileSize
FileTimeToLocalFileTime
CreateFileW
ExpandEnvironmentStringsW
ReadConsoleW
SetEnvironmentVariableW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetStdHandle
TlsGetValue
EncodePointer
LCMapStringEx
GetCPInfo
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
SetEndOfFile
WriteConsoleW
CloseHandle
Module32FirstW
UnhandledExceptionFilter
MultiByteToWideChar

user32

RedrawWindow
WindowFromPoint
CheckMenuRadioItem
DrawIconEx
IsDialogMessageW
LockWorkStation
IsHungAppWindow
PeekMessageW
SendMessageTimeoutW
CheckRadioButton
GetDlgCtrlID
MsgWaitForMultipleObjects
GetDesktopWindow
GetWindow
GetGuiResources
LoadBitmapW
CopyImage
EndMenu
SetMenuInfo
GetMenuInfo
TrackPopupMenu
RemoveMenu
CreateMenu
DrawMenuBar
LoadMenuW
TranslateAcceleratorW
LoadAcceleratorsW
IsWindowEnabled
GetDlgItemTextW
CreateDialogParamW
SetLayeredWindowAttributes
IsWindow
PostQuitMessage
ExitWindowsEx
DispatchMessageW
TranslateMessage
GetMessageW
DrawEdge
RegisterWindowMessageW
EndTask
GetWindowDC
SetMenuItemInfoW
IsIconic
ShowWindowAsync
KillTimer
GetMonitorInfoW
MonitorFromPoint
EnumWindows
SetClassLongW
ClientToScreen
GetWindowTextW
InvalidateRgn
TrackPopupMenuEx
ModifyMenuW
AppendMenuW
GetMenuItemCount
GetMenuItemID
EnableMenuItem
CreatePopupMenu
EnableWindow
IsDlgButtonChecked
CheckDlgButton
GetWindowPlacement
LoadIconW
SetWindowPlacement
DefMDIChildProcW
DefFrameProcW
DefDlgProcW
CreateIconIndirect
FrameRect
IsWindowVisible
DestroyWindow
GetClassNameW
EnumChildWindows
PtInRect
UnionRect
CopyRect
ScreenToClient
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
IsZoomed
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DrawFrameControl
ChildWindowFromPoint
DialogBoxParamW
MoveWindow
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
GetScrollInfo
SetScrollInfo
GetClassLongW
SetWindowLongW
GetWindowLongW
OffsetRect
IntersectRect
InflateRect
FillRect
GetSysColorBrush
GetSysColor
MapWindowPoints
GetCursorPos
GetWindowRect
SendMessageW
WaitForInputIdle
ShowWindow
SetFocus
ReleaseCapture
GetSystemMetrics
GetMenu
CheckMenuItem
GetSubMenu
GetClientRect
GetPropW
SetPropW
ScrollWindowEx
ValidateRect
InvalidateRect
GetUpdateRgn
GetUpdateRect
EndPaint
BeginPaint
UpdateWindow
DrawTextW
SetTimer
SetCapture
GetCapture
GetKeyState
GetFocus
InsertMenuW
DeleteMenu
SetForegroundWindow
MessageBoxW
SetCursor
FindWindowW
FindWindowExW
GetWindowThreadProcessId
LoadCursorW
DestroyIcon
LoadImageW
EnumDisplaySettingsW
GetDC
ReleaseDC
SetWindowPos
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetParent
SetDlgItemTextW
PostMessageW
LoadStringW

advapi32

AdjustTokenPrivileges
AllocateAndInitializeSid
DuplicateTokenEx
EqualSid
FreeSid
GetTokenInformation
CopySid
GetLengthSid
QueryServiceConfigW
ImpersonateLoggedOnUser
AddAccessAllowedAce
AddAce
CreateRestrictedToken
GetAce
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
RevertToSelf
LookupAccountSidW
InitializeAcl
IsValidSid
SetTokenInformation
GetSecurityInfo
SetSecurityInfo
LsaFreeMemory
OpenProcessToken
LsaOpenPolicy
LsaEnumerateAccountRights
ConvertSidToStringSidW
FlushTraceW
RegConnectRegistryW
CreateProcessAsUserW
GetKernelObjectSecurity
SetKernelObjectSecurity
LookupPrivilegeNameW
EnumServicesStatusExW
RegQueryValueExA
RegOpenKeyExA
ProcessTrace
LookupAccountNameW
LookupPrivilegeValueW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
OpenTraceW
ControlTraceW
StartTraceW
SetServiceObjectSecurity
QueryServiceObjectSecurity
MapGenericMask
RegCreateKeyW
LsaClose
RegCloseKey
StartServiceW
QueryServiceStatus
RegEnumValueW
RegLoadKeyW
RegOpenKeyW
ControlService
QueryServiceConfig2W
OpenServiceW
OpenSCManagerW
GetServiceDisplayNameW
CloseServiceHandle
RegDeleteValueW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegQueryValueW
RegUnLoadKeyW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
CloseTrace

shell32

SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteW
SHBrowseForFolderW
Shell_NotifyIconW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFolderPathW
SHGetFileInfoW

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoGetInterfaceAndReleaseStream
CoSetProxyBlanket
CoInitialize
CoMarshalInterThreadInterfaceInStream

oleaut32

SafeArrayGetElement
SysAllocStringLen
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantInit
VariantClear
VariantChangeType
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound

winhttp

WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSendRequest
WinHttpOpenRequest
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse

Sections

.text
Size: 802KB - Virtual size: 801KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
procexp64.exe
.exe windows:6 windows x64 arch:x64

290a32d240db413a1c805200d7a67944

Code Sign

33:00:00:01:e0:71:73:24:ca:5c:98:f8:19:00:00:00:00:01:e0
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:f1:61:86:0e:ca:71:03:c3:90:31:4e:5d:35:70:d9:62:a5:89:a3:01:b5:96:53:0d:eb:ad:a2:e4:73:e3:b1
Signer

Actual PE Digest

1b:f1:61:86:0e:ca:71:03:c3:90:31:4e:5d:35:70:d9:62:a5:89:a3:01:b5:96:53:0d:eb:ad:a2:e4:73:e3:b1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\agent\1\s\exe\x64\Release\procexp64.pdb

Imports

shlwapi

SHAutoComplete
ColorHLSToRGB
ColorRGBToHLS
StrStrIW
ord176
StrCmpIW
UrlUnescapeW

iphlpapi

GetExtendedTcpTable
GetExtendedUdpTable

ws2_32

getservbyport
WSAStartup
gethostbyaddr
htonl
ntohs
ntohl
htons

mpr

WNetGetConnectionW

comctl32

ImageList_ReplaceIcon
ImageList_Add
InitCommonControlsEx
ImageList_Destroy
ImageList_DrawEx
ord17
PropertySheetW
ImageList_Create
CreateStatusWindowW
ord413
ImageList_GetIcon
ord410
CreatePropertySheetPageW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

credui

CredUIPromptForCredentialsW

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList

crypt32

CertDuplicateCertificateContext
CertGetNameStringW

aclui

ord1

powrprof

IsPwrHibernateAllowed
IsPwrSuspendAllowed
SetSuspendState

wtsapi32

WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSSendMessageW
WTSDisconnectSession
WTSLogoffSession
WTSFreeMemory

uxtheme

EnableThemeDialogTexture

ntdll

NtQueryInformationProcess
NtQueryMutant
NtQueryEvent
NtQuerySemaphore
NtQuerySymbolicLinkObject
NtQueryObject
NtOpenSymbolicLinkObject
NtQuerySystemInformation
NtSetInformationProcess
NtLoadDriver
NtCreateKey
NtOpenKey
RtlVirtualUnwind
RtlUnwindEx
NtQuerySection
NtResumeThread
NtSuspendProcess
RtlLookupFunctionEntry
NtOpenThread
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
RtlCaptureContext
NtQueryInformationThread
NtSuspendThread
NtResumeProcess
RtlPcToFileHeader
RtlUnwind

gdi32

RectInRegion
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetTextColor
GetStockObject
Polyline
SetMapMode
StartDocW
EndDoc
StartPage
EndPage
CreateFontIndirectW
GetTextExtentPoint32W
SetTextAlign
ExtTextOutW
GetTextExtentExPointW
LineTo
Rectangle
RestoreDC
SaveDC
SetROP2
MoveToEx
CreateBitmap
GetDeviceCaps
GetBkMode
GetBkColor
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreateRectRgn
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
GetObjectW
CreateDIBSection
GetTextMetricsW

comdlg32

GetSaveFileNameW
ChooseFontW
GetOpenFileNameW
PrintDlgW
CommDlgExtendedError
ChooseColorW
FindTextW

kernel32

GetLastError
SetErrorMode
InitializeCriticalSection
Sleep
GetCurrentProcess
ExitThread
TlsAlloc
TlsSetValue
CreateProcessW
OpenProcess
GetVersion
GetSystemWindowsDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
IsWow64Process
GetSystemWow64DirectoryW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalFree
FormatMessageA
lstrlenW
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetNumberFormatW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindFirstFileW
GetFileAttributesW
GetPrivateProfileStringW
FreeLibrary
LoadLibraryExW
ReadFile
InitializeSListHead
MultiByteToWideChar
FindClose
FindNextFileW
LeaveCriticalSection
EnterCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
GetCurrentThread
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
CreateThread
GetExitCodeThread
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
SetLastError
GetVersionExW
GetFileSizeEx
LoadLibraryW
GetTickCount
MulDiv
GlobalAddAtomW
FormatMessageW
GetCommandLineW
GetFileType
LocalAlloc
TerminateThread
GlobalAlloc
GlobalReAlloc
GlobalUnlock
WriteFile
Module32FirstW
Module32NextW
DeleteCriticalSection
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
IsBadStringPtrW
OpenEventW
GetEnvironmentVariableW
ReadProcessMemory
lstrcmpiW
SearchPathW
SetFilePointer
GetCurrentProcessId
GetSystemDirectoryW
VirtualQueryEx
OpenThread
SuspendThread
ResumeThread
GetThreadContext
Thread32First
Thread32Next
QueryPerformanceCounter
QueryPerformanceFrequency
ResetEvent
IsBadReadPtr
DeleteFileW
TerminateProcess
SetPriorityClass
ProcessIdToSessionId
GetProcessId
GlobalMemoryStatusEx
GetLogicalProcessorInformation
GlobalFree
SetProcessWorkingSetSize
PulseEvent
GetComputerNameW
WTSGetActiveConsoleSessionId
GetCurrentDirectoryW
GetDriveTypeW
OutputDebugStringW
DuplicateHandle
DeviceIoControl
VirtualAlloc
VirtualFree
IsProcessInJob
CreateJobObjectW
QueryInformationJobObject
GetThreadGroupAffinity
SetThreadGroupAffinity
GlobalMemoryStatus
GetProcessAffinityMask
SetProcessAffinityMask
GetProcessWorkingSetSize
GetActiveProcessorGroupCount
GetActiveProcessorCount
WideCharToMultiByte
K32GetModuleFileNameExW
K32QueryWorkingSet
K32GetMappedFileNameW
DecodePointer
RaiseException
InitializeCriticalSectionEx
GetNativeSystemInfo
ExpandEnvironmentStringsA
LoadLibraryExA
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
TlsFree
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetConsoleCP
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
ReadConsoleW
GetLongPathNameW
GetFullPathNameW
GetFileTime
GetFileSize
FileTimeToLocalFileTime
CreateFileW
ExpandEnvironmentStringsW
GetTimeZoneInformation
SetEnvironmentVariableW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetStdHandle
TlsGetValue
EncodePointer
LCMapStringEx
GetCPInfo
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
SetEndOfFile
WriteConsoleW
CloseHandle
GlobalLock
GetStartupInfoW
GetCurrentThreadId
GetStringTypeW

user32

EndMenu
RedrawWindow
WindowFromPoint
CheckMenuRadioItem
DrawIconEx
IsDialogMessageW
LockWorkStation
IsHungAppWindow
PeekMessageW
SendMessageTimeoutW
CheckRadioButton
GetDlgCtrlID
MsgWaitForMultipleObjects
GetDesktopWindow
GetWindow
GetGuiResources
LoadBitmapW
CopyImage
GetMenuInfo
TrackPopupMenu
RemoveMenu
CreateMenu
DrawMenuBar
LoadMenuW
TranslateAcceleratorW
LoadAcceleratorsW
IsWindowEnabled
GetDlgItemTextW
CreateDialogParamW
SetLayeredWindowAttributes
IsWindow
PostQuitMessage
ExitWindowsEx
DispatchMessageW
TranslateMessage
GetMessageW
DrawEdge
RegisterWindowMessageW
EndTask
GetWindowDC
SetMenuItemInfoW
IsIconic
ShowWindowAsync
KillTimer
GetMonitorInfoW
MonitorFromPoint
EnumWindows
SetClassLongW
ClientToScreen
GetWindowTextW
InvalidateRgn
TrackPopupMenuEx
ModifyMenuW
AppendMenuW
GetMenuItemCount
GetMenuItemID
EnableMenuItem
CreatePopupMenu
EnableWindow
IsDlgButtonChecked
CheckDlgButton
GetWindowPlacement
LoadIconW
SetWindowPlacement
DefMDIChildProcW
DefFrameProcW
DefDlgProcW
CreateIconIndirect
FrameRect
IsWindowVisible
DestroyWindow
GetClassNameW
EnumChildWindows
SetWindowLongW
GetWindowLongW
PtInRect
UnionRect
CopyRect
ScreenToClient
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
IsZoomed
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DrawFrameControl
ChildWindowFromPoint
DialogBoxParamW
MoveWindow
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
GetScrollInfo
SetScrollInfo
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
OffsetRect
IntersectRect
InflateRect
FillRect
GetSysColorBrush
GetSysColor
MapWindowPoints
GetCursorPos
GetWindowRect
GetClientRect
GetPropW
SetPropW
ScrollWindowEx
ValidateRect
InvalidateRect
GetUpdateRgn
GetUpdateRect
EndPaint
BeginPaint
UpdateWindow
DrawTextW
SetTimer
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetFocus
SetWindowPos
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetParent
SetDlgItemTextW
PostMessageW
LoadStringW
ReleaseDC
GetDC
EnumDisplaySettingsW
LoadImageW
DestroyIcon
LoadCursorW
GetWindowThreadProcessId
FindWindowExW
FindWindowW
SetCursor
MessageBoxW
SetForegroundWindow
DeleteMenu
InsertMenuW
GetSubMenu
CheckMenuItem
GetMenu
GetSystemMetrics
SetFocus
ShowWindow
WaitForInputIdle
SetMenuInfo
SendMessageW

advapi32

OpenProcessToken
AdjustTokenPrivileges
AllocateAndInitializeSid
DuplicateTokenEx
EqualSid
GetLengthSid
QueryServiceConfigW
AddAccessAllowedAce
AddAce
FreeSid
GetTokenInformation
ImpersonateLoggedOnUser
CreateRestrictedToken
GetAce
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
RevertToSelf
LookupAccountSidW
InitializeAcl
IsValidSid
SetTokenInformation
GetSecurityInfo
SetSecurityInfo
LsaFreeMemory
RegCloseKey
LsaOpenPolicy
LsaEnumerateAccountRights
ConvertSidToStringSidW
FlushTraceW
RegConnectRegistryW
CreateProcessAsUserW
GetKernelObjectSecurity
SetKernelObjectSecurity
LookupPrivilegeNameW
EnumServicesStatusExW
RegQueryValueExA
RegOpenKeyExA
ProcessTrace
LookupAccountNameW
LookupPrivilegeValueW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
OpenTraceW
ControlTraceW
StartTraceW
SetServiceObjectSecurity
QueryServiceObjectSecurity
MapGenericMask
RegCreateKeyW
LsaClose
CloseTrace
StartServiceW
QueryServiceStatus
RegEnumValueW
RegLoadKeyW
RegOpenKeyW
ControlService
QueryServiceConfig2W
OpenServiceW
OpenSCManagerW
GetServiceDisplayNameW
CloseServiceHandle
RegDeleteValueW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegQueryValueW
RegUnLoadKeyW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
CopySid

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHBrowseForFolderW
ShellExecuteW
SHGetMalloc
Shell_NotifyIconW
ShellExecuteExW
SHGetFolderPathW
SHGetFileInfoW

ole32

CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoSetProxyBlanket
CoInitialize
CoMarshalInterThreadInterfaceInStream

oleaut32

SysAllocStringLen
VariantCopy
SafeArrayGetElement
SafeArrayUnaccessData
SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantInit
VariantClear
VariantChangeType
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData

winhttp

WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpGetProxyForUrl

Sections

.text
Size: 915KB - Virtual size: 915KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 262KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
procexp64a.exe
amifldrv32.sys
.sys windows:6 windows x86 arch:x86

799681d1376c222d5c4071714193365f

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:a2:90:5d:11:f5:cf:bb:c5:3a:b2:1b:fd:39:de:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/06/2012, 00:00

Not After

26/06/2015, 23:59

Subject

CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

eb:40:86:6c:68:da:69:77:ad:f9:63:36:85:37:1b:ec:05:de:65:2a
Signer

Actual PE Digest

eb:40:86:6c:68:da:69:77:ad:f9:63:36:85:37:1b:ec:05:de:65:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

r:\work\driver\flashdriverwin32\Release\i386\amifldrv32.pdb

Imports

ntoskrnl.exe

ObReferenceObjectByHandle
ZwOpenSection
RtlInitUnicodeString
ZwUnmapViewOfSection
MmFreeContiguousMemory
IoFreeMdl
MmMapLockedPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
MmGetPhysicalAddress
ZwMapViewOfSection
MmAllocateContiguousMemory
MmUnmapLockedPages
IoDeleteDevice
IoDeleteSymbolicLink
memmove
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
ZwClose
WRITE_REGISTER_ULONG
WRITE_REGISTER_USHORT
WRITE_REGISTER_UCHAR
READ_REGISTER_ULONG
READ_REGISTER_USHORT
READ_REGISTER_UCHAR
MmUnmapIoSpace
MmIsAddressValid
MmMapIoSpace

hal

KfLowerIrql
WRITE_PORT_ULONG
WRITE_PORT_USHORT
WRITE_PORT_UCHAR
READ_PORT_ULONG
READ_PORT_USHORT
READ_PORT_UCHAR
HalTranslateBusAddress
KfRaiseIrql

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
amifldrv64.sys
.sys windows:6 windows x64 arch:x64

9943d029b8ce940ac6c9a8ab0737bf35

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:a2:90:5d:11:f5:cf:bb:c5:3a:b2:1b:fd:39:de:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/06/2012, 00:00

Not After

26/06/2015, 23:59

Subject

CN=American Megatrends\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=American Megatrends\, Inc.,L=Norcross,ST=Georgia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

40:60:3c:72:30:d7:4f:f3:35:24:a1:1c:0b:09:f9:45:9e:7a:fe:91
Signer

Actual PE Digest

40:60:3c:72:30:d7:4f:f3:35:24:a1:1c:0b:09:f9:45:9e:7a:fe:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

r:\work\driver\flashdriverwin64\Release\amd64\amifldrv64.pdb

Imports

ntoskrnl.exe

ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmMapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
MmMapIoSpace
MmGetPhysicalAddress
MmIsAddressValid
IoAllocateMdl
MmAllocateContiguousMemory
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
IoFreeMdl
MmUnmapIoSpace

hal

HalTranslateBusAddress

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 926B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bit.exe
.exe windows:4 windows x86 arch:x86

30aa9a9a3c2c9a4ce5375d3ac90c92df

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
GetUserNameA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenThreadToken
OpenProcessToken

user32

GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
MessageBoxA
LoadStringA
GetSystemMetrics
CharNextA
CharLowerBuffA
CharUpperBuffA
CharToOemA

kernel32

GetACP
Sleep
VirtualFree
VirtualAlloc
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
SetCurrentDirectoryA
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCurrentDirectoryA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
CreateDirectoryA
ExitProcess
CompareStringA
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
DeleteFileA
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
WriteFile
WaitForSingleObject
VirtualQuery
UnmapViewOfFile
SizeofResource
SetLastError
SetFileTime
SetFilePointer
SetFileAttributesA
SetEvent
SetEndOfFile
SetCurrentDirectoryA
ResetEvent
ReadFile
MoveFileA
MapViewOfFile
LockResource
LocalFileTimeToFileTime
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GetVersionExA
GetTickCount
GetThreadLocale
GetTempFileNameA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCPInfo
FreeResource
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DosDateTimeToFileTime
DeleteFileA
DeleteCriticalSection
CreateFileA
CreateEventA
CompareStringA
CloseHandle
Sleep
CopyFileA
CreateFileA
GetConsoleScreenBufferInfo
WriteConsoleA
QueryPerformanceCounter
GetComputerNameA
GetSystemDirectoryA
GetSystemInfo
GetVersionExA
ord3
CloseHandle
GetLastError
GetCurrentThread
GetCurrentProcess

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Sections

.text
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 23KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 12B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
info.txt
report1.dat

Sharing

General

Malware Config

Signatures

Files

94a15243b64f8836e8a90164f8331bb2

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

shell32

gdi32

comdlg32

winspool.drv

shlwapi

ole32

oleaut32

oleacc

Sections

.text Size: 630KB - Virtual size: 630KB

.rdata Size: 171KB - Virtual size: 171KB

.data Size: 42KB - Virtual size: 897KB

.rsrc Size: 29KB - Virtual size: 28KB

0ce5a4a81eb3ebc0d116d3bbad16546d

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

shell32

gdi32

comdlg32

winspool.drv

shlwapi

ole32

oleaut32

oleacc

Sections

.text Size: 827KB - Virtual size: 827KB

.rdata Size: 261KB - Virtual size: 260KB

.data Size: 74KB - Virtual size: 1.6MB

.pdata Size: 41KB - Virtual size: 40KB

.rsrc Size: 29KB - Virtual size: 28KB

553433ab8c22c54672a94bfb04f1fc03

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:dfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

83:6f:6d:0a:21:ee:4a:4d:f1:16:c6:ed:bf:45:77:ad:16:5b:8f:74:64:47:de:5e:c9:06:c3:31:fb:8d:d8:1cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

iphlpapi

ws2_32

mpr

comctl32

version

credui

setupapi

crypt32

aclui

powrprof

wtsapi32

uxtheme

ntdll

gdi32

comdlg32

kernel32

user32

advapi32

shell32

.text
Size: 630KB - Virtual size: 630KB

.rdata
Size: 171KB - Virtual size: 171KB

.data
Size: 42KB - Virtual size: 897KB

.rsrc
Size: 29KB - Virtual size: 28KB

.text
Size: 827KB - Virtual size: 827KB

.rdata
Size: 261KB - Virtual size: 260KB

.data
Size: 74KB - Virtual size: 1.6MB

.pdata
Size: 41KB - Virtual size: 40KB

.rsrc
Size: 29KB - Virtual size: 28KB

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

83:6f:6d:0a:21:ee:4a:4d:f1:16:c6:ed:bf:45:77:ad:16:5b:8f:74:64:47:de:5e:c9:06:c3:31:fb:8d:d8:1c
Signer

.text
Size: 802KB - Virtual size: 801KB

.rdata
Size: 201KB - Virtual size: 200KB

.data
Size: 34KB - Virtual size: 171KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 49KB - Virtual size: 48KB

33:00:00:01:e0:71:73:24:ca:5c:98:f8:19:00:00:00:00:01:e0
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

1b:f1:61:86:0e:ca:71:03:c3:90:31:4e:5d:35:70:d9:62:a5:89:a3:01:b5:96:53:0d:eb:ad:a2:e4:73:e3:b1
Signer

.text
Size: 915KB - Virtual size: 915KB

.rdata
Size: 262KB - Virtual size: 261KB

.data
Size: 41KB - Virtual size: 184KB

.pdata
Size: 31KB - Virtual size: 31KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 208KB - Virtual size: 208KB

.reloc
Size: 5KB - Virtual size: 4KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

5b:a2:90:5d:11:f5:cf:bb:c5:3a:b2:1b:fd:39:de:fe
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

eb:40:86:6c:68:da:69:77:ad:f9:63:36:85:37:1b:ec:05:de:65:2a
Signer