##!!SetUp_2244_Pa$sW0rd$$!![.]zip

Sharing

Copy URL Twitter E-mail

General

Target

##!!SetUp_2244_Pa$sW0rd$$!!.zip
Size

25.1MB
MD5

c1d1965f661a1ba87fbbaeed42645cf6
SHA1

535fa28076ee30678d1424254cc08a2698abb6d9
SHA256

4bd55660c9d01d3b554599bb4c7da95f2fb807e9d0795f11e08b1f8539503ddb
SHA512

ef40f92f23bc61653349c3bf55be734b1786acf469b968ab48f027107ae935000680d0b1a768538b0dd72e78924bbba4796ff72107198ea5852298e53bd82759
SSDEEP

393216:33Oqf6uMjZNcx0my+P/cLrRCbtcfsHpnDrFQND/iA0uLnPx7nY/zGHmtdJwZbUhR:O6OXcxI+PEXshc2B+9iKZckKI+R

Score

3^/10

Malware Config

Signatures

Unsigned PE 14 IoCs

Checks for missing Authenticode signature.

resource
unpack001/##!!SetUp_2244_Pa$sW0rd$$!!/ICQLiteShell.dll
unpack001/##!!SetUp_2244_Pa$sW0rd$$!!/ICQRT.dll
unpack001/##!!SetUp_2244_Pa$sW0rd$$!!/LiteRes.dll
unpack001/##!!SetUp_2244_Pa$sW0rd$$!!/LiteSkinUtils.dll
unpack001/##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/ICQLiteShell.dll
unpack001/##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/ICQRT.dll
unpack001/##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/LiteRes.dll
unpack001/##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/LiteSkinUtils.dll
unpack001/##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/x64/AdonisUI.ClassicTheme.dll
unpack001/##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/x64/AdonisUI.dll
unpack002/$PLUGINSDIR/StartMenu.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/UAC.dll
unpack002/$PLUGINSDIR/nsDialogs.dll

Files

##!!SetUp_2244_Pa$sW0rd$$!!.zip
.zip
##!!SetUp_2244_Pa$sW0rd$$!!/ICQLiteShell.dll
.dll regsvr32 windows:4 windows x86 arch:x86

36da04e9d80185202c5dff27d69487ef

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord2818
ord540
ord2915
ord537
ord800
ord941
ord861
ord823
ord6467
ord1131
ord2725
ord3953
ord825
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord535
ord4160
ord5302
ord2396
ord269
ord5199
ord1577
ord600
ord4274
ord1182
ord5300
ord1255
ord1253
ord1578
ord1197
ord4079
ord1570
ord1243
ord342
ord815
ord6375
ord4486
ord2554
ord2512
ord5731
ord1116
ord1176
ord1575
ord1168
ord3922
ord826
ord3346
ord1089

msvcrt

_initterm
??1type_info@@UAE@XZ
_stricmp
memcpy
__CxxFrameHandler
free
malloc
realloc
memset
memcmp
strlen
_snprintf
strcat
strncpy
?terminate@@YAXXZ
_except_handler3
__dllonexit
_onexit
_adjust_fdiv

kernel32

GetLastError
LoadLibraryA
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
HeapDestroy
GetProcAddress
lstrcpyA
lstrcatA
GetVersionExA
CloseHandle
OpenMutexA
LocalFree
LocalAlloc

user32

CreateMenu
InsertMenuItemA
LoadBitmapA
InsertMenuA
wsprintfA
CharNextA

gdi32

DeleteObject

advapi32

RegOpenKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA

shell32

DragQueryFileA

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree

oleaut32

BSTR_UserMarshal
RegisterTypeLi
SysAllocStringLen
BSTR_UserFree
BSTR_UserUnmarshal
LoadTypeLi
BSTR_UserSize
SysAllocString
SysFreeString
VarUI4FromStr

rpcrt4

CStdStubBuffer_CountRefs
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 89B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/ICQRT.dll
.dll windows:4 windows x86 arch:x86

eea1a54f9a41b7445dc95356daf71d0a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
DisableThreadLibraryCalls

msvcrt

__CxxFrameHandler
_CxxThrowException
?what@exception@@UBEPBDXZ
strlen
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
memcpy
??4exception@@QAEAAV0@ABV0@@Z
??3@YAXPAX@Z
wcslen
iswctype
??2@YAPAXI@Z
??0exception@@QAE@ABV0@@Z
memcmp
memchr
memset
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
free
_initterm
malloc
_adjust_fdiv
memmove

Exports

Exports

??4?$numeric_limits@C@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@D@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@E@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@F@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@G@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@H@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@I@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@J@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@K@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@M@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@N@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@O@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@_N@std@@QAEAAV01@ABV01@@Z
??4_Num_base@std@@QAEAAU01@ABU01@@Z
??4_Num_float_base@std@@QAEAAU01@ABU01@@Z
??4_Num_int_base@std@@QAEAAU01@ABU01@@Z
?denorm_min@?$numeric_limits@C@std@@SACXZ
?denorm_min@?$numeric_limits@D@std@@SADXZ
?denorm_min@?$numeric_limits@E@std@@SAEXZ
?denorm_min@?$numeric_limits@F@std@@SAFXZ
?denorm_min@?$numeric_limits@G@std@@SAGXZ
?denorm_min@?$numeric_limits@H@std@@SAHXZ
?denorm_min@?$numeric_limits@I@std@@SAIXZ
?denorm_min@?$numeric_limits@J@std@@SAJXZ
?denorm_min@?$numeric_limits@K@std@@SAKXZ
?denorm_min@?$numeric_limits@M@std@@SAMXZ
?denorm_min@?$numeric_limits@N@std@@SANXZ
?denorm_min@?$numeric_limits@O@std@@SAOXZ
?denorm_min@?$numeric_limits@_N@std@@SA_NXZ
?epsilon@?$numeric_limits@C@std@@SACXZ
?epsilon@?$numeric_limits@D@std@@SADXZ
?epsilon@?$numeric_limits@E@std@@SAEXZ
?epsilon@?$numeric_limits@F@std@@SAFXZ
?epsilon@?$numeric_limits@G@std@@SAGXZ
?epsilon@?$numeric_limits@H@std@@SAHXZ
?epsilon@?$numeric_limits@I@std@@SAIXZ
?epsilon@?$numeric_limits@J@std@@SAJXZ
?epsilon@?$numeric_limits@K@std@@SAKXZ
?epsilon@?$numeric_limits@M@std@@SAMXZ
?epsilon@?$numeric_limits@N@std@@SANXZ
?epsilon@?$numeric_limits@O@std@@SAOXZ
?epsilon@?$numeric_limits@_N@std@@SA_NXZ
?infinity@?$numeric_limits@C@std@@SACXZ
?infinity@?$numeric_limits@D@std@@SADXZ
?infinity@?$numeric_limits@E@std@@SAEXZ
?infinity@?$numeric_limits@F@std@@SAFXZ
?infinity@?$numeric_limits@G@std@@SAGXZ
?infinity@?$numeric_limits@H@std@@SAHXZ
?infinity@?$numeric_limits@I@std@@SAIXZ
?infinity@?$numeric_limits@J@std@@SAJXZ
?infinity@?$numeric_limits@K@std@@SAKXZ
?infinity@?$numeric_limits@M@std@@SAMXZ
?infinity@?$numeric_limits@N@std@@SANXZ
?infinity@?$numeric_limits@O@std@@SAOXZ
?infinity@?$numeric_limits@_N@std@@SA_NXZ
?max@?$numeric_limits@C@std@@SACXZ
?max@?$numeric_limits@D@std@@SADXZ
?max@?$numeric_limits@E@std@@SAEXZ
?max@?$numeric_limits@F@std@@SAFXZ
?max@?$numeric_limits@G@std@@SAGXZ
?max@?$numeric_limits@H@std@@SAHXZ
?max@?$numeric_limits@I@std@@SAIXZ
?max@?$numeric_limits@J@std@@SAJXZ
?max@?$numeric_limits@K@std@@SAKXZ
?max@?$numeric_limits@M@std@@SAMXZ
?max@?$numeric_limits@N@std@@SANXZ
?max@?$numeric_limits@O@std@@SAOXZ
?max@?$numeric_limits@_N@std@@SA_NXZ
?min@?$numeric_limits@C@std@@SACXZ
?min@?$numeric_limits@D@std@@SADXZ
?min@?$numeric_limits@E@std@@SAEXZ
?min@?$numeric_limits@F@std@@SAFXZ
?min@?$numeric_limits@G@std@@SAGXZ
?min@?$numeric_limits@H@std@@SAHXZ
?min@?$numeric_limits@I@std@@SAIXZ
?min@?$numeric_limits@J@std@@SAJXZ
?min@?$numeric_limits@K@std@@SAKXZ
?min@?$numeric_limits@M@std@@SAMXZ
?min@?$numeric_limits@N@std@@SANXZ
?min@?$numeric_limits@O@std@@SAOXZ
?min@?$numeric_limits@_N@std@@SA_NXZ
?quiet_NaN@?$numeric_limits@C@std@@SACXZ
?quiet_NaN@?$numeric_limits@D@std@@SADXZ
?quiet_NaN@?$numeric_limits@E@std@@SAEXZ
?quiet_NaN@?$numeric_limits@F@std@@SAFXZ
?quiet_NaN@?$numeric_limits@G@std@@SAGXZ
?quiet_NaN@?$numeric_limits@H@std@@SAHXZ
?quiet_NaN@?$numeric_limits@I@std@@SAIXZ
?quiet_NaN@?$numeric_limits@J@std@@SAJXZ
?quiet_NaN@?$numeric_limits@K@std@@SAKXZ
?quiet_NaN@?$numeric_limits@M@std@@SAMXZ
?quiet_NaN@?$numeric_limits@N@std@@SANXZ
?quiet_NaN@?$numeric_limits@O@std@@SAOXZ
?quiet_NaN@?$numeric_limits@_N@std@@SA_NXZ
?round_error@?$numeric_limits@C@std@@SACXZ
?round_error@?$numeric_limits@D@std@@SADXZ
?round_error@?$numeric_limits@E@std@@SAEXZ
?round_error@?$numeric_limits@F@std@@SAFXZ
?round_error@?$numeric_limits@G@std@@SAGXZ
?round_error@?$numeric_limits@H@std@@SAHXZ
?round_error@?$numeric_limits@I@std@@SAIXZ
?round_error@?$numeric_limits@J@std@@SAJXZ
?round_error@?$numeric_limits@K@std@@SAKXZ
?round_error@?$numeric_limits@M@std@@SAMXZ
?round_error@?$numeric_limits@N@std@@SANXZ
?round_error@?$numeric_limits@O@std@@SAOXZ
?round_error@?$numeric_limits@_N@std@@SA_NXZ
?signaling_NaN@?$numeric_limits@C@std@@SACXZ
?signaling_NaN@?$numeric_limits@D@std@@SADXZ
?signaling_NaN@?$numeric_limits@E@std@@SAEXZ
?signaling_NaN@?$numeric_limits@F@std@@SAFXZ
?signaling_NaN@?$numeric_limits@G@std@@SAGXZ
?signaling_NaN@?$numeric_limits@H@std@@SAHXZ
?signaling_NaN@?$numeric_limits@I@std@@SAIXZ
?signaling_NaN@?$numeric_limits@J@std@@SAJXZ
?signaling_NaN@?$numeric_limits@K@std@@SAKXZ
?signaling_NaN@?$numeric_limits@M@std@@SAMXZ
?signaling_NaN@?$numeric_limits@N@std@@SANXZ
?signaling_NaN@?$numeric_limits@O@std@@SAOXZ
?signaling_NaN@?$numeric_limits@_N@std@@SA_NXZ

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/LiteRes.dll
.dll windows:4 windows x86 arch:x86

ce6ef31899b31809ae0c71c094c6f083

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord1253
ord342
ord823
ord1182
ord1168

msvcrt

free
_initterm
malloc
_adjust_fdiv

Sections

.text
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 732KB - Virtual size: 731KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/LiteSkinUtils.dll
.dll windows:4 windows x86 arch:x86

a8d043bdfc629c21151b760b23d3bcd9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord1233
ord1114
ord2055
ord2152
ord567
ord1113
ord3237
ord6376
ord4441
ord4837
ord3798
ord5290
ord2623
ord3742
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord2985
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord1601
ord4078
ord2648
ord4353
ord6374
ord5163
ord4275
ord535
ord2385
ord5241
ord4407
ord1776
ord6055
ord4003
ord858
ord2486
ord538
ord540
ord941
ord1168
ord1253
ord342
ord823
ord1182
ord3318
ord818
ord800
ord539
ord825
ord665
ord1979
ord537
ord5186
ord354
ord2864
ord6880

msvcrt

_CxxThrowException
memcpy
??1type_info@@UAE@XZ
free
strlen
memset
strncpy
_adjust_fdiv
malloc
_initterm
__CxxFrameHandler
?terminate@@YAXXZ
_except_handler3
_onexit
__dllonexit
fopen
fclose
strrchr
_purecall

kernel32

GetLastError
MultiByteToWideChar
lstrlenA
LocalFree
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
InterlockedDecrement
InterlockedIncrement
GetCurrentProcessId
FreeLibrary

user32

GetParent
EnableWindow
EnumWindows
OffsetRect
GetWindowThreadProcessId
GetSysColor
PostMessageA
IsWindow
GetWindowRect

gdi32

GetStockObject
GetObjectA

ole32

CoCreateInstance
OleRun
CreateStreamOnHGlobal
CoRegisterClassObject
CoRevokeClassObject

oleaut32

VariantClear
SysFreeString
SysAllocString
LoadTypeLibEx

icqrt

ord36
ord195
ord179
ord328
ord142
ord174
ord360
ord38
ord15
ord191
ord158
ord250
ord259

advapi32

RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA

Exports

Exports

??0MCSkin@@AAE@XZ
??0MCSkin@@QAE@ABV0@@Z
??0MCSkinAdvisor@@AAE@XZ
??0MCSkinRegistry@@QAE@ABV0@@Z
??0MCSkinRegistry@@QAE@XZ
??0MISknSink@@QAE@ABV0@@Z
??0MISknSink@@QAE@XZ
??1MCSkin@@QAE@XZ
??1MCSkinAdvisor@@UAE@XZ
??1MCSkinRegistry@@QAE@XZ
??4MCSkin@@QAEAAV0@ABV0@@Z
??4MCSkinLoader@@QAEAAV0@ABV0@@Z
??4MCSkinRegistry@@QAEAAV0@ABV0@@Z
??4MISknSink@@QAEAAV0@ABV0@@Z
??_7MCSkinAdvisor@@6B@
??_7MISknSink@@6B@
?Advise@MCSkinAdvisor@@QAEKPAUISkinObject@@PAVMISknSink@@@Z
?ChangeSkin@MCSkin@@QAEJPBDI@Z
?CheckSkinVersion@MCSkin@@QAEGPBDAAV?$vector@VCString@@V?$allocator@VCString@@@std@@@std@@@Z
?CreateFontStruct@MCSkin@@QAEXPAUSkinLogFont@@H@Z
?CreateSkinComponent@MCSkin@@QAEJPAPAUISkin@@@Z
?EnumWindowsProc@MCSkin@@SGHPAUHWND__@@J@Z
?FindNames@MCSkin@@AAE_NPAUISkinObject@@PAPAGHAAV?$vector@VCString@@V?$allocator@VCString@@@std@@@std@@@Z
?FindPath@MCSkinLoader@@SAXXZ
?FromReg@MCSkinRegistry@@QAE_NXZ
?Get@MCSkin@@SAPAUISkin@@XZ
?GetAppColor@MCSkin@@SAKW4APP_COLOR@1@@Z
?GetDispatchMap@MCSkinAdvisor@@MBEPBUAFX_DISPMAP@@XZ
?GetHUE@MCSkin@@QAEEXZ
?GetInterfaceMap@MCSkinAdvisor@@MBEPBUAFX_INTERFACEMAP@@XZ
?GetMessageMap@MCSkinAdvisor@@MBEPBUAFX_MSGMAP@@XZ
?GetSkinFileID@MCSkin@@QAE?AVCString@@PBD@Z
?GetSkinFileID@MCSkin@@QAE?AVCString@@XZ
?GetSkinFullPathName@MCSkinRegistry@@QAEPBDXZ
?GetSysColor@MCSkin@@SAKH@Z
?GetWantSkin@MCSkinRegistry@@QAE_NXZ
?Initialize@MCSkin@@QAEJP6AXPAUIUnknown@@@Z@Z
?Initialize@MCSkinAdvisor@@QAE_NXZ
?Instance@MCSkin@@SAPAV1@XZ
?Instance@MCSkinAdvisor@@SAPAV1@XZ
?IsInitialized@MCSkin@@QBE_NXZ
?IsInitialized@MCSkinRegistry@@AAE_NXZ
?IsLoaded@MCSkin@@QBE_NXZ
?Load@MCSkin@@QAEJPBD@Z
?Load@MCSkinLoader@@SAJPAUISkin@@@Z
?OnDblClick@MCSkinAdvisor@@MAEXPAUIUnknown@@@Z
?OnMouseIn@MCSkinAdvisor@@MAEXPAUIUnknown@@@Z
?OnMouseMove@MCSkinAdvisor@@MAEXPAUIUnknown@@JJ@Z
?OnMouseOut@MCSkinAdvisor@@MAEXPAUIUnknown@@@Z
?OnRender@MCSkinAdvisor@@MAEXPAUIUnknown@@0JJ@Z
?OnSkinDblClick@MISknSink@@UAEXPAUIUnknown@@@Z
?OnSkinGenEvent@MCSkinAdvisor@@MAEXPAUIUnknown@@PBD@Z
?OnSkinGenEvent@MISknSink@@UAEXPAUIUnknown@@PBD@Z
?OnSkinMouseIn@MISknSink@@UAEXPAUIUnknown@@@Z
?OnSkinMouseMove@MISknSink@@UAEXPAUIUnknown@@JJ@Z
?OnSkinMouseOut@MISknSink@@UAEXPAUIUnknown@@@Z
?RenderParentBK@MCSkin@@QAE_NPAUHWND__@@PAUHDC__@@@Z
?SetAppValues@MCSkinRegistry@@SAXPAUHKEY__@@PBD1@Z
?SetCaptionFont@MCSkin@@QAEXAAV?$_com_ptr_t@V?$_com_IIID@UISkinObject@@$1?_GUID_6a5905c9_0bdd_49fb_9c45_cbb450d3bfd5@@3U__s_GUID@@A@@@@PAG@Z
?SetCaptionFont@MCSkin@@QAEXPAG@Z
?SetCaptionFont@MCSkin@@QAEXXZ
?SetFileName@MCSkinLoader@@SAXPBD@Z
?SetHUE@MCSkin@@QAEXE@Z
?SetMenuFont@MCSkin@@QAEXPAG@Z
?SetMenuFont@MCSkin@@QAEXXZ
?SetSkinFullPathName@MCSkinRegistry@@QAEXPBD@Z
?SetWantSkin@MCSkinRegistry@@QAEX_N@Z
?SkinFileExist@MCSkinLoader@@SA_NXZ
?ToReg@MCSkinRegistry@@QAEXXZ
?Unadvise@MCSkinAdvisor@@QAE_NAAK@Z
?Uninitialize@MCSkin@@QAE_NXZ
?Uninitialize@MCSkinAdvisor@@QAE_NXZ
?Unload@MCSkin@@QAE_NXZ
?_GetBaseDispatchMap@MCSkinAdvisor@@KGPBUAFX_DISPMAP@@XZ
?_GetBaseInterfaceMap@MCSkinAdvisor@@KGPBUAFX_INTERFACEMAP@@XZ
?_GetBaseMessageMap@MCSkinAdvisor@@KGPBUAFX_MSGMAP@@XZ
?_dispatchEntries@MCSkinAdvisor@@0QBUAFX_DISPMAP_ENTRY@@B
?_dispatchEntryCount@MCSkinAdvisor@@0IA
?_dwStockPropMask@MCSkinAdvisor@@0KA
?_interfaceEntries@MCSkinAdvisor@@0QBUAFX_INTERFACEMAP_ENTRY@@B
?_messageEntries@MCSkinAdvisor@@0QBUAFX_MSGMAP_ENTRY@@B
?dispatchMap@MCSkinAdvisor@@1UAFX_DISPMAP@@B
?interfaceMap@MCSkinAdvisor@@1UAFX_INTERFACEMAP@@B
?messageMap@MCSkinAdvisor@@1UAFX_MSGMAP@@B
?s_hRootKey@MCSkinRegistry@@0PAUHKEY__@@A
?s_sDefName@MCSkinRegistry@@0V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?s_sPath@MCSkinRegistry@@0V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?s_strFileName@MCSkinLoader@@2V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?s_strPath@MCSkinLoader@@2VCString@@A

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/PassCode.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/CMap/Identity-H
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/CMap/Identity-V
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/CMap/UCS2-GBK-EUC
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/CMap/UniKS-UTF16-H
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/CMap/UniKS-UTF16-V
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/AdobePIStd.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/CourierStd-Bold.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/CourierStd-BoldOblique.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/CourierStd-Oblique.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/CourierStd.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/MinionPro-Bold.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/MinionPro-BoldIt.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/MinionPro-It.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/MinionPro-Regular.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/MyriadPro-Bold.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/MyriadPro-BoldIt.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/MyriadPro-It.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/MyriadPro-Regular.otf
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/ICQLiteShell.dll
.dll regsvr32 windows:4 windows x86 arch:x86

36da04e9d80185202c5dff27d69487ef

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord2818
ord540
ord2915
ord537
ord800
ord941
ord861
ord823
ord6467
ord1131
ord2725
ord3953
ord825
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord535
ord4160
ord5302
ord2396
ord269
ord5199
ord1577
ord600
ord4274
ord1182
ord5300
ord1255
ord1253
ord1578
ord1197
ord4079
ord1570
ord1243
ord342
ord815
ord6375
ord4486
ord2554
ord2512
ord5731
ord1116
ord1176
ord1575
ord1168
ord3922
ord826
ord3346
ord1089

msvcrt

_initterm
??1type_info@@UAE@XZ
_stricmp
memcpy
__CxxFrameHandler
free
malloc
realloc
memset
memcmp
strlen
_snprintf
strcat
strncpy
?terminate@@YAXXZ
_except_handler3
__dllonexit
_onexit
_adjust_fdiv

kernel32

GetLastError
LoadLibraryA
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
HeapDestroy
GetProcAddress
lstrcpyA
lstrcatA
GetVersionExA
CloseHandle
OpenMutexA
LocalFree
LocalAlloc

user32

CreateMenu
InsertMenuItemA
LoadBitmapA
InsertMenuA
wsprintfA
CharNextA

gdi32

DeleteObject

advapi32

RegOpenKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA

shell32

DragQueryFileA

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree

oleaut32

BSTR_UserMarshal
RegisterTypeLi
SysAllocStringLen
BSTR_UserFree
BSTR_UserUnmarshal
LoadTypeLi
BSTR_UserSize
SysAllocString
SysFreeString
VarUI4FromStr

rpcrt4

CStdStubBuffer_CountRefs
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 89B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/ICQRT.dll
.dll windows:4 windows x86 arch:x86

eea1a54f9a41b7445dc95356daf71d0a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
DisableThreadLibraryCalls

msvcrt

__CxxFrameHandler
_CxxThrowException
?what@exception@@UBEPBDXZ
strlen
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
memcpy
??4exception@@QAEAAV0@ABV0@@Z
??3@YAXPAX@Z
wcslen
iswctype
??2@YAPAXI@Z
??0exception@@QAE@ABV0@@Z
memcmp
memchr
memset
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
free
_initterm
malloc
_adjust_fdiv
memmove

Exports

Exports

??4?$numeric_limits@C@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@D@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@E@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@F@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@G@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@H@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@I@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@J@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@K@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@M@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@N@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@O@std@@QAEAAV01@ABV01@@Z
??4?$numeric_limits@_N@std@@QAEAAV01@ABV01@@Z
??4_Num_base@std@@QAEAAU01@ABU01@@Z
??4_Num_float_base@std@@QAEAAU01@ABU01@@Z
??4_Num_int_base@std@@QAEAAU01@ABU01@@Z
?denorm_min@?$numeric_limits@C@std@@SACXZ
?denorm_min@?$numeric_limits@D@std@@SADXZ
?denorm_min@?$numeric_limits@E@std@@SAEXZ
?denorm_min@?$numeric_limits@F@std@@SAFXZ
?denorm_min@?$numeric_limits@G@std@@SAGXZ
?denorm_min@?$numeric_limits@H@std@@SAHXZ
?denorm_min@?$numeric_limits@I@std@@SAIXZ
?denorm_min@?$numeric_limits@J@std@@SAJXZ
?denorm_min@?$numeric_limits@K@std@@SAKXZ
?denorm_min@?$numeric_limits@M@std@@SAMXZ
?denorm_min@?$numeric_limits@N@std@@SANXZ
?denorm_min@?$numeric_limits@O@std@@SAOXZ
?denorm_min@?$numeric_limits@_N@std@@SA_NXZ
?epsilon@?$numeric_limits@C@std@@SACXZ
?epsilon@?$numeric_limits@D@std@@SADXZ
?epsilon@?$numeric_limits@E@std@@SAEXZ
?epsilon@?$numeric_limits@F@std@@SAFXZ
?epsilon@?$numeric_limits@G@std@@SAGXZ
?epsilon@?$numeric_limits@H@std@@SAHXZ
?epsilon@?$numeric_limits@I@std@@SAIXZ
?epsilon@?$numeric_limits@J@std@@SAJXZ
?epsilon@?$numeric_limits@K@std@@SAKXZ
?epsilon@?$numeric_limits@M@std@@SAMXZ
?epsilon@?$numeric_limits@N@std@@SANXZ
?epsilon@?$numeric_limits@O@std@@SAOXZ
?epsilon@?$numeric_limits@_N@std@@SA_NXZ
?infinity@?$numeric_limits@C@std@@SACXZ
?infinity@?$numeric_limits@D@std@@SADXZ
?infinity@?$numeric_limits@E@std@@SAEXZ
?infinity@?$numeric_limits@F@std@@SAFXZ
?infinity@?$numeric_limits@G@std@@SAGXZ
?infinity@?$numeric_limits@H@std@@SAHXZ
?infinity@?$numeric_limits@I@std@@SAIXZ
?infinity@?$numeric_limits@J@std@@SAJXZ
?infinity@?$numeric_limits@K@std@@SAKXZ
?infinity@?$numeric_limits@M@std@@SAMXZ
?infinity@?$numeric_limits@N@std@@SANXZ
?infinity@?$numeric_limits@O@std@@SAOXZ
?infinity@?$numeric_limits@_N@std@@SA_NXZ
?max@?$numeric_limits@C@std@@SACXZ
?max@?$numeric_limits@D@std@@SADXZ
?max@?$numeric_limits@E@std@@SAEXZ
?max@?$numeric_limits@F@std@@SAFXZ
?max@?$numeric_limits@G@std@@SAGXZ
?max@?$numeric_limits@H@std@@SAHXZ
?max@?$numeric_limits@I@std@@SAIXZ
?max@?$numeric_limits@J@std@@SAJXZ
?max@?$numeric_limits@K@std@@SAKXZ
?max@?$numeric_limits@M@std@@SAMXZ
?max@?$numeric_limits@N@std@@SANXZ
?max@?$numeric_limits@O@std@@SAOXZ
?max@?$numeric_limits@_N@std@@SA_NXZ
?min@?$numeric_limits@C@std@@SACXZ
?min@?$numeric_limits@D@std@@SADXZ
?min@?$numeric_limits@E@std@@SAEXZ
?min@?$numeric_limits@F@std@@SAFXZ
?min@?$numeric_limits@G@std@@SAGXZ
?min@?$numeric_limits@H@std@@SAHXZ
?min@?$numeric_limits@I@std@@SAIXZ
?min@?$numeric_limits@J@std@@SAJXZ
?min@?$numeric_limits@K@std@@SAKXZ
?min@?$numeric_limits@M@std@@SAMXZ
?min@?$numeric_limits@N@std@@SANXZ
?min@?$numeric_limits@O@std@@SAOXZ
?min@?$numeric_limits@_N@std@@SA_NXZ
?quiet_NaN@?$numeric_limits@C@std@@SACXZ
?quiet_NaN@?$numeric_limits@D@std@@SADXZ
?quiet_NaN@?$numeric_limits@E@std@@SAEXZ
?quiet_NaN@?$numeric_limits@F@std@@SAFXZ
?quiet_NaN@?$numeric_limits@G@std@@SAGXZ
?quiet_NaN@?$numeric_limits@H@std@@SAHXZ
?quiet_NaN@?$numeric_limits@I@std@@SAIXZ
?quiet_NaN@?$numeric_limits@J@std@@SAJXZ
?quiet_NaN@?$numeric_limits@K@std@@SAKXZ
?quiet_NaN@?$numeric_limits@M@std@@SAMXZ
?quiet_NaN@?$numeric_limits@N@std@@SANXZ
?quiet_NaN@?$numeric_limits@O@std@@SAOXZ
?quiet_NaN@?$numeric_limits@_N@std@@SA_NXZ
?round_error@?$numeric_limits@C@std@@SACXZ
?round_error@?$numeric_limits@D@std@@SADXZ
?round_error@?$numeric_limits@E@std@@SAEXZ
?round_error@?$numeric_limits@F@std@@SAFXZ
?round_error@?$numeric_limits@G@std@@SAGXZ
?round_error@?$numeric_limits@H@std@@SAHXZ
?round_error@?$numeric_limits@I@std@@SAIXZ
?round_error@?$numeric_limits@J@std@@SAJXZ
?round_error@?$numeric_limits@K@std@@SAKXZ
?round_error@?$numeric_limits@M@std@@SAMXZ
?round_error@?$numeric_limits@N@std@@SANXZ
?round_error@?$numeric_limits@O@std@@SAOXZ
?round_error@?$numeric_limits@_N@std@@SA_NXZ
?signaling_NaN@?$numeric_limits@C@std@@SACXZ
?signaling_NaN@?$numeric_limits@D@std@@SADXZ
?signaling_NaN@?$numeric_limits@E@std@@SAEXZ
?signaling_NaN@?$numeric_limits@F@std@@SAFXZ
?signaling_NaN@?$numeric_limits@G@std@@SAGXZ
?signaling_NaN@?$numeric_limits@H@std@@SAHXZ
?signaling_NaN@?$numeric_limits@I@std@@SAIXZ
?signaling_NaN@?$numeric_limits@J@std@@SAJXZ
?signaling_NaN@?$numeric_limits@K@std@@SAKXZ
?signaling_NaN@?$numeric_limits@M@std@@SAMXZ
?signaling_NaN@?$numeric_limits@N@std@@SANXZ
?signaling_NaN@?$numeric_limits@O@std@@SAOXZ
?signaling_NaN@?$numeric_limits@_N@std@@SA_NXZ

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/WinRar.exe
.exe windows:5 windows x64 arch:x64

629fae0a56e3262e208711dda6ae6b1d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/06/2017, 00:00

Not After

01/06/2020, 23:59

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/06/2017, 00:00

Not After

01/06/2020, 23:59

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ca:05:77:9a:83:94:f1:c2:84:3b:d1:35:92:02:9e:08:73:69:34:94:e8:62:49:32:6d:ca:10:c8:55:9e:d9:9b
Signer

Actual PE Digest

ca:05:77:9a:83:94:f1:c2:84:3b:d1:35:92:02:9e:08:73:69:34:94:e8:62:49:32:6d:ca:10:c8:55:9e:d9:9b

Digest Algorithm

sha256

PE Digest Matches

true

ed:14:78:6d:47:d9:55:27:5a:d1:dd:f1:22:3e:ed:fc:47:98:f7:f9
Signer

Actual PE Digest

ed:14:78:6d:47:d9:55:27:5a:d1:dd:f1:22:3e:ed:fc:47:98:f7:f9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb

Imports

kernel32

GetLastError
SetLastError
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
GetTickCount
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
EncodePointer
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
TerminateProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW

gdiplus

GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc

Sections

.text
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 152KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/an.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ar.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/az.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ba.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/be.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/bg.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/bn.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ca.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/co.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/cs.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/da.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/de.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/el.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/eng.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/es.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/et.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/eu.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ext.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/fa.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/fi.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/fr.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/fur.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/fy.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ga.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/gl.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/gu.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/he.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/he.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/hi.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/hi.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/hr.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/hr.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/hu.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/hu.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/hy.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/id.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/is.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/it.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ja.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ka.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/kaa.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/kab.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/kk.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ko.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ku-ckb.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ky.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/lij.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/lt.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/mk.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/mn.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/mng.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/mng2.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/mr.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ne.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/nl.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/pa-in.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/pl.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ps.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/pt-br.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/pt.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ro.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ru.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/sa.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/si.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/sk.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/sl.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/sr-spc.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/sr-spl.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/sv.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/sw.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ta.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/tg.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/th.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/tk.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/tr.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/tt.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/ug.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/uk.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/uz-cyrl.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/uz.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/va.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/vi.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/yo.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/zh-cn.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/Language/zh-tw.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/LiteRes.dll
.dll windows:4 windows x86 arch:x86

ce6ef31899b31809ae0c71c094c6f083

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord1253
ord342
ord823
ord1182
ord1168

msvcrt

free
_initterm
malloc
_adjust_fdiv

Sections

.text
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 732KB - Virtual size: 731KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/LiteSkinUtils.dll
.dll windows:4 windows x86 arch:x86

a8d043bdfc629c21151b760b23d3bcd9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord1233
ord1114
ord2055
ord2152
ord567
ord1113
ord3237
ord6376
ord4441
ord4837
ord3798
ord5290
ord2623
ord3742
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord2985
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord1601
ord4078
ord2648
ord4353
ord6374
ord5163
ord4275
ord535
ord2385
ord5241
ord4407
ord1776
ord6055
ord4003
ord858
ord2486
ord538
ord540
ord941
ord1168
ord1253
ord342
ord823
ord1182
ord3318
ord818
ord800
ord539
ord825
ord665
ord1979
ord537
ord5186
ord354
ord2864
ord6880

msvcrt

_CxxThrowException
memcpy
??1type_info@@UAE@XZ
free
strlen
memset
strncpy
_adjust_fdiv
malloc
_initterm
__CxxFrameHandler
?terminate@@YAXXZ
_except_handler3
_onexit
__dllonexit
fopen
fclose
strrchr
_purecall

kernel32

GetLastError
MultiByteToWideChar
lstrlenA
LocalFree
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
InterlockedDecrement
InterlockedIncrement
GetCurrentProcessId
FreeLibrary

user32

GetParent
EnableWindow
EnumWindows
OffsetRect
GetWindowThreadProcessId
GetSysColor
PostMessageA
IsWindow
GetWindowRect

gdi32

GetStockObject
GetObjectA

ole32

CoCreateInstance
OleRun
CreateStreamOnHGlobal
CoRegisterClassObject
CoRevokeClassObject

oleaut32

VariantClear
SysFreeString
SysAllocString
LoadTypeLibEx

icqrt

ord36
ord195
ord179
ord328
ord142
ord174
ord360
ord38
ord15
ord191
ord158
ord250
ord259

advapi32

RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA

Exports

Exports

??0MCSkin@@AAE@XZ
??0MCSkin@@QAE@ABV0@@Z
??0MCSkinAdvisor@@AAE@XZ
??0MCSkinRegistry@@QAE@ABV0@@Z
??0MCSkinRegistry@@QAE@XZ
??0MISknSink@@QAE@ABV0@@Z
??0MISknSink@@QAE@XZ
??1MCSkin@@QAE@XZ
??1MCSkinAdvisor@@UAE@XZ
??1MCSkinRegistry@@QAE@XZ
??4MCSkin@@QAEAAV0@ABV0@@Z
??4MCSkinLoader@@QAEAAV0@ABV0@@Z
??4MCSkinRegistry@@QAEAAV0@ABV0@@Z
??4MISknSink@@QAEAAV0@ABV0@@Z
??_7MCSkinAdvisor@@6B@
??_7MISknSink@@6B@
?Advise@MCSkinAdvisor@@QAEKPAUISkinObject@@PAVMISknSink@@@Z
?ChangeSkin@MCSkin@@QAEJPBDI@Z
?CheckSkinVersion@MCSkin@@QAEGPBDAAV?$vector@VCString@@V?$allocator@VCString@@@std@@@std@@@Z
?CreateFontStruct@MCSkin@@QAEXPAUSkinLogFont@@H@Z
?CreateSkinComponent@MCSkin@@QAEJPAPAUISkin@@@Z
?EnumWindowsProc@MCSkin@@SGHPAUHWND__@@J@Z
?FindNames@MCSkin@@AAE_NPAUISkinObject@@PAPAGHAAV?$vector@VCString@@V?$allocator@VCString@@@std@@@std@@@Z
?FindPath@MCSkinLoader@@SAXXZ
?FromReg@MCSkinRegistry@@QAE_NXZ
?Get@MCSkin@@SAPAUISkin@@XZ
?GetAppColor@MCSkin@@SAKW4APP_COLOR@1@@Z
?GetDispatchMap@MCSkinAdvisor@@MBEPBUAFX_DISPMAP@@XZ
?GetHUE@MCSkin@@QAEEXZ
?GetInterfaceMap@MCSkinAdvisor@@MBEPBUAFX_INTERFACEMAP@@XZ
?GetMessageMap@MCSkinAdvisor@@MBEPBUAFX_MSGMAP@@XZ
?GetSkinFileID@MCSkin@@QAE?AVCString@@PBD@Z
?GetSkinFileID@MCSkin@@QAE?AVCString@@XZ
?GetSkinFullPathName@MCSkinRegistry@@QAEPBDXZ
?GetSysColor@MCSkin@@SAKH@Z
?GetWantSkin@MCSkinRegistry@@QAE_NXZ
?Initialize@MCSkin@@QAEJP6AXPAUIUnknown@@@Z@Z
?Initialize@MCSkinAdvisor@@QAE_NXZ
?Instance@MCSkin@@SAPAV1@XZ
?Instance@MCSkinAdvisor@@SAPAV1@XZ
?IsInitialized@MCSkin@@QBE_NXZ
?IsInitialized@MCSkinRegistry@@AAE_NXZ
?IsLoaded@MCSkin@@QBE_NXZ
?Load@MCSkin@@QAEJPBD@Z
?Load@MCSkinLoader@@SAJPAUISkin@@@Z
?OnDblClick@MCSkinAdvisor@@MAEXPAUIUnknown@@@Z
?OnMouseIn@MCSkinAdvisor@@MAEXPAUIUnknown@@@Z
?OnMouseMove@MCSkinAdvisor@@MAEXPAUIUnknown@@JJ@Z
?OnMouseOut@MCSkinAdvisor@@MAEXPAUIUnknown@@@Z
?OnRender@MCSkinAdvisor@@MAEXPAUIUnknown@@0JJ@Z
?OnSkinDblClick@MISknSink@@UAEXPAUIUnknown@@@Z
?OnSkinGenEvent@MCSkinAdvisor@@MAEXPAUIUnknown@@PBD@Z
?OnSkinGenEvent@MISknSink@@UAEXPAUIUnknown@@PBD@Z
?OnSkinMouseIn@MISknSink@@UAEXPAUIUnknown@@@Z
?OnSkinMouseMove@MISknSink@@UAEXPAUIUnknown@@JJ@Z
?OnSkinMouseOut@MISknSink@@UAEXPAUIUnknown@@@Z
?RenderParentBK@MCSkin@@QAE_NPAUHWND__@@PAUHDC__@@@Z
?SetAppValues@MCSkinRegistry@@SAXPAUHKEY__@@PBD1@Z
?SetCaptionFont@MCSkin@@QAEXAAV?$_com_ptr_t@V?$_com_IIID@UISkinObject@@$1?_GUID_6a5905c9_0bdd_49fb_9c45_cbb450d3bfd5@@3U__s_GUID@@A@@@@PAG@Z
?SetCaptionFont@MCSkin@@QAEXPAG@Z
?SetCaptionFont@MCSkin@@QAEXXZ
?SetFileName@MCSkinLoader@@SAXPBD@Z
?SetHUE@MCSkin@@QAEXE@Z
?SetMenuFont@MCSkin@@QAEXPAG@Z
?SetMenuFont@MCSkin@@QAEXXZ
?SetSkinFullPathName@MCSkinRegistry@@QAEXPBD@Z
?SetWantSkin@MCSkinRegistry@@QAEX_N@Z
?SkinFileExist@MCSkinLoader@@SA_NXZ
?ToReg@MCSkinRegistry@@QAEXXZ
?Unadvise@MCSkinAdvisor@@QAE_NAAK@Z
?Uninitialize@MCSkin@@QAE_NXZ
?Uninitialize@MCSkinAdvisor@@QAE_NXZ
?Unload@MCSkin@@QAE_NXZ
?_GetBaseDispatchMap@MCSkinAdvisor@@KGPBUAFX_DISPMAP@@XZ
?_GetBaseInterfaceMap@MCSkinAdvisor@@KGPBUAFX_INTERFACEMAP@@XZ
?_GetBaseMessageMap@MCSkinAdvisor@@KGPBUAFX_MSGMAP@@XZ
?_dispatchEntries@MCSkinAdvisor@@0QBUAFX_DISPMAP_ENTRY@@B
?_dispatchEntryCount@MCSkinAdvisor@@0IA
?_dwStockPropMask@MCSkinAdvisor@@0KA
?_interfaceEntries@MCSkinAdvisor@@0QBUAFX_INTERFACEMAP_ENTRY@@B
?_messageEntries@MCSkinAdvisor@@0QBUAFX_MSGMAP_ENTRY@@B
?dispatchMap@MCSkinAdvisor@@1UAFX_DISPMAP@@B
?interfaceMap@MCSkinAdvisor@@1UAFX_INTERFACEMAP@@B
?messageMap@MCSkinAdvisor@@1UAFX_MSGMAP@@B
?s_hRootKey@MCSkinRegistry@@0PAUHKEY__@@A
?s_sDefName@MCSkinRegistry@@0V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?s_sPath@MCSkinRegistry@@0V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?s_strFileName@MCSkinLoader@@2V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?s_strPath@MCSkinLoader@@2VCString@@A

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/SY______.PFM
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/bentonite.cfg
.png
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/zx______.pfm
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/Pfm/zy______.pfm
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/SY______.PFB
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/ZX______.PFB
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Font/ZY______.PFB
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/am.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/ar.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/fi.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/fil.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/fr.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/gu.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/he.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/hi.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/hr.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/hu.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/id.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/lt.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/lv.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/x64/AdonisUI.ClassicTheme.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\1\s\src\AdonisUI.ClassicTheme\obj\Release\net45\AdonisUI.ClassicTheme.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/x64/AdonisUI.ClassicTheme.xml
.xml
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/x64/AdonisUI.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\1\s\src\AdonisUI\obj\Release\net45\AdonisUI.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/x64/AdonisUI.xml
.xml
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/x64/SQLite.Interop.dll
.dll windows:6 windows x64 arch:x64

a42f73521c784fa06f1d886fcbcefcba

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/10/2021, 00:00

Not After

12/12/2024, 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/10/2021, 00:00

Not After

12/12/2024, 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:de:a6:58:6d:f1:ba:ab:46:cb:60:08:e4:1a:5f:83:16:67:26:51:0b:b5:b9:8a:c9:8b:ed:b5:c8:82:6d:c1:e7:36:aa:8a:82:fe:da:08:1c:7c:47:a3:78:cf:af:fe:92:cb:b8:fd:17:10:3d:e8:ca:87:5b:a3:f2:a6:35:30
Signer

Actual PE Digest

cf:de:a6:58:6d:f1:ba:ab:46:cb:60:08:e4:1a:5f:83:16:67:26:51:0b:b5:b9:8a:c9:8b:ed:b5:c8:82:6d:c1:e7:36:aa:8a:82:fe:da:08:1c:7c:47:a3:78:cf:af:fe:92:cb:b8:fd:17:10:3d:e8:ca:87:5b:a3:f2:a6:35:30

Digest Algorithm

sha512

PE Digest Matches

true

3e:e8:ad:96:a2:e1:d0:66:85:77:ae:c2:41:dc:ef:f3:d5:76:58:fd
Signer

Actual PE Digest

3e:e8:ad:96:a2:e1:d0:66:85:77:ae:c2:41:dc:ef:f3:d5:76:58:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

Imports

mscoree

StrongNameSignatureVerificationEx
StrongNameTokenFromAssembly
StrongNameFreeBuffer
CorBindToRuntimeEx
StrongNameErrorInfo

wintrust

WinVerifyTrust

kernel32

TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
lstrlenW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
GetModuleFileNameW
SetEnvironmentVariableW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
GetEnvironmentVariableW
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
ReadFile
CreateFileA
LoadLibraryA
lstrcatW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
WriteConsoleW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
AreFileApisANSI
SetEnvironmentVariableA
RaiseException
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushViewOfFile
lstrcmpiW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW

user32

wsprintfW

advapi32

CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey

Exports

Exports

SI00b5de0dbe05adc8
SI00f2097672333949
SI013768ea228eaf06
SI03ee1370ff2172fd
SI050169b0f137dcac
SI061f9351f6b79d40
SI066df4a47deb7b95
SI075258fe7332f5c9
SI07646c0ac405baf1
SI0a8f1a0337a9feb7
SI0b65268e19d3b81d
SI0e7c9abcb195c68c
SI0f556a49067bf550
SI0fe7fecb92f1b44b
SI12409cae6ddf2f1e
SI12a7c0808f3f99f2
SI150953dc62f0a879
SI1527d54f96ad891e
SI15d5f41c81892f13
SI19b2677a019ab7ab
SI1ae480d1861ed022
SI1bc1bc471c8cd143
SI1c7a7970970b9619
SI21d24eac30bb9014
SI23e7cf9c8e559e93
SI2409c7e1eb500ce9
SI24bb313f312e2857
SI24f5c83eaddd65e8
SI252aeb4a9d3dc2ff
SI2b074e8cf29cb472
SI2b5f6f3d24eb7ba3
SI2bc16556d60ccfcd
SI2c7820fd77bf7594
SI31a566678d8c54ab
SI327cfc7a6b1fd1fb
SI32b0162a49ae8729
SI349980d776ee39ac
SI36ddf861177da59c
SI36e67160052f7f69
SI3723ba2973e3b57b
SI3974af1f94b94613
SI3d45b939740dff51
SI3d527d6e902c8427
SI3efc17e9bbe52434
SI3f596ca698b243fc
SI3f8b1cdb4dc92eff
SI45d842f2d2322061
SI462a496f3247faf2
SI46481015c7f49c68
SI4983499b64278231
SI4987aea8bdedf163
SI4abff63f9a080046
SI4bf5a93645714882
SI4ceb9ee614df7639
SI4fb6877896ef7303
SI50a9b553ac0b2e2a
SI52058dea2268cd04
SI546abd8b90c0f48d
SI568a7d0a1f4d0ff4
SI57335d3e329eea8d
SI5887bf867911838d
SI588da80b6a264802
SI5b2b3e8bff031a75
SI5b7374ef2d63d8eb
SI5c7fb49466251e7d
SI609efcf96ea8408a
SI61a330d2e855b61b
SI633e1c91fb9a8aa1
SI64119fb980b7e962
SI6479b9cf07b87f67
SI674c3bc07fc17979
SI6901b186cfd089f2
SI690ffdcfd9cda629
SI69d8a1d378771295
SI6cfa851319f410c1
SI6d14611bb8b2c8bc
SI6e539204336d5b4b
SI6e6c544c028b2de9
SI70e4ec628dd7e188
SI7164645d0504ae24
SI72621cc08869a205
SI72b05b1ad5f34d61
SI75fe921d50a95fe0
SI768767362ea03a94
SI77ffe3fede90bfbb
SI783104ea11038afc
SI79f6c64948ab63d2
SI7a4943591207dd14
SI7b97ee05aa1e64c7
SI7c373366af3ee2f7
SI7cd7250399b1ea60
SI7da3b9691a73b4a2
SI7f41c842e0d89557
SI8162bd921f89d839
SI824276b89178ecbe
SI83d1cf4976f57337
SI863e1ae0679961f5
SI87a11c29fe1dc17b
SI88974d2e6bd51eff
SI8a3a9f59ab5f24ee
SI8d447a033d183aaf
SI8d676d5954c732bc
SI8dd2c969f2a6a31e
SI8e33e5864c547f3f
SI9196a02c851acbfb
SI919f742193b92a4b
SI943321d364f02e5d
SI94d8f51c6c1db577
SI950480ab972e108d
SI9517b76a4f0b657e
SI9662fa92cee70cf1
SI979d7afd84d6f0ca
SI989b06a5a9b937fe
SI989b754accd7cddf
SI9bf461db9bf83c22
SI9c6d7cd7b7d38055
SI9cb7692f61998485
SI9ea49276dcf9849f
SIa069da76968b7553
SIa0f9dd1158cbfb0c
SIa1d7e21a548b910c
SIa26b8e5116b7d93b
SIa2a6050a8dbd3b7a
SIa3401e98cbad673e
SIa3f7b31190ce0815
SIa618e7f1e95b5c32
SIa62692883d0c456a
SIa8e1a742a358dc07
SIa9b758d3ae2e9aea
SIab3ed5feb3c43f0c
SIada7f27769d7f95b
SIae9562605f0b7c06
SIb391996b7b633820
SIb3f045f05d2d1b0e
SIb4089165600bb7f5
SIb4e97c410be9a2cf
SIb6d52d8cb2f1045a
SIb739af05c351a5b0
SIb84ee16d149e7562
SIb94a6bc97d77e69f
SIbc9b0b73a965892b
SIbff6307869d58daf
SIc001296960f3e921
SIc0bb4eab77f5a999
SIc21d402df09e0c69
SIc26100c97b176329
SIc28b5d2d1f102994
SIc2d8715ee8c9e908
SIc38599462746964c
SIc3b0ae4f7a27b7a8
SIc5d5610a73781fac
SIc8c63d94dd03040b
SIca6f27da046939cc
SIcbf931747ce28d75
SIcc134e65c80c0c61
SIcd2334250b08e199
SIcd6b4ac0aeff7202
SId00f524badf4f5cf
SId6deafdcc0c75049
SId99ac2a61d035e11
SIdba35b6dcb77d463
SIdbbe1b52f304f379
SIdc2e4e1ccfa9a043
SIdc6920f226dceb74
SIdca7c218fe9393fb
SIde347320a2d725fa
SIdeb28053ce71d5b4
SIdfd4d81e1791b463
SIe25e8f29ef2a78eb
SIe2cb515ade8c0235
SIe57aa77c8884d3f9
SIe6405dfd7b63ead9
SIe68a75d48671c8a5
SIe7632ce587b97772
SIea4313bfab0cfe57
SIea8388f7613ed158
SIec91f505db92f298
SIecd4a7ef4a5968a1
SIeea5cda6d9846aa5
SIef12447577961bdf
SIf060fffd3e5c94b5
SIf21356bf3fa1a8ef
SIf216ef3874529d42
SIf356c1132676af25
SIf4199c70bfb81a15
SIf499bb5c421377e7
SIf71b64d343ddea8b
SIf8090240c1414098
SIf8364af380546f2d
SIf86df75514f4442f
SIf8a71e249d9c661f
SIf8b1716e85b0e192
SIf8ee6276be88ce12
SIfc350ae509dc2b53
SIfca3960780d005fa
SIfcfad09d1b0a60ec
SIfd52d1389825aac4
SIfdb97bb7d9d0d622
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_json_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/x86/BouncyCastle.Crypto.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/03/2020, 00:00

Not After

23/03/2023, 12:00

Subject

SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61
Signer

Actual PE Digest

f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

BouncyCastle.Crypto.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/x86/BouncyCastle.Crypto.xml
.xml
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/x86/CP1254
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/Locals/x86/SQLite.Interop.dll
.dll windows:6 windows x86 arch:x86

39ace63b362beb47a2a7a8202a5c4f2d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/10/2021, 00:00

Not After

12/12/2024, 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/10/2021, 00:00

Not After

12/12/2024, 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:1f:3a:ac:fb:ed:36:06:88:31:ea:b4:6d:f3:a1:e3:8d:2e:7a:dc:11:66:12:9b:f9:bb:8d:7d:d5:0e:57:cc:4e:89:0a:bf:27:24:68:97:37:c9:ea:55:87:a3:86:1c:e3:da:c3:21:ee:3d:b2:c8:6c:40:c6:40:7b:27:ce:61
Signer

Actual PE Digest

3b:1f:3a:ac:fb:ed:36:06:88:31:ea:b4:6d:f3:a1:e3:8d:2e:7a:dc:11:66:12:9b:f9:bb:8d:7d:d5:0e:57:cc:4e:89:0a:bf:27:24:68:97:37:c9:ea:55:87:a3:86:1c:e3:da:c3:21:ee:3d:b2:c8:6c:40:c6:40:7b:27:ce:61

Digest Algorithm

sha512

PE Digest Matches

true

18:28:ac:13:a6:25:5d:21:f8:30:42:d7:18:8e:57:cb:ff:65:3f:df
Signer

Actual PE Digest

18:28:ac:13:a6:25:5d:21:f8:30:42:d7:18:8e:57:cb:ff:65:3f:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dev\sqlite\dotnet-private\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

Imports

mscoree

StrongNameSignatureVerificationEx
StrongNameTokenFromAssembly
StrongNameFreeBuffer
CorBindToRuntimeEx
StrongNameErrorInfo

wintrust

WinVerifyTrust

kernel32

TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
lstrlenW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
GetModuleFileNameW
SetEnvironmentVariableW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
GetEnvironmentVariableW
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
ReadFile
CreateFileA
LoadLibraryA
lstrcatW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
WriteConsoleW
lstrcmpiW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
SetEnvironmentVariableA
AreFileApisANSI
DecodePointer
SetStdHandle
RaiseException
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushViewOfFile
MapViewOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW

user32

wsprintfW

advapi32

CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey

Exports

Exports

SI00b5de0dbe05adc8
SI00f2097672333949
SI03ee1370ff2172fd
SI066df4a47deb7b95
SI07646c0ac405baf1
SI0a8f1a0337a9feb7
SI0e7c9abcb195c68c
SI12409cae6ddf2f1e
SI12a7c0808f3f99f2
SI150953dc62f0a879
SI1527d54f96ad891e
SI19b2677a019ab7ab
SI1ae480d1861ed022
SI1bc1bc471c8cd143
SI1c7a7970970b9619
SI21d24eac30bb9014
SI23e7cf9c8e559e93
SI2409c7e1eb500ce9
SI24bb313f312e2857
SI252aeb4a9d3dc2ff
SI2b5f6f3d24eb7ba3
SI2bc16556d60ccfcd
SI2c7820fd77bf7594
SI31a566678d8c54ab
SI327cfc7a6b1fd1fb
SI32b0162a49ae8729
SI36ddf861177da59c
SI36e67160052f7f69
SI3723ba2973e3b57b
SI3d45b939740dff51
SI3d527d6e902c8427
SI3efc17e9bbe52434
SI3f596ca698b243fc
SI3f8b1cdb4dc92eff
SI45d842f2d2322061
SI462a496f3247faf2
SI46481015c7f49c68
SI4983499b64278231
SI4987aea8bdedf163
SI4abff63f9a080046
SI4bf5a93645714882
SI4ceb9ee614df7639
SI4fb6877896ef7303
SI50a9b553ac0b2e2a
SI52058dea2268cd04
SI546abd8b90c0f48d
SI568a7d0a1f4d0ff4
SI588da80b6a264802
SI5b2b3e8bff031a75
SI5b7374ef2d63d8eb
SI5c7fb49466251e7d
SI609efcf96ea8408a
SI61a330d2e855b61b
SI633e1c91fb9a8aa1
SI674c3bc07fc17979
SI6901b186cfd089f2
SI69d8a1d378771295
SI6cfa851319f410c1
SI6d14611bb8b2c8bc
SI6e539204336d5b4b
SI70e4ec628dd7e188
SI7164645d0504ae24
SI72621cc08869a205
SI75fe921d50a95fe0
SI768767362ea03a94
SI783104ea11038afc
SI79f6c64948ab63d2
SI7f41c842e0d89557
SI8162bd921f89d839
SI824276b89178ecbe
SI83d1cf4976f57337
SI863e1ae0679961f5
SI87a11c29fe1dc17b
SI88974d2e6bd51eff
SI8a3a9f59ab5f24ee
SI8d447a033d183aaf
SI8d676d5954c732bc
SI8e33e5864c547f3f
SI9196a02c851acbfb
SI919f742193b92a4b
SI943321d364f02e5d
SI94d8f51c6c1db577
SI950480ab972e108d
SI9517b76a4f0b657e
SI9662fa92cee70cf1
SI979d7afd84d6f0ca
SI989b06a5a9b937fe
SI989b754accd7cddf
SI9c6d7cd7b7d38055
SI9cb7692f61998485
SIa069da76968b7553
SIa0f9dd1158cbfb0c
SIa26b8e5116b7d93b
SIa2a6050a8dbd3b7a
SIa3401e98cbad673e
SIa3f7b31190ce0815
SIa618e7f1e95b5c32
SIa62692883d0c456a
SIae9562605f0b7c06
SIb3f045f05d2d1b0e
SIb4089165600bb7f5
SIb4e97c410be9a2cf
SIb6d52d8cb2f1045a
SIb739af05c351a5b0
SIbc9b0b73a965892b
SIbff6307869d58daf
SIc001296960f3e921
SIc26100c97b176329
SIc28b5d2d1f102994
SIc38599462746964c
SIc3b0ae4f7a27b7a8
SIca6f27da046939cc
SIcbf931747ce28d75
SIcc134e65c80c0c61
SIcd6b4ac0aeff7202
SId6deafdcc0c75049
SId99ac2a61d035e11
SIdba35b6dcb77d463
SIdc2e4e1ccfa9a043
SIdc6920f226dceb74
SIde347320a2d725fa
SIdfd4d81e1791b463
SIe25e8f29ef2a78eb
SIe57aa77c8884d3f9
SIe6405dfd7b63ead9
SIe68a75d48671c8a5
SIe7632ce587b97772
SIea4313bfab0cfe57
SIea8388f7613ed158
SIec91f505db92f298
SIecd4a7ef4a5968a1
SIef12447577961bdf
SIf060fffd3e5c94b5
SIf21356bf3fa1a8ef
SIf216ef3874529d42
SIf356c1132676af25
SIf4199c70bfb81a15
SIf499bb5c421377e7
SIf71b64d343ddea8b
SIf8364af380546f2d
SIf86df75514f4442f
SIf8a71e249d9c661f
SIf8b1716e85b0e192
SIf8ee6276be88ce12
SIfc350ae509dc2b53
SIfca3960780d005fa
SIfd52d1389825aac4
SIfdb97bb7d9d0d622
_SI013768ea228eaf06@8
_SI050169b0f137dcac@12
_SI061f9351f6b79d40@8
_SI075258fe7332f5c9@0
_SI0b65268e19d3b81d@12
_SI0f556a49067bf550@8
_SI0fe7fecb92f1b44b@12
_SI15d5f41c81892f13@8
_SI24f5c83eaddd65e8@4
_SI2b074e8cf29cb472@16
_SI349980d776ee39ac@12
_SI3974af1f94b94613@12
_SI57335d3e329eea8d@12
_SI5887bf867911838d@12
_SI64119fb980b7e962@12
_SI6479b9cf07b87f67@8
_SI690ffdcfd9cda629@8
_SI6e6c544c028b2de9@4
_SI72b05b1ad5f34d61@12
_SI77ffe3fede90bfbb@32
_SI7a4943591207dd14@4
_SI7b97ee05aa1e64c7@12
_SI7c373366af3ee2f7@4
_SI7cd7250399b1ea60@4
_SI7da3b9691a73b4a2@12
_SI8dd2c969f2a6a31e@12
_SI9bf461db9bf83c22@8
_SI9ea49276dcf9849f@12
_SIa1d7e21a548b910c@4
_SIa8e1a742a358dc07@8
_SIa9b758d3ae2e9aea@12
_SIab3ed5feb3c43f0c@0
_SIada7f27769d7f95b@4
_SIb391996b7b633820@36
_SIb84ee16d149e7562@12
_SIb94a6bc97d77e69f@8
_SIc0bb4eab77f5a999@20
_SIc21d402df09e0c69@8
_SIc2d8715ee8c9e908@4
_SIc5d5610a73781fac@12
_SIc8c63d94dd03040b@44
_SIcd2334250b08e199@112
_SId00f524badf4f5cf@20
_SIdbbe1b52f304f379@4
_SIdca7c218fe9393fb@24
_SIdeb28053ce71d5b4@12
_SIe2cb515ade8c0235@12
_SIeea5cda6d9846aa5@12
_SIf8090240c1414098@4
_SIfcfad09d1b0a60ec@20
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_json_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/SaslPrep/SaslPrepProfile_norm_bidi.spp
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/CP1254
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/ICU/icudt26l.dat
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Adobe/symbol.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Adobe/zdingbat.txt
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Mac/CENTEURO.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Mac/CORPCHAR.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Mac/CROATIAN.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Mac/CYRILLIC.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Mac/GREEK.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Mac/ICELAND.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Mac/ROMAN.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Mac/ROMANIAN.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Mac/SYMBOL.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Mac/TURKISH.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/Mac/UKRAINE.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/win/CP1250.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/win/CP1251.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/win/CP1252.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/win/CP1253.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/win/CP1254.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/win/CP1257.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/TypeSupport/Unicode/Mappings/win/CP1258.TXT
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/opengl64.dll
##!!SetUp_2244_Pa$sW0rd$$!!/Resource/resources.pak
##!!SetUp_2244_Pa$sW0rd$$!!/Sеtup.exe
.exe windows:4 windows x86 arch:x86

61259b55b8912888e90f516ca08dc514

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ec:8e:4d:a0:9c:b5:89:45:35:4f:74:64:bc:20:c2:29
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

09/09/2021, 00:00

Not After

08/09/2024, 23:59

Subject

CN=Florian Heidenreich,O=Florian Heidenreich,ST=Sachsen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

75:80:17:c4:83:9f:24:eb:a0:f5:76:e5:e1:c4:d9:30:a2:38:b1:be:11:6e:eb:08:92:19:7e:9d:27:63:a3:c4
Signer

Actual PE Digest

75:80:17:c4:83:9f:24:eb:a0:f5:76:e5:e1:c4:d9:30:a2:38:b1:be:11:6e:eb:08:92:19:7e:9d:27:63:a3:c4

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 220KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 362KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/StartMenu.dll
.dll windows:4 windows x86 arch:x86

80469f6834e579db68a646d49780b9d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatW
FindClose
FindNextFileW
lstrcmpW
GetModuleHandleW
lstrcmpiW
MulDiv
lstrcpynW
GlobalAlloc
lstrcpyW
FindFirstFileW
GlobalFree

user32

GetMessageW
TranslateMessage
PostMessageW
DispatchMessageW
GetDlgItem
GetWindowLongW
CheckDlgButton
ShowWindow
LoadIconW
GetClientRect
MoveWindow
DestroyWindow
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextW
SendMessageW
IsDlgButtonChecked
GetWindowTextW
CreateDialogParamW
SetWindowLongW
wsprintfW
ScreenToClient
IsDialogMessageW
CallWindowProcW

gdi32

GetTextMetricsW
SelectObject

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoTaskMemFree

Exports

Exports

Init
Select
Show

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 578B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UAC.dll
.dll windows:4 windows x86 arch:x86

0ef725341a4aecf8398c0e2132f38049

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetLastError
GetCurrentProcessId
GetCommandLineW
GetProcAddress
CreateThread
GlobalFree
LoadLibraryA
OpenProcess
GlobalAlloc
CreateFileMappingW
Sleep
MapViewOfFile
GetModuleHandleW
UnmapViewOfFile
CreateEventW
SetCurrentDirectoryW
GetVersionExW
GetExitCodeProcess
lstrcatW
LocalFree
GetPrivateProfileStringW
FormatMessageW
GetPrivateProfileIntW
CreateProcessW
CloseHandle
GetLastError
DuplicateHandle
GetCurrentThreadId
lstrlenW
SetEvent
WaitForSingleObject
lstrcmpiW
GetExitCodeThread
GetModuleFileNameW

user32

SetWindowPos
GetClientRect
GetWindowThreadProcessId
SetWindowLongW
DefWindowProcW
GetDlgItem
CallWindowProcW
CallNextHookEx
GetClassNameW
PeekMessageW
DestroyWindow
SendMessageW
SetForegroundWindow
IsWindowVisible
MsgWaitForMultipleObjects
LoadStringW
EndDialog
EnableWindow
DialogBoxParamW
LoadImageW
MessageBoxW
GetWindowLongW
DispatchMessageW
ShowWindow
wsprintfW
CreateDialogParamW
GetWindowRect
IsDialogMessageW
FindWindowExW
CharNextW
CreateWindowExW
LoadIconW
PostMessageW
SetWindowsHookExW
UnhookWindowsHookEx
TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW
QueryServiceStatus
CloseServiceHandle
OpenProcessToken
OpenSCManagerW
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
EqualSid

ole32

CoInitialize

Exports

Exports

_

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

6b5c4f7d679059f68f1269aad3a5cecd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc

user32

DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW

gdi32

SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 638B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Mp3tag.exe
.exe windows:6 windows x86 arch:x86

ada0329d1bc9185f4bb18f7c4c409e71

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ec:8e:4d:a0:9c:b5:89:45:35:4f:74:64:bc:20:c2:29
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

09/09/2021, 00:00

Not After

08/09/2024, 23:59

Subject

CN=Florian Heidenreich,O=Florian Heidenreich,ST=Sachsen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d3:6b:84:4e:06:ae:70:51:9b:17:67:a7:e9:1e:2a:fd:d2:ce:38:4f:db:93:be:98:47:7a:b1:b4:53:b4:da:94
Signer

Actual PE Digest

d3:6b:84:4e:06:ae:70:51:9b:17:67:a7:e9:1e:2a:fd:d2:ce:38:4f:db:93:be:98:47:7a:b1:b4:53:b4:da:94

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Y:\build\binaries\mp3tag\Mp3tag.pdb

Imports

shlwapi

PathIsRelativeW
StrCmpLogicalW
PathCompactPathW
PathStripToRootW
PathRemoveFileSpecW
PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW
ord219
PathQuoteSpacesW
PathIsUNCW
PathSearchAndQualifyW
PathRelativePathToW
ord12

uxtheme

CloseThemeData
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetThemeMargins
GetThemeInt
GetThemeBackgroundContentRect
DrawThemeBackground
EndBufferedPaint
BufferedPaintSetAlpha
BeginBufferedPaint
GetThemeColor
OpenThemeData
SetWindowTheme
DrawThemeText
DrawThemeParentBackground

kernel32

Beep
CompareStringOrdinal
LoadLibraryExW
VirtualProtect
GetACP
OutputDebugStringA
GetModuleHandleA
EncodePointer
lstrcmpW
GlobalFindAtomW
CompareStringW
GetVersionExW
lstrcmpA
CompareStringA
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
SuspendThread
ResumeThread
GetProfileIntW
GetDiskFreeSpaceW
ReplaceFileW
FlushFileBuffers
LockFile
UnlockFile
DuplicateHandle
GetThreadLocale
GetFileSizeEx
LocalFileTimeToFileTime
CreateSemaphoreW
GetAtomNameW
GlobalFlags
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
SetErrorMode
FindResourceExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
RegisterWaitForSingleObject
SetThreadGroupAffinity
GetThreadGroupAffinity
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformationEx
GetLogicalProcessorInformation
GetCurrentProcessorNumberEx
SwitchToThread
SignalObjectAndWait
SystemTimeToTzSpecificLocalTime
GetFileType
ExpandEnvironmentStringsW
FileTimeToSystemTime
GetVolumeInformationW
GetDiskFreeSpaceExW
GetNativeSystemInfo
TryEnterCriticalSection
HeapCreate
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
DeleteFileA
HeapCompact
LockFileEx
GetTickCount
GetConsoleScreenBufferInfo
AreFileApisANSI
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
SystemTimeToFileTime
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
IsValidLocale
ExitProcess
GetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
SetStdHandle
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
HeapQueryInformation
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetCPInfo
CompareStringEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateEventExW
InitOnceExecuteOnce
SetFileInformationByHandle
LCMapStringEx
GetLocaleInfoEx
RtlCaptureStackBackTrace
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
TryAcquireSRWLockExclusive
FormatMessageA
RaiseException
GetWindowsDirectoryW
GetSystemDirectoryW
VerifyVersionInfoW
VerSetConditionMask
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetThreadPriority
ReadDirectoryChangesW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
InitializeCriticalSectionAndSpinCount
WriteFile
ReadFile
SetEndOfFile
SetFilePointer
CreateProcessW
lstrcatW
GetCommandLineW
SetCurrentDirectoryW
GetCurrentDirectoryW
RemoveDirectoryW
CreateDirectoryW
OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFullPathNameW
SetFileTime
GetFileTime
GetLongPathNameW
GetShortPathNameW
GetFileAttributesExW
GetFileSize
MoveFileExW
GetTickCount64
MoveFileW
SetFileAttributesW
CopyFileW
DeleteFileW
SetConsoleCtrlHandler
CreateMutexW
SleepEx
SetEvent
GetCurrentThread
SetThreadPriority
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
HeapDestroy
DecodePointer
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
NormalizeString
IsNormalizedString
GetTempFileNameW
LCMapStringW
GetStringTypeExW
LCMapStringA
LoadLibraryA
GetStringTypeExA
GetUserDefaultLCID
CreateSemaphoreExW
CreateMutexExW
GlobalGetAtomNameW
GetVersion
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
OutputDebugStringW
IsDebuggerPresent
FindNextFileW
lstrcpynW
GetEnvironmentVariableW
WaitForMultipleObjects
MulDiv
Sleep
GetFileAttributesW
TerminateThread
CreateThread
QueryPerformanceFrequency
QueryPerformanceCounter
lstrcpyW
GlobalUnlock
LocalAlloc
GlobalLock
GlobalFree
GlobalAlloc
GlobalSize
WaitForSingleObject
ResetEvent
CreateEventW
FreeLibrary
GetDriveTypeW
SetLastError
LocalFree
WideCharToMultiByte
lstrcmpiW
lstrlenW
EnumSystemLocalesW
FindClose
FindFirstFileW
GetLocaleInfoW
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapFree
GetModuleHandleW
HeapAlloc
GetProcessHeap
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
GlobalDeleteAtom
TzSpecificLocalTimeToSystemTime
GlobalAddAtomW
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
GetLastError
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
GetTempPathW
GetProcAddress
LoadLibraryW
GetModuleFileNameW
SetUnhandledExceptionFilter
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
UnregisterWait
GetThreadTimes
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
InterlockedPopEntrySList
QueryDepthSList
GetFileInformationByHandle
PeekNamedPipe
GetSystemTime

user32

SetWindowRgn
IsZoomed
GetScrollInfo
GetClassLongW
GetWindowRgn
LockWindowUpdate
CopyImage
RealChildWindowFromPoint
SetPropW
MapWindowPoints
IsMenu
AdjustWindowRectEx
DeferWindowPos
TrackMouseEvent
FrameRect
FillRect
SetRect
CopyIcon
DrawEdge
UnionRect
DestroyCursor
GetComboBoxInfo
SetWindowPos
PostThreadMessageW
CreateWindowExW
RegisterClassW
DestroyWindow
DefWindowProcW
MonitorFromRect
MsgWaitForMultipleObjects
CharUpperBuffW
SendMessageTimeoutW
GetLastActivePopup
MsgWaitForMultipleObjectsEx
PeekMessageW
EndPaint
BeginPaint
InvalidateRgn
DrawTextW
GetIconInfo
CreateIconIndirect
DrawIconEx
CreateMenu
GetMenuItemInfoW
GetMenuState
DeleteMenu
ModifyMenuW
LoadMenuW
SetMenuDefaultItem
SendDlgItemMessageA
SetRectEmpty
UnregisterClassA
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
IsWindowEnabled
GetMessageTime
CallWindowProcW
GetClassInfoW
GetClassInfoExW
IsChild
IsWindowUnicode
GetMessageW
GetMessageA
DispatchMessageA
DestroyAcceleratorTable
LoadAcceleratorsW
DestroyMenu
SetActiveWindow
GetActiveWindow
OpenClipboard
SetWindowLongW
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
CharUpperW
CharLowerW
UnregisterClassW
GetDialogBaseUnits
EnableWindow
SendMessageW
MessageBoxW
UpdateWindow
GetAsyncKeyState
KillTimer
SetTimer
PostMessageW
SendDlgItemMessageW
GetDlgItemTextW
MonitorFromWindow
GetMonitorInfoW
CopyRect
SystemParametersInfoW
GetWindowRect
CreatePopupMenu
AppendMenuW
SetDlgItemTextW
GetDlgItem
GetClientRect
InsertMenuW
GetWindow
LoadIconW
GetFocus
GetMessagePos
RegisterClipboardFormatW
IsClipboardFormatAvailable
GetClipboardData
EmptyClipboard
SetClipboardData
GetPriorityClipboardFormat
ReleaseDC
GetDC
DragDetect
GetParent
CheckMenuRadioItem
EnumClipboardFormats
CheckMenuItem
CloseClipboard
GetSubMenu
GetWindowPlacement
SetWindowPlacement
SetFocus
GetCapture
GetMenu
SetMenu
TrackPopupMenuEx
GetForegroundWindow
ValidateRect
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
GetPropW
RemovePropW
GetTopWindow
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetScrollInfo
WinHelpW
ShowWindow
MoveWindow
SetDlgItemInt
GetDlgItemInt
CheckDlgButton
CheckRadioButton
IsDlgButtonChecked
ScrollWindowEx
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
GetMenuStringW
RemoveMenu
GetKeyNameTextW
MapVirtualKeyW
PostQuitMessage
WaitMessage
ScreenToClient
PtInRect
GetMenuItemCount
GetMenuItemID
ClientToScreen
GetSysColor
WindowFromPoint
SetCursor
LoadCursorW
TranslateMessage
DispatchMessageW
InvalidateRect
GetDlgCtrlID
IsWindow
DestroyIcon
RedrawWindow
GetWindowDC
MapDialogRect
SetCapture
ReleaseCapture
GetSystemMetrics
MessageBeep
IntersectRect
EqualRect
RegisterWindowMessageW
EnableMenuItem
GetClassNameW
IsWindowVisible
IsIconic
SetForegroundWindow
GetCursorPos
TrackPopupMenu
GetMenuInfo
GetSysColorBrush
SetMenuInfo
GetWindowThreadProcessId
DrawMenuBar
MonitorFromPoint
LoadStringA
LoadImageW
LoadStringW
BeginDeferWindowPos
EndDeferWindowPos
GetDesktopWindow
GetKeyState
InflateRect
OffsetRect
CharLowerBuffW
IsRectEmpty
GetWindowLongW
GetDCEx
SetParent
GetSystemMenu
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
InsertMenuItemW
TranslateAcceleratorW
BringWindowToTop
DrawIcon
TabbedTextOutW
GrayStringW
DrawTextExW
ShowOwnedPopups

gdi32

IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
GetWindowExtEx
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
MoveToEx
TextOutW
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetMapMode
DPtoLP
CreateEllipticRgn
CreateDIBSection
LPtoDP
GetBkColor
CreateFontW
GetCharWidthW
StretchDIBits
EnumFontFamiliesExW
GetViewportExtEx
GetObjectType
GetCurrentPositionEx
GetClipRgn
GetClipBox
Escape
CreatePatternBrush
CreateHatchBrush
CreateDIBPatternBrushPt
CreateDCW
CopyMetaFileW
SetPixelV
SetDIBits
GetDIBits
Ellipse
ExcludeClipRect
SetPixel
SetBkMode
ExtTextOutW
SetBkColor
CreatePolygonRgn
GetPixel
CreateBitmap
GetWindowOrgEx
FillRgn
CombineRgn
SetRectRgn
OffsetRgn
CreateRectRgn
CreateRectRgnIndirect
ExtCreatePen
CreatePen
SetTextColor
GetStockObject
PatBlt
GetTextColor
DeleteObject
GetDeviceCaps
SelectObject
CreateCompatibleDC
GetObjectW
CreateCompatibleBitmap
BitBlt
DeleteDC
CreateSolidBrush
GetTextExtentPoint32W
CreateDIBitmap
CreateFontIndirectW
GetTextMetricsW
StartDocW
GetCurrentObject

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

SetFileSecurityW
CryptReleaseContext
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
RegEnumKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegEnumValueW
RegSetValueW
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
GetFileSecurityW
GetUserNameW

shell32

SHCreateShellItem
DragQueryFileW
ShellExecuteW
SHGetFileInfoW
SHCreateItemFromIDList
SHParseDisplayName
SHCreateShellItemArrayFromIDLists
ord155
ord190
SHOpenFolderAndSelectItems
FindExecutableW
SHBindToParent
SHGetDataFromIDListW
SHGetIDListFromObject
SHFileOperationW
SHAddToRecentDocs
ExtractIconW
DragFinish
Shell_NotifyIconW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteExW
SHGetMalloc

comctl32

ord410
ImageList_SetBkColor
ImageList_ReplaceIcon
ord345
ord413
ImageList_DragMove
ImageList_DragShowNolock
ImageList_BeginDrag
ImageList_DragEnter
ImageList_GetImageInfo
ImageList_AddMasked
ImageList_DragLeave
ImageList_EndDrag
ord412
ImageList_GetIcon
ImageList_Draw

ole32

ReadFmtUserTypeStg
OleDuplicateData
OleRegGetUserType
SetConvertStg
CoCreateGuid
CoInitializeEx
OleSetClipboard
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
PropVariantCopy
CoLockObjectExternal
WriteFmtUserTypeStg
OleGetClipboard
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CoDisconnectObject
StringFromGUID2
CLSIDFromString
CoGetClassObject
CoRegisterClassObject
CoRevokeClassObject
CoRegisterMessageFilter
CLSIDFromProgID
OleRun
RevokeDragDrop
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
RegisterDragDrop
ReleaseStgMedium
CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CreateBindCtx

oleaut32

VariantClear
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
SysReAllocStringLen
SysStringLen
VariantInit
SysFreeString
SysAllocString
VariantCopy
SystemTimeToVariantTime
VarDecFromStr
VarBstrFromDec
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
VariantTimeToSystemTime
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayCreate
SafeArrayAllocData
SafeArrayAllocDescriptor

oledlg

OleUIBusyW

ws2_32

socket
inet_addr
gethostbyname
WSASetLastError
connect
send
recv
closesocket
select
gethostname
accept
bind
getpeername
htons
getsockname
htonl
inet_ntoa
WSAAsyncSelect
WSAGetLastError
WSACleanup
WSAStartup
sendto
recvfrom
ntohs

gdiplus

GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDrawRectangleI
GdipCreateBitmapFromScan0
GdipSetInterpolationMode
GdipGraphicsClear
GdipSaveImageToStream
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectI
GdipBitmapUnlockBits
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipGetImagePixelFormat
GdipCreateFromHDC
GdipGetImageFlags
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreatePen1
GdipDeletePen
GdipSetPenDashStyle
GdipCreatePath
GdipDeletePath
GdipResetPath
GdipStartPathFigure
GdipClosePathFigure
GdipAddPathArcI
GdipDrawPath
GdipBitmapLockBits
GdipDeleteGraphics

winmm

mciSendCommandW
mciGetErrorStringW

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

tak_deco_lib

tak_SSD_GetStreamInfo
tak_SSD_Valid
tak_SSD_Create_FromStream
tak_SSD_GetEncoderInfo
tak_SSD_Destroy

crypt32

CryptUnprotectMemory
CertFreeCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptProtectMemory

winhttp

WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryAuthSchemes
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpSetOption
WinHttpQueryOption
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpAddRequestHeaders
WinHttpGetDefaultProxyConfiguration
WinHttpSetCredentials

bcrypt

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash

Sections

.text
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Mp3tagReadme.txt
data/actions/Case conversion.mta
data/actions/Schreibweise aendern.mta
data/sources/Cover Art#Discogs Artist + Album.src
data/sources/Cover Art#Discogs Artist + Title.src
data/sources/Cover Art#Discogs Artist + Year.src
data/sources/Cover Art#Discogs Release ID.src
.vbs
data/sources/Cover Art#Discogs.inc
.vbs
data/sources/Cover Art#Discogs.src
data/sources/Cover Art#MusicBrainz.src
data/sources/Discogs Artist + Album.src
data/sources/Discogs Artist + Title.src
data/sources/Discogs Artist + Year.src
data/sources/Discogs Release ID.src
.vbs
data/sources/Discogs.inc
.vbs
data/sources/Discogs.src
data/sources/MusicBrainz.src
.vbs
export/RTF.mte
export/csv.mte
export/html_mp3tag.mte
export/html_standard.mte
export/sfv.mte
export/txt_taglist.mte
lang/Arabic.lng
lang/Armenian.lng
lang/Belarusian.lng
lang/Bulgarian.lng
lang/Catalan.lng
lang/Chinese-CN.lng
lang/Chinese-TW.lng
lang/Corsican.lng
.vbs
lang/Croatian.lng
lang/Czech.lng
lang/Danish.lng
lang/Dutch.lng
lang/English.lng
lang/Farsi.lng
lang/Finnish.lng
lang/French.lng
lang/Galician.lng
lang/German.lng
lang/Greek.lng
lang/Hebrew.lng
lang/Hungarian.lng
lang/Indonesian.lng
lang/Italian.lng
lang/Japanese.lng
lang/Korean.lng
lang/Lithuanian.lng
lang/Macedonian.lng
lang/Norwegian.lng
lang/Polish.lng
lang/Portuguese-BR.lng
lang/Portuguese-PT.lng
lang/Romanian.lng
lang/Russian.lng
lang/Serbian (Latin).lng
lang/Serbian.lng
lang/Slovak.lng
lang/Slovenian.lng
lang/Spanish.lng
lang/Swedish.lng
lang/Tamil.lng
lang/Turkish.lng
lang/Ukrainian.lng
lang/Vietnamese.lng
lang/icons/Armenian.ico
lang/icons/Belarusian.ico
lang/icons/Bulgarian.ico
lang/icons/Catalan.ico
lang/icons/Chinese-CN.ico
lang/icons/Chinese-TW.ico
lang/icons/Corsican.ico
lang/icons/Croatian.ico
lang/icons/Czech.ico
lang/icons/Danish.ico
lang/icons/Dutch.ico
lang/icons/English.ico
lang/icons/Farsi.ico
lang/icons/Finnish.ico
lang/icons/French.ico
lang/icons/German.ico
lang/icons/Greek.ico
lang/icons/Hebrew.ico
lang/icons/Hungarian.ico
lang/icons/Indonesian.ico
lang/icons/Italian.ico
lang/icons/Japanese.ico
lang/icons/Korean.ico
lang/icons/Lithuanian.ico
lang/icons/Norwegian.ico
lang/icons/Polish.ico
lang/icons/Portuguese-BR.ico
lang/icons/Portuguese-PT.ico
lang/icons/Romanian.ico
lang/icons/Russian.ico
lang/icons/Serbian (Latin).ico
lang/icons/Serbian.ico
lang/icons/Slovak.ico
lang/icons/Slovenian.ico
lang/icons/Spanish.ico
lang/icons/Swedish.ico
lang/icons/Turkish.ico
lang/icons/Ukrainian.ico
lang/icons/Vietnamese.ico
##!!SetUp_2244_Pa$sW0rd$$!!/resources.dll

Sharing

General

Malware Config

Signatures

Files

36da04e9d80185202c5dff27d69487ef

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

rpcrt4

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 16KB

.orpc Size: 4KB - Virtual size: 89B

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 1KB

eea1a54f9a41b7445dc95356daf71d0a

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 1024B - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

ce6ef31899b31809ae0c71c094c6f083

Headers

File Characteristics

Imports

mfc42

msvcrt

Sections

.text Size: 512B - Virtual size: 480B

.rdata Size: 512B - Virtual size: 308B

.data Size: 512B - Virtual size: 76B

.rsrc Size: 732KB - Virtual size: 731KB

.reloc Size: 512B - Virtual size: 420B

a8d043bdfc629c21151b760b23d3bcd9

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

ole32

oleaut32

icqrt

advapi32

Exports

Exports

Sections

.text Size: 27KB - Virtual size: 27KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 864B

.reloc Size: 3KB - Virtual size: 3KB

36da04e9d80185202c5dff27d69487ef

Headers

File Characteristics

Imports

mfc42

msvcrt

.text
Size: 20KB - Virtual size: 16KB

.orpc
Size: 4KB - Virtual size: 89B

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 512B - Virtual size: 480B

.rdata
Size: 512B - Virtual size: 308B

.data
Size: 512B - Virtual size: 76B

.rsrc
Size: 732KB - Virtual size: 731KB

.reloc
Size: 512B - Virtual size: 420B

.text
Size: 27KB - Virtual size: 27KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 864B

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 20KB - Virtual size: 16KB

.orpc
Size: 4KB - Virtual size: 89B

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

ca:05:77:9a:83:94:f1:c2:84:3b:d1:35:92:02:9e:08:73:69:34:94:e8:62:49:32:6d:ca:10:c8:55:9e:d9:9b
Signer

ed:14:78:6d:47:d9:55:27:5a:d1:dd:f1:22:3e:ed:fc:47:98:f7:f9
Signer