a8e0d115b81e8974e7e5a6e1bcc3bdb7e81b8ef8347561f7c1e207add2c8d37f

Sharing

Copy URL Twitter E-mail

General

Target

a8e0d115b81e8974e7e5a6e1bcc3bdb7e81b8ef8347561f7c1e207add2c8d37f
Size

3.0MB
MD5

f7dc064722d9831d9a0f36d86903f30d
SHA1

273f36c5be90f186d288438626caa3bc5f56c760
SHA256

a8e0d115b81e8974e7e5a6e1bcc3bdb7e81b8ef8347561f7c1e207add2c8d37f
SHA512

e60c1c13388fa0be8696fd999b010630172e74156f542fdf438427089e0f42e2aff8d7eebcde9a11d8a9fdae5b4563318fa26f0cc6cfd5591b42fbc6cb794689
SSDEEP

49152:8YFja1379VW8QzKxdriSTnYIU4+C7nqIEgRAw9Im57ivLkTQEpKXKOKkZm9m0b28:7a1zW8fdyLmn9/ulvL36OZZsbBEHOwuN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

a8e0d115b81e8974e7e5a6e1bcc3bdb7e81b8ef8347561f7c1e207add2c8d37f
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cb:5c:89:82:9a:d1:91:95:51:fd:14:5e:bb:0a:94:df:1f:00:46:cf
Signer

Actual PE Digest

cb:5c:89:82:9a:d1:91:95:51:fd:14:5e:bb:0a:94:df:1f:00:46:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ftconfig.ini
$TEMP/InstallHelp/SecurityScanner32.dll
.dll windows:5 windows x86 arch:x86

75b9f36d40cc1c98e71e3b881f8feb7a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

85:ff:39:6f:91:9d:07:44:2d:6e:2e:7b:d4:b2:b9:56:23:05:ee:e8
Signer

Actual PE Digest

85:ff:39:6f:91:9d:07:44:2d:6e:2e:7b:d4:b2:b9:56:23:05:ee:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

secur32

GetUserNameExW

wininet

InternetQueryOptionA

kernel32

LoadLibraryW
Sleep
GetVersionExW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
GetACP
MultiByteToWideChar
GetLastError
GetCurrentDirectoryW
GetThreadLocale
GetProcAddress
GlobalFree
FindClose
GetPrivateProfileStringA
GetLocalTime
WritePrivateProfileStringA
RemoveDirectoryW
GetPrivateProfileStructA
FindNextFileW
DeleteCriticalSection
GetShortPathNameW
GetCurrentThreadId
ReleaseMutex
CloseHandle
DeleteFileW
GetCurrentProcessId
SetFileAttributesW
SetEvent
TerminateThread
CreateEventA
LeaveCriticalSection
SetCurrentDirectoryA
EnterCriticalSection
ResetEvent
LoadLibraryA
LocalAlloc
OpenEventA
WaitForMultipleObjects
GetModuleFileNameA
GetModuleHandleA
GetCurrentDirectoryA
GetVersionExA
GetVersion
LocalFree
GetModuleHandleW
GetPrivateProfileStringW
lstrlenW
IsBadReadPtr
SystemTimeToFileTime
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
lstrlenA
SetWaitableTimer
LoadLibraryExW
GetSystemWindowsDirectoryW
GetComputerNameW
WideCharToMultiByte
GetGeoInfoW
GetUserGeoID
CreateEventW
SetCurrentDirectoryW
CreateWaitableTimerW
EnumResourceLanguagesW
CreateThread
GetLocaleInfoW
GetCalendarInfoW
lstrcpynW
MulDiv
IsBadWritePtr
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
FindFirstFileExW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
GetTimeZoneInformation
GetStdHandle
ExitProcess
HeapCreate
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
GetConsoleMode
UnhandledExceptionFilter
TerminateProcess
LCMapStringW
GetCPInfo
GetFullPathNameW
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
GetSystemInfo
VirtualAlloc
VirtualProtect
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
InitializeCriticalSectionAndSpinCount
RaiseException
GetProcessHeap
HeapSize
GetSystemDirectoryW
GlobalAlloc
OpenProcess
InitializeCriticalSection
WriteFile
OutputDebugStringW
GetWindowsDirectoryA
InterlockedCompareExchange
WaitForSingleObject
CreateDirectoryW
GetCurrentProcess
InterlockedDecrement
MoveFileExW
InterlockedIncrement
CreateProcessW
FreeLibrary
VirtualQuery
GetLocaleInfoA
WritePrivateProfileStructA
SetFilePointer
FindFirstFileW
CreateMutexW
GetFileSize
CreateFileA
GetEnvironmentStringsW
QueryPerformanceCounter
GetDriveTypeW
SetEnvironmentVariableA
FlushFileBuffers
GetUserDefaultLCID
GetTickCount
GetConsoleCP
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
CompareStringW
SetEndOfFile
SetStdHandle
WriteConsoleW
IsValidLocale
EnumSystemLocalesA

user32

SetCapture
MsgWaitForMultipleObjects
GetDC
IsDialogMessageW
SetRect
ReleaseDC
GetDlgItem
GetDesktopWindow
SetWindowPos
LoadStringW
ShowWindow
CreateDialogParamW
ReleaseCapture
SetForegroundWindow
LoadImageW
GetClientRect
TranslateMessage
GetForegroundWindow
LoadIconW
BringWindowToTop
SystemParametersInfoW
PeekMessageW
MonitorFromWindow
MsgWaitForMultipleObjectsEx
GetLastInputInfo
MessageBoxW
GetSystemMetrics
IsWindowVisible
SendMessageW
GetMonitorInfoW
GetWindowThreadProcessId
GetWindow
DispatchMessageW
GetWindowRect
DestroyWindow
ClientToScreen
GetWindowInfo
wsprintfW

gdi32

GetDeviceCaps
SetBkMode
DeleteObject
GetObjectW
GetStockObject
CreateFontIndirectW

advapi32

CreateWellKnownSid
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
LookupAccountNameW
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
LookupAccountSidW
RegQueryValueExW
EqualSid
GetTokenInformation
OpenProcessToken

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetFolderPathW

ole32

CoGetClassObject
CoInitialize
CoUninitialize

oleaut32

SysAllocString
SysFreeString
SafeArrayGetLBound
VariantClear
CreateDispTypeInfo
VariantCopy
SysAllocStringByteLen
SafeArrayDestroy
VariantInit
VariantChangeType
SafeArrayGetElement
SysStringByteLen
SafeArrayGetUBound
CreateStdDispatch
SafeArrayCreate
SafeArrayPutElement

shlwapi

PathRemoveFileSpecW
PathAppendW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW

Exports

Exports

DoPersistAfterUninstall
IsEnterpriseEnvironment
LaunchAppAsUser
LaunchMcAfeeExe
OnAppAbort
OnAppInit
OnAppShutdown
OnBrowserInit

Sections

.text
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/AVScanComponent.dll
.dll regsvr32 windows:5 windows x86 arch:x86

35d5848d2df674119d0ebf8335899b1d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b8:2d:a6:69:46:c2:73:cb:f4:1c:50:6e:65:68:f3:19:0b:6c:1c:17
Signer

Actual PE Digest

b8:2d:a6:69:46:c2:73:cb:f4:1c:50:6e:65:68:f3:19:0b:6c:1c:17

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\BuildEngineSpace\Temp\1bdca58b-5fe3-430d-84d8-22c1c468b5cd\build\Win32\Release\AVScanComponent.pdb

Imports

psapi

GetModuleFileNameExW
EnumProcesses
EnumProcessModules

wintrust

WinVerifyTrust

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

SetThreadLocale
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
InterlockedCompareExchange
GetCurrentProcessId
WritePrivateProfileStructA
WideCharToMultiByte
GetPrivateProfileStructA
GetPrivateProfileStringA
GetFileAttributesW
CreateMutexW
CloseHandle
CreateDirectoryW
FindClose
FindNextFileW
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileA
GetWindowsDirectoryA
GetACP
GetLocaleInfoA
GetVersionExW
GetShortPathNameW
MoveFileExW
SetFileAttributesW
FindFirstFileW
DeleteFileW
RemoveDirectoryW
GetCurrentDirectoryW
InterlockedDecrement
InterlockedIncrement
ReleaseMutex
OutputDebugStringW
GetLocalTime
GetCurrentThreadId
CreateFileW
WaitForSingleObject
VirtualQuery
GetThreadLocale
InitializeCriticalSectionAndSpinCount
LocalFree
LoadLibraryW
GetSystemDirectoryW
GetPrivateProfileStringW
WaitForMultipleObjects
GetTickCount
SetPriorityClass
FindResourceExW
CreateProcessW
SystemTimeToFileTime
GetCurrentProcess
GetUserDefaultLCID
SetEvent
IsBadReadPtr
OpenProcess
GlobalAlloc
GetExitCodeProcess
GlobalFree
ResetEvent
LockResource
CreateEventW
GetTempPathW
CreateToolhelp32Snapshot
Module32First
Module32Next
GetVersionExA
LoadLibraryA
GetSystemDirectoryA
GetShortPathNameA
FindFirstFileA
IsBadWritePtr
IsValidLocale
EnumSystemLocalesA
FlushFileBuffers
GetConsoleMode
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
RtlUnwind
MultiByteToWideChar
GetLastError
RaiseException
lstrcmpiW
GetModuleHandleW
GetProcAddress
lstrlenW
FreeLibrary
CompareStringW
SetEnvironmentVariableW
WriteConsoleW
SetStdHandle
SetEndOfFile
GetCPInfo
LCMapStringW
TerminateProcess
InitializeCriticalSection
GetConsoleCP
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
SetLastError
CreateThread
ExitThread
GetCommandLineA
GetSystemInfo
VirtualAlloc
VirtualProtect
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
HeapCreate
GetStdHandle
ExitProcess
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter

user32

CharNextW

advapi32

RegSetValueExW
RegCreateKeyA
FreeSid
AllocateAndInitializeSid
LookupAccountSidW
RegQueryValueExW
EqualSid
GetTokenInformation
OpenProcessToken
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW

shell32

SHGetFolderPathW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize
CoTaskMemRealloc
StringFromGUID2

oleaut32

VarBstrCmp
SysAllocStringLen
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantCopy
VariantClear
VariantInit
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
RegisterTypeLi
VarUI4FromStr

shlwapi

PathRemoveFileSpecW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
LoadUserProfileW

mcscan32

AVInitialise
AVScanObject
AVClose

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 311KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/AVScanner.ini
$_1_/MCCompHostConfig.ini
$_1_/McAfee.ico
$_1_/McAfeeMSS_IE.dll
.dll regsvr32 windows:5 windows x86 arch:x86

37582229b20019cf557825608629bee6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:9a:8a:ff:0d:9e:48:54:56:ac:e2:3e:5b:e3:17:c4:c8:3e:03:f8
Signer

Actual PE Digest

09:9a:8a:ff:0d:9e:48:54:56:ac:e2:3e:5b:e3:17:c4:c8:3e:03:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\BuildEngineSpace\Temp\1bdca58b-5fe3-430d-84d8-22c1c468b5cd\build\Win32\Release\McAfeeMSS_IE.pdb

Imports

kernel32

GetModuleHandleW
lstrcmpiW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
FreeLibrary
MultiByteToWideChar
SizeofResource
GetProcAddress
FindResourceW
LoadLibraryExW
IsWow64Process
GetCurrentProcess
SetThreadLocale
GetThreadLocale
lstrlenW
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LoadResource
RaiseException
GetStringTypeW
LCMapStringW
LoadLibraryW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
EncodePointer
DecodePointer
HeapAlloc
HeapFree
RtlUnwind
GetCurrentThreadId
GetCommandLineA
Sleep
HeapSize
ExitProcess
WriteFile
GetStdHandle
HeapCreate
HeapDestroy
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
HeapReAlloc
IsProcessorFeaturePresent
GetCPInfo
GetACP

user32

CharNextW

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW

ole32

CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
StringFromCLSID
StringFromGUID2
CoTaskMemRealloc

oleaut32

VariantClear
SysFreeString
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysStringLen
DispCallFunc
VariantInit
VarUI4FromStr
SysAllocString

shlwapi

SHDeleteKeyW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/McCHSvc.exe
.exe windows:5 windows x86 arch:x86

603d97f2e7030c168d81f6ad456a5739

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8e:8b:d5:d9:76:ac:d8:63:0b:96:39:d7:ec:54:a8:42:e9:4c:5d:6f
Signer

Actual PE Digest

8e:8b:d5:d9:76:ac:d8:63:0b:96:39:d7:ec:54:a8:42:e9:4c:5d:6f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\BuildEngineSpace\Temp\1bdca58b-5fe3-430d-84d8-22c1c468b5cd\build\Win32\Release\McComponentHostService.pdb

Imports

kernel32

GetLocalTime
GetCurrentThreadId
CreateFileW
WaitForSingleObject
VirtualQuery
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
GetProcAddress
GetPrivateProfileStringW
FreeLibrary
lstrlenW
GetModuleHandleW
lstrcmpiW
RaiseException
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetCurrentProcess
GetCurrentThread
SetEvent
GetCommandLineW
CreateEventW
CreateThread
OutputDebugStringW
GetVersionExA
SetStdHandle
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetSystemTimeAsFileTime
ReleaseMutex
InterlockedIncrement
InterlockedDecrement
GetCurrentDirectoryW
RemoveDirectoryW
DeleteFileW
FindFirstFileW
SetFileAttributesW
MoveFileExW
GetShortPathNameW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
FlushFileBuffers
GetACP
GetWindowsDirectoryA
CreateFileA
GetFileSize
ReadFile
SetFilePointer
WriteFile
FindNextFileW
FindClose
CreateDirectoryW
CloseHandle
CreateMutexW
GetModuleFileNameW
GetFileAttributesW
GetPrivateProfileStringA
MultiByteToWideChar
GetPrivateProfileStructA
WideCharToMultiByte
WritePrivateProfileStructA
GetLastError
GetCurrentProcessId
InterlockedCompareExchange
Sleep
EnterCriticalSection
WriteConsoleW
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
GetLocaleInfoW
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetStdHandle
HeapCreate
ExitProcess
HeapSize
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
LCMapStringW
GetCPInfo
RtlUnwind
GetStartupInfoW
HeapSetInformation
HeapAlloc
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapFree
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer

user32

LoadStringW
CharUpperW
MessageBoxW
GetMessageW
PostThreadMessageW
CharNextW
TranslateMessage
DispatchMessageW

advapi32

OpenProcessToken
DeregisterEventSource
ReportEventW
RegisterEventSourceW
DeleteService
ControlService
OpenServiceW
ChangeServiceConfig2W
CloseServiceHandle
CreateServiceW
OpenSCManagerW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RegQueryValueExW
SetServiceStatus
LookupAccountNameW
InitializeAcl
GetAclInformation
GetAce
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
OpenThreadToken
GetTokenInformation
SetSecurityDescriptorOwner
IsValidSid
GetLengthSid
CopySid
SetSecurityDescriptorGroup
InitializeSecurityDescriptor
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW

shell32

SHGetFolderPathW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromString
CoDisconnectObject
CoInitializeSecurity
CoAddRefServerProcess
CoReleaseServerProcess
CoCreateInstance
CoInitializeEx
CoUninitialize
CoResumeClassObjects
CoRegisterClassObject
CoRevokeClassObject
StringFromGUID2

oleaut32

UnRegisterTypeLi
RegisterTypeLi
VarCmp
SysStringByteLen
SysAllocStringByteLen
VariantCopy
VariantClear
VariantInit
LoadTypeLi
LoadRegTypeLi
SysStringLen
VarUI4FromStr
SysFreeString
SysAllocString

Sections

.text
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/McUICnt.exe
.exe windows:5 windows x86 arch:x86

801583edf04c83dca6d5a7c2aafb6f9f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

99:4b:5f:b9:c4:a6:44:11:b2:49:fc:b5:94:a2:b4:17:f8:7c:2a:60
Signer

Actual PE Digest

99:4b:5f:b9:c4:a6:44:11:b2:49:fc:b5:94:a2:b4:17:f8:7c:2a:60

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\BuildEngineSpace\Temp\a4c70369-1335-4a70-a3de-04f49464df14\build\Win32\Release\McUICnt.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wintrust

WinVerifyTrust

kernel32

IsValidLocale
SetEnvironmentVariableA
FlushFileBuffers
WriteConsoleW
CreateFileW
GetFileSize
CloseHandle
GetVersionExW
ReadFile
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetModuleHandleW
GetLastError
EnterCriticalSection
Sleep
InterlockedCompareExchange
GetCurrentProcessId
WritePrivateProfileStructA
WideCharToMultiByte
GetPrivateProfileStructA
MultiByteToWideChar
GetPrivateProfileStringA
GetFileAttributesW
GetModuleFileNameW
CreateMutexW
CreateDirectoryW
FindClose
FindNextFileW
WriteFile
SetFilePointer
CreateFileA
GetWindowsDirectoryA
GetACP
GetLocaleInfoA
GetThreadLocale
GetShortPathNameW
MoveFileExW
SetFileAttributesW
FindFirstFileW
DeleteFileW
RemoveDirectoryW
GetCurrentDirectoryW
InterlockedDecrement
InterlockedIncrement
ReleaseMutex
OutputDebugStringW
GetLocalTime
GetCurrentThreadId
WaitForSingleObject
VirtualQuery
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
LoadLibraryW
GetProcAddress
FreeLibrary
IsBadWritePtr
SetEvent
GlobalDeleteAtom
GetCommandLineW
LocalFree
CreateEventW
OpenEventW
SetLastError
CreateThread
LocalAlloc
GlobalAddAtomW
EnumSystemLocalesA
lstrlenW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetEnvironmentVariableW
InterlockedExchange
SwitchToThread
LoadLibraryExW
IsBadReadPtr
SystemTimeToFileTime
GetVersionExA
LoadLibraryA
GetSystemDirectoryA
lstrlenA
GetShortPathNameA
Module32Next
Module32First
CreateToolhelp32Snapshot
OpenProcess
FindFirstFileA
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
HeapCreate
GetStdHandle
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
CompareStringW
GetDateFormatA
GetTimeFormatA
LCMapStringW
GetCPInfo
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetSystemInfo
VirtualAlloc
VirtualProtect
GetLocaleInfoW
DecodePointer
EncodePointer
GetStringTypeW
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
RaiseException
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetStdHandle
GlobalGetAtomNameW
GetTickCount
GetUserDefaultLCID

user32

UnregisterClassW
LoadStringW
LoadBitmapW
LoadIconW
LoadCursorW
GetClassInfoW
CreateWindowExW
RegisterClassW
UpdateWindow
EnableWindow
DefWindowProcW
SetWindowTextW
IsWindowVisible
KillTimer
SetTimer
PostMessageW
GetParent
SendMessageW
LoadImageW
PostQuitMessage
GetWindowRect
DestroyIcon
GetDesktopWindow
GetClientRect
SetWindowPos
ReleaseDC
GetDC
GetSystemMetrics
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
IsIconic
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
SetForegroundWindow
FindWindowExW
SetPropW
wsprintfW
BringWindowToTop
GetWindowPlacement
ShowWindow
DestroyWindow
CreateDialogParamW
SetWindowLongW
GetWindowLongW
IsDialogMessageW
IsWindow
EndDialog
GetPropW

gdi32

GetDeviceCaps

ole32

CLSIDFromString
CoUninitialize
CreateStreamOnHGlobal
CoInitialize
CoInitializeEx
CoGetClassObject
CoCreateInstance

oleaut32

SysAllocStringByteLen
CreateDispTypeInfo
CreateStdDispatch
SysAllocStringLen
SysStringByteLen
VariantInit
VariantClear
VariantChangeType
VariantCopy
SysAllocString
SysFreeString

shlwapi

PathRemoveFileSpecW
PathFileExistsW
SHGetValueW
PathStripPathW
PathAppendW

wininet

InternetCrackUrlW

Sections

.text
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/McUpdater.dll
.dll regsvr32 windows:5 windows x86 arch:x86

355fa80a585e5e270101478d9d0bd44f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ea:30:91:63:13:4a:c5:22:00:cf:fb:16:b0:26:ca:9f:83:07:4a:8b
Signer

Actual PE Digest

ea:30:91:63:13:4a:c5:22:00:cf:fb:16:b0:26:ca:9f:83:07:4a:8b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\BuildEngineSpace\Temp\1bdca58b-5fe3-430d-84d8-22c1c468b5cd\build\Win32\Release\McUpdater.pdb

Imports

wintrust

WinVerifyTrust

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

OutputDebugStringW
GetWindowsDirectoryA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
Sleep
GetVersionExW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
GetACP
MultiByteToWideChar
RaiseException
GetLastError
GetCurrentDirectoryW
GetThreadLocale
FindClose
GetPrivateProfileStringA
GetLocalTime
RemoveDirectoryW
GetPrivateProfileStructA
FindNextFileW
DeleteCriticalSection
GetShortPathNameW
GetCurrentThreadId
ReleaseMutex
CloseHandle
DeleteFileW
GetCurrentProcessId
SetFileAttributesW
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
GetExitCodeProcess
FreeLibrary
SetEvent
TerminateThread
GetSystemDirectoryA
GetProcAddress
ResetEvent
LoadLibraryA
GetModuleFileNameA
InterlockedCompareExchange
GetVersionExA
LocalFree
GetSystemTime
SystemTimeToFileTime
OpenThread
lstrcpynW
GetTimeFormatW
lstrlenW
lstrcpyW
GetCurrentProcess
GetModuleHandleW
GlobalAlloc
GetSystemDirectoryW
LoadLibraryW
GlobalFree
lstrcatW
CreateEventW
GetUserDefaultLCID
lstrcmpiW
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
SetThreadLocale
ResumeThread
SetEndOfFile
FlushFileBuffers
IsBadReadPtr
CreateProcessW
TlsFree
lstrlenA
GetShortPathNameA
Module32Next
Module32First
CreateToolhelp32Snapshot
OpenProcess
FindFirstFileA
IsBadWritePtr
IsValidCodePage
GetOEMCP
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
LCMapStringW
WaitForSingleObject
CreateDirectoryW
InterlockedDecrement
MoveFileExW
InterlockedIncrement
VirtualQuery
GetLocaleInfoA
WritePrivateProfileStructA
SetFilePointer
FindFirstFileW
CreateMutexW
GetFileSize
CreateFileA
GetTempFileNameW
CompareStringW
SetEnvironmentVariableA
TlsAlloc
TlsGetValue
TlsSetValue
SetCurrentDirectoryW
GetCPInfo
RtlUnwind
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetTickCount
GetCommandLineA
GetSystemTimeAsFileTime
HeapReAlloc
CreateThread
ExitThread
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapAlloc
HeapFree
DecodePointer
EncodePointer
GetStringTypeW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
GetTimeZoneInformation
GetLocaleInfoW
HeapSize
GetStdHandle
ExitProcess
HeapDestroy
HeapCreate
SetLastError
InterlockedExchange

user32

wsprintfW
GetMessageW
PostThreadMessageW
CharNextW

advapi32

RegOpenKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueA
LookupAccountSidW
RegQueryInfoKeyW
GetTokenInformation
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyA

shell32

SHGetFolderPathW

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2

oleaut32

SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysAllocString
VariantInit
SysStringLen
VarUI4FromStr
VariantCopy
VariantClear
SysFreeString

wininet

HttpQueryInfoW
HttpAddRequestHeadersW
InternetSetOptionW
HttpSendRequestW
HttpOpenRequestW
InternetReadFile
InternetCrackUrlW
InternetOpenW
InternetCloseHandle
InternetConnectW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/SSScheduler.exe
.exe windows:5 windows x86 arch:x86

183bd4fad5e59a80b92c89354d994285

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e6:5b:a4:5d:aa:d6:55:c1:97:98:d2:09:9d:c5:d6:d0:fc:e9:27:bd
Signer

Actual PE Digest

e6:5b:a4:5d:aa:d6:55:c1:97:98:d2:09:9d:c5:d6:d0:fc:e9:27:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\BuildEngineSpace\Temp\1bdca58b-5fe3-430d-84d8-22c1c468b5cd\build\Win32\Release\SSScheduler.pdb

Imports

kernel32

CreateFileA
GetFileSize
CreateMutexW
FindFirstFileW
SetFilePointer
WritePrivateProfileStructA
GetLocaleInfoA
VirtualQuery
FreeLibrary
InterlockedIncrement
SystemTimeToFileTime
MoveFileExW
InterlockedDecrement
GetCurrentProcess
CreateDirectoryW
WaitForSingleObject
InterlockedCompareExchange
OutputDebugStringW
IsBadReadPtr
GetWindowsDirectoryA
WriteFile
InitializeCriticalSection
GetSystemDirectoryW
WideCharToMultiByte
LoadLibraryW
Sleep
GetVersionExW
LeaveCriticalSection
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
GetACP
MultiByteToWideChar
GetLastError
GetCurrentDirectoryW
GetThreadLocale
GetProcAddress
EnterCriticalSection
FindClose
GetPrivateProfileStringA
GetLocalTime
WritePrivateProfileStringA
RemoveDirectoryW
GetPrivateProfileStructA
FindNextFileW
DeleteCriticalSection
GetShortPathNameW
GetCurrentThreadId
ReleaseMutex
CloseHandle
DeleteFileW
GetCurrentProcessId
SetFileAttributesW
SetWaitableTimer
ResetEvent
LocalAlloc
CreateEventW
GlobalGetAtomNameW
CreateWaitableTimerW
GetPrivateProfileSectionW
LocalFree
CompareStringW
FlushFileBuffers
WriteConsoleW
SetEnvironmentVariableA
SetStdHandle
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
InterlockedExchange
LoadLibraryA
RaiseException
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
GetSystemTimeAsFileTime
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetCPInfo
RtlUnwind
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
HeapCreate
ExitProcess
GetStdHandle
GetLocaleInfoW
GetTimeZoneInformation

user32

DispatchMessageW
FindWindowExW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
SendMessageW
GetPropW

oleaut32

SysFreeString
SysAllocString

shlwapi

PathIsRelativeW
PathRemoveFileSpecW

Sections

.text
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/SecurityScanner.dll
.dll windows:5 windows x86 arch:x86

75b9f36d40cc1c98e71e3b881f8feb7a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

85:ff:39:6f:91:9d:07:44:2d:6e:2e:7b:d4:b2:b9:56:23:05:ee:e8
Signer

Actual PE Digest

85:ff:39:6f:91:9d:07:44:2d:6e:2e:7b:d4:b2:b9:56:23:05:ee:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

secur32

GetUserNameExW

wininet

InternetQueryOptionA

kernel32

LoadLibraryW
Sleep
GetVersionExW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
GetACP
MultiByteToWideChar
GetLastError
GetCurrentDirectoryW
GetThreadLocale
GetProcAddress
GlobalFree
FindClose
GetPrivateProfileStringA
GetLocalTime
WritePrivateProfileStringA
RemoveDirectoryW
GetPrivateProfileStructA
FindNextFileW
DeleteCriticalSection
GetShortPathNameW
GetCurrentThreadId
ReleaseMutex
CloseHandle
DeleteFileW
GetCurrentProcessId
SetFileAttributesW
SetEvent
TerminateThread
CreateEventA
LeaveCriticalSection
SetCurrentDirectoryA
EnterCriticalSection
ResetEvent
LoadLibraryA
LocalAlloc
OpenEventA
WaitForMultipleObjects
GetModuleFileNameA
GetModuleHandleA
GetCurrentDirectoryA
GetVersionExA
GetVersion
LocalFree
GetModuleHandleW
GetPrivateProfileStringW
lstrlenW
IsBadReadPtr
SystemTimeToFileTime
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
lstrlenA
SetWaitableTimer
LoadLibraryExW
GetSystemWindowsDirectoryW
GetComputerNameW
WideCharToMultiByte
GetGeoInfoW
GetUserGeoID
CreateEventW
SetCurrentDirectoryW
CreateWaitableTimerW
EnumResourceLanguagesW
CreateThread
GetLocaleInfoW
GetCalendarInfoW
lstrcpynW
MulDiv
IsBadWritePtr
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
FindFirstFileExW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
GetTimeZoneInformation
GetStdHandle
ExitProcess
HeapCreate
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
GetConsoleMode
UnhandledExceptionFilter
TerminateProcess
LCMapStringW
GetCPInfo
GetFullPathNameW
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
GetSystemInfo
VirtualAlloc
VirtualProtect
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
InitializeCriticalSectionAndSpinCount
RaiseException
GetProcessHeap
HeapSize
GetSystemDirectoryW
GlobalAlloc
OpenProcess
InitializeCriticalSection
WriteFile
OutputDebugStringW
GetWindowsDirectoryA
InterlockedCompareExchange
WaitForSingleObject
CreateDirectoryW
GetCurrentProcess
InterlockedDecrement
MoveFileExW
InterlockedIncrement
CreateProcessW
FreeLibrary
VirtualQuery
GetLocaleInfoA
WritePrivateProfileStructA
SetFilePointer
FindFirstFileW
CreateMutexW
GetFileSize
CreateFileA
GetEnvironmentStringsW
QueryPerformanceCounter
GetDriveTypeW
SetEnvironmentVariableA
FlushFileBuffers
GetUserDefaultLCID
GetTickCount
GetConsoleCP
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
CompareStringW
SetEndOfFile
SetStdHandle
WriteConsoleW
IsValidLocale
EnumSystemLocalesA

user32

SetCapture
MsgWaitForMultipleObjects
GetDC
IsDialogMessageW
SetRect
ReleaseDC
GetDlgItem
GetDesktopWindow
SetWindowPos
LoadStringW
ShowWindow
CreateDialogParamW
ReleaseCapture
SetForegroundWindow
LoadImageW
GetClientRect
TranslateMessage
GetForegroundWindow
LoadIconW
BringWindowToTop
SystemParametersInfoW
PeekMessageW
MonitorFromWindow
MsgWaitForMultipleObjectsEx
GetLastInputInfo
MessageBoxW
GetSystemMetrics
IsWindowVisible
SendMessageW
GetMonitorInfoW
GetWindowThreadProcessId
GetWindow
DispatchMessageW
GetWindowRect
DestroyWindow
ClientToScreen
GetWindowInfo
wsprintfW

gdi32

GetDeviceCaps
SetBkMode
DeleteObject
GetObjectW
GetStockObject
CreateFontIndirectW

advapi32

CreateWellKnownSid
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
LookupAccountNameW
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
LookupAccountSidW
RegQueryValueExW
EqualSid
GetTokenInformation
OpenProcessToken

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetFolderPathW

ole32

CoGetClassObject
CoInitialize
CoUninitialize

oleaut32

SysAllocString
SysFreeString
SafeArrayGetLBound
VariantClear
CreateDispTypeInfo
VariantCopy
SysAllocStringByteLen
SafeArrayDestroy
VariantInit
VariantChangeType
SafeArrayGetElement
SysStringByteLen
SafeArrayGetUBound
CreateStdDispatch
SafeArrayCreate
SafeArrayPutElement

shlwapi

PathRemoveFileSpecW
PathAppendW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW

Exports

Exports

DoPersistAfterUninstall
IsEnterpriseEnvironment
LaunchAppAsUser
LaunchMcAfeeExe
OnAppAbort
OnAppInit
OnAppShutdown
OnBrowserInit

Sections

.text
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/SecurityScanner_LD.dll
.dll windows:5 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

eb:21:f4:d8:02:80:f5:ff:a7:04:91:88:2e:c4:c1:02:f5:84:a4:8b
Signer

Actual PE Digest

eb:21:f4:d8:02:80:f5:ff:a7:04:91:88:2e:c4:c1:02:f5:84:a4:8b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$_1_/WMIScanner.dll
.dll regsvr32 windows:5 windows x86 arch:x86

fb212eeb98ba109d19411acaa07acb66

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:52:50:f9:ed:36:0c:99:4c:8b:da:92:d7:f6:f6:57:c7:ce:e2:fb
Signer

Actual PE Digest

61:52:50:f9:ed:36:0c:99:4c:8b:da:92:d7:f6:f6:57:c7:ce:e2:fb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\BuildEngineSpace\Temp\1bdca58b-5fe3-430d-84d8-22c1c468b5cd\build\Win32\Release\WMIScanner.pdb

Imports

wintrust

WinVerifyTrust

kernel32

InterlockedCompareExchange
GetCurrentProcessId
WritePrivateProfileStructA
WideCharToMultiByte
GetPrivateProfileStructA
GetPrivateProfileStringA
GetFileAttributesW
CreateMutexW
CloseHandle
CreateDirectoryW
FindClose
FindNextFileW
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileA
GetWindowsDirectoryA
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
GetShortPathNameW
MoveFileExW
SetFileAttributesW
FindFirstFileW
DeleteFileW
RemoveDirectoryW
GetCurrentDirectoryW
InterlockedDecrement
Sleep
ReleaseMutex
OutputDebugStringW
GetLocalTime
GetCurrentThreadId
CreateFileW
WaitForSingleObject
VirtualQuery
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
GetSystemTime
lstrlenA
FindResourceExW
LockResource
SetThreadLocale
FormatMessageW
LocalAlloc
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
IsBadReadPtr
GetVersionExA
LoadLibraryA
GetSystemDirectoryA
GetShortPathNameA
Module32Next
Module32First
CreateToolhelp32Snapshot
OpenProcess
FindFirstFileA
IsBadWritePtr
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetLastError
RaiseException
lstrcmpiW
GetUserDefaultLCID
GetModuleHandleW
GetProcAddress
lstrlenW
FreeLibrary
DeleteCriticalSection
InterlockedIncrement
QueryPerformanceCounter
GetEnvironmentStringsW
SetEnvironmentVariableA
SetEndOfFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
LoadLibraryW
GetTimeZoneInformation
IsValidLocale
EnumSystemLocalesA
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
SetHandleCount
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
HeapCreate
GetStdHandle
ExitProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetTickCount
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
GetLocaleInfoW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
LocalFree
VirtualProtect
VirtualAlloc
GetSystemInfo
GetCommandLineA
RtlUnwind
GetCPInfo
LCMapStringW
GetTimeFormatA
GetDateFormatA
CompareStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

user32

CharNextW

advapi32

QueryServiceStatusEx
RegCreateKeyA
RegSetValueExA
RegQueryValueExW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW

shell32

SHGetFolderPathW

ole32

StringFromGUID2
CoSetProxyBlanket
CLSIDFromProgID
CoDisconnectObject
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleRun
CoGetClassObject
CoCreateInstance

oleaut32

SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
VariantCopy
VariantChangeType
VariantClear
VariantInit
SystemTimeToVariantTime
VariantTimeToSystemTime
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
VarUI4FromStr
GetErrorInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 328KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/WebInfoScanner.dll
.dll regsvr32 windows:5 windows x86 arch:x86

0538876cb30dd7ddf8a120016992dc57

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2b:cd:bb:db:3e:83:e0:43:ed:0c:d7:9f:9d:ab:8e:9f:61:61:02:0f
Signer

Actual PE Digest

2b:cd:bb:db:3e:83:e0:43:ed:0c:d7:9f:9d:ab:8e:9f:61:61:02:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\BuildEngineSpace\Temp\1bdca58b-5fe3-430d-84d8-22c1c468b5cd\build\Win32\Release\WebInfoScanner.pdb

Imports

wintrust

WinVerifyTrust

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
Sleep
InterlockedCompareExchange
GetCurrentProcessId
WritePrivateProfileStructA
GetPrivateProfileStructA
GetPrivateProfileStringA
GetFileAttributesW
CreateMutexW
CloseHandle
CreateDirectoryW
FindClose
FindNextFileW
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileA
GetWindowsDirectoryA
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
GetShortPathNameW
MoveFileExW
CopyFileW
SetFileAttributesW
FindFirstFileW
DeleteFileW
RemoveDirectoryW
GetCurrentDirectoryW
InterlockedDecrement
InterlockedIncrement
SizeofResource
OutputDebugStringW
GetLocalTime
GetCurrentThreadId
CreateFileW
WaitForSingleObject
VirtualQuery
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
GetTickCount
SetThreadLocale
lstrlenA
LockResource
FindResourceExW
CompareFileTime
WaitForMultipleObjects
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
OpenProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
LocalFileTimeToFileTime
CreateEventW
SetEvent
ResetEvent
FindFirstFileExW
IsBadReadPtr
GetVersionExA
LoadLibraryA
GetSystemDirectoryA
GetShortPathNameA
Module32Next
Module32First
FindFirstFileA
IsBadWritePtr
LocalFree
IsValidLocale
EnumSystemLocalesA
MultiByteToWideChar
GetLastError
RaiseException
lstrcmpiW
GetModuleHandleW
GetProcAddress
lstrlenW
FreeLibrary
DeleteCriticalSection
SetStdHandle
WriteConsoleW
SetEndOfFile
CompareStringW
ReleaseMutex
SetEnvironmentVariableA
GetUserDefaultLCID
LoadLibraryW
PeekNamedPipe
GetFileInformationByHandle
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
QueryPerformanceCounter
GetEnvironmentStringsW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
VirtualProtect
VirtualAlloc
GetSystemInfo
GetCommandLineA
GetTimeFormatW
GetDateFormatW
GetSystemTimeAsFileTime
GetDriveTypeW
ExitThread
CreateThread
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
SetHandleCount
GetLocaleInfoW
IsValidCodePage
GetOEMCP
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapCreate
GetStdHandle
ExitProcess
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LCMapStringW
GetCPInfo
RtlUnwind
GetFullPathNameW
HeapDestroy

user32

CharNextW

advapi32

RegCreateKeyA
RegSetValueExA
OpenProcessToken
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW

shell32

SHGetFolderPathW

ole32

CoInitializeEx
CoUninitialize
CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantCopy
LoadTypeLi
LoadRegTypeLi
SysFreeString
SysStringLen
SysAllocString
VariantClear
VariantInit
VarUI4FromStr

shlwapi

PathFileExistsW

sacore

sa_map_freeitembycopy
sa_list_destroy
sa_list_append
sa_list_cloneitembycopy
sa_list_freeitembycopy
sa_list_create
sa_dss_maintenance
sa_dss_lookupurls
sa_sethttphooks
sa_setcachehooks
sa_setmblhooks
sa_setstorehooks
sa_setloghooks
SA_OPTION_SHAREDDIRECTORY
SA_OPTION_LOCALE
SA_OPTION_AFFID
SA_OPTION_CLIENTTYPE
SA_OPTION_CLIENTVERSION
SA_OPTION_DSSURL
sa_option_setstring
sa_finalize
sa_initialize
sa_map_cloneitembycopy
sa_map_comparestringi
sa_map_hashstringi
sa_map_set
sa_map_destroy
sa_map_get
sa_map_create

sa_cache_sqlite

cache_flush_sqlite
cache_setvalue_sqlite
cache_getvalue_sqlite
cache_initialize_sqlite
cache_finalize_sqlite

sa_http_win32

sa_http_get_win32
sa_http_post_win32
sa_http_cancel_win32

sa_mbl

sa_mbl_authenticate_hook
sa_mbl_lookup_hook

sa_store_sqlite

store_getvalue_sqlite
store_getkeys_sqlite
store_finalize_sqlite
store_initialize_sqlite
store_getkeysvalues_sqlite
store_setvalue_sqlite
store_setvalues_sqlite

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken

sqlite3

sqlite3_prepare_v2
sqlite3_step
sqlite3_finalize
sqlite3_column_int
sqlite3_open16
sqlite3_busy_timeout
sqlite3_errmsg
sqlite3_column_int64
sqlite3_db_handle
sqlite3_column_text16
sqlite3_column_count
sqlite3_close

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 314KB - Virtual size: 314KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/config.dat
$_1_/ftconfig.ini
$_1_/mcbrwsr2.dll
.dll windows:5 windows x86 arch:x86

de9e2b930b6ae2700b4a11160e07aa2e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:4a:36:1e:16:8a:81:a8:f3:ef:aa:da:33:25:08:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/09/2008, 00:00

Not After

09/10/2011, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a2:8d:c1:b2:81:30:2f:d2:6a:22:0e:69:a9:20:5c:a1:78:89:42:3a
Signer

Actual PE Digest

a2:8d:c1:b2:81:30:2f:d2:6a:22:0e:69:a9:20:5c:a1:78:89:42:3a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\BuildEngineSpace\Temp\74a71990-0aa5-49ab-a1a5-4f8b25bbac71\build\Win32\Release\mcbrwsr2.pdb

Imports

wintrust

WinVerifyTrust

urlmon

CoInternetGetSession

kernel32

DeleteCriticalSection
InterlockedIncrement
GetProcAddress
GetSystemDirectoryW
CloseHandle
WriteFile
CreateFileW
InterlockedDecrement
WideCharToMultiByte
GetFileAttributesW
LoadLibraryExW
SetCurrentDirectoryW
GetCurrentDirectoryW
lstrcpynW
GetLastError
MultiByteToWideChar
GetACP
GetLocaleInfoA
GetVersionExW
FindClose
FindFirstFileW
SetFilePointer
ReadFile
GetFileSize
CreateFileA
GetWindowsDirectoryA
GetPrivateProfileStringA
GetPrivateProfileStructA
WritePrivateProfileStringA
WritePrivateProfileStructA
GetShortPathNameW
CopyFileW
GetTempFileNameW
MoveFileExW
SetFileAttributesW
GetCurrentProcessId
CreateMutexW
GetModuleFileNameW
RemoveDirectoryW
FindNextFileW
DeleteFileW
CreateDirectoryW
lstrlenW
OutputDebugStringW
InitializeCriticalSection
GetCurrentThreadId
ReleaseMutex
WaitForSingleObject
VirtualQuery
Sleep
InterlockedCompareExchange
VerifyVersionInfoW
VerSetConditionMask
EnterCriticalSection
LeaveCriticalSection
GlobalFree
GlobalAlloc
GetCurrentProcess
GetTickCount
RaiseException
LoadLibraryW
LocalFree
LocalAlloc
IsBadReadPtr
GetModuleHandleW
SystemTimeToFileTime
GetVersionExA
LoadLibraryA
GetSystemDirectoryA
Module32Next
Module32First
CreateToolhelp32Snapshot
OpenProcess
FindFirstFileA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
IsValidLocale
IsBadWritePtr
FreeLibrary
GetThreadLocale
ExitProcess
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
SetEnvironmentVariableA
GetStdHandle
GetModuleFileNameA
GetLocalTime
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
HeapDestroy
HeapCreate
VirtualFree
IsValidCodePage
GetOEMCP
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
CompareStringW
CompareStringA
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleA
InterlockedExchange
HeapFree
GetProcessHeap
RtlUnwind
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
GetSystemInfo
HeapReAlloc
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
GetTimeFormatA
GetDateFormatA
HeapSize

user32

LoadStringW
GetClientRect
IsChild
SetWindowTextW
MessageBoxW
KillTimer
GetKeyState
SetTimer
wsprintfW
PostMessageW

advapi32

FreeSid
RegCreateKeyA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

SHGetFolderPathW
ShellExecuteW

ole32

CoCreateInstance
CoGetClassObject
CreateStreamOnHGlobal
IIDFromString
CLSIDFromString

oleaut32

VariantChangeType
CreateDispTypeInfo
CreateStdDispatch
LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysStringLen
VariantCopy
SysAllocStringLen
VariantClear
VariantInit
SysFreeString
SysAllocString

shlwapi

SHSetValueW
SHGetValueW

wininet

InternetCrackUrlW

Exports

Exports

McBrwDeInit
McBrwInit
McBrwInit2
McGetBrwObject
McGetBrwObject2

Sections

.text
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/mcscan32.dll
.dll windows:4 windows x86 arch:x86

361a36d6a6598083251b73e547b26b9c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d6:c1:28:eb:69:66:42:cb:16:3f:e8:83:70:3b:8f:6f:20:20:bf:09
Signer

Actual PE Digest

d6:c1:28:eb:69:66:42:cb:16:3f:e8:83:70:3b:8f:6f:20:20:bf:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\AVEngine5\BUILD\AVEngine\build\bin\vs6m\release\mcscan32.pdb

Imports

kernel32

GetModuleHandleA
GetCurrentProcess
WaitForSingleObject
ReleaseMutex
CreateFileA
TerminateProcess
WriteProfileStringA
GetWindowsDirectoryA
GetVersionExA
OpenProcess
GetPrivateProfileStringA
WritePrivateProfileStringA
FindClose
FindNextFileA
CreateDirectoryA
GetTempPathA
FindFirstFileA
RemoveDirectoryA
SetFileAttributesA
DeleteFileA
GetShortPathNameA
CopyFileW
GetLastError
GetFileTime
GetFileAttributesA
GetFileAttributesW
CopyFileA
SetFilePointer
MoveFileExA
SetFileTime
DeleteFileW
SetEndOfFile
ReadFile
GetFileType
WriteFile
WideCharToMultiByte
MoveFileA
SetFileAttributesW
MoveFileExW
GetComputerNameA
GetDriveTypeA
GetVolumeInformationA
VirtualQueryEx
ReadProcessMemory
GetCurrentProcessId
GetTempFileNameA
GetDiskFreeSpaceA
FindFirstFileW
QueryPerformanceFrequency
GetCurrentThreadId
FindNextFileW
IsDBCSLeadByte
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CompareStringW
CompareStringA
SetEnvironmentVariableA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
MultiByteToWideChar
GetVersion
DeviceIoControl
lstrlenW
CreateFileW
AreFileApisANSI
SetFileApisToOEM
CloseHandle
SetCurrentDirectoryA
GetCurrentDirectoryA
CreateMutexA
CreateProcessA
LoadLibraryExA
GetModuleFileNameA
Sleep
QueryPerformanceCounter
GetTickCount
HeapFree
HeapAlloc
HeapCreate
HeapDestroy
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemDirectoryA
SetErrorMode
ExitProcess
GetSystemTimeAsFileTime
GetCommandLineA
GetProcessHeap
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
VirtualFree
VirtualAlloc
HeapReAlloc
HeapSize
RaiseException
RtlUnwind
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoA

user32

CharPrevA
GetSystemMetrics
GetKeyboardType
wsprintfA
GetWindowThreadProcessId
EnumWindows
SendMessageA
PostMessageA
FindWindowA
CharNextA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
IsValidSid
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorDacl
LookupAccountNameA
InitializeSecurityDescriptor
SetFileSecurityA
RegEnumValueW
RegEnumValueA
RegEnumKeyExA
RegEnumKeyExW
RegDeleteKeyW
RegDeleteKeyA
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegDeleteValueW
RegSetValueExW
RegOpenKeyExA
RegCloseKey
OpenProcessToken

Exports

Exports

AVClose
AVInitialise
AVRetrieveInstanceInfo
AVScanObject
AVUpdate
DllMain
Old_VS_ClearBuffer
RetrieveExtensionLists
RetrieveSingleExtensionList
VS_DeleteFile
VS_End
VS_GetAbsIO
VS_GetEngineInfo
VS_GetInfectedItemInfo
VS_Init
VS_InstanceInit
VS_IsRemoverAvailable
VS_ReLoadData
VS_ReadVirusList
VS_RegisterCallback
VS_RepairBoot
VS_RepairFile
VS_ScanBootEx
VS_ScanCompressed
VS_ScanFile
VS_ScanHeuristics
VS_ScanMemory
VS_SetAbsIO
VS_SetAbsIOEx
VS_SetExtendedOpts
VS_VirusCount
VScan_AddNativeParameter
VScan_CleanBoot
VScan_CleanBootJp
VScan_CleanFile
VScan_DeleteFile
VScan_DeleteNativeParameter
VScan_End
VScan_ExtraVirusCount
VScan_GetAbsIO
VScan_GetCompleteExtensionListSize
VScan_GetEngineInfo
VScan_GetIndividualExtensionListSizes
VScan_GetInfectedItemInfo
VScan_Init
VScan_InitEx
VScan_InitExclYN
VScan_InstanceInit
VScan_ReLoadData
VScan_ReadVirusList
VScan_ReadVirusListEx
VScan_RegisterCallback
VScan_ScanBoot
VScan_ScanFile
VScan_ScanMemory
VScan_SetAbsIO
VScan_SetExtendedOpts
VScan_SetTimeout
VScan_UserExtensionList
VScan_VirusCount
_AVClose
_AVInitialise
_AVScanObject
_AVUpdate
_AVUpdate@8

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 292KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/npMcAfeeMSS.dll
.dll windows:5 windows x86 arch:x86

0516edb33936af6b2ddda6825300e658

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:26:27:24:20:b0:cb:54:fd:c1:3f:ad:76:31:43:18:f2:ff:b0:15
Signer

Actual PE Digest

30:26:27:24:20:b0:cb:54:fd:c1:3f:ad:76:31:43:18:f2:ff:b0:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\BuildEngineSpace\Temp\1bdca58b-5fe3-430d-84d8-22c1c468b5cd\build\Win32\Release\npMcAfeeMss.pdb

Imports

kernel32

DisableThreadLibraryCalls
RaiseException
RtlUnwind
GetCurrentThreadId
DecodePointer
GetCommandLineA
HeapAlloc
GetLastError
HeapFree
IsProcessorFeaturePresent
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
GetProcAddress
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LoadLibraryW
LCMapStringW
MultiByteToWideChar
GetStringTypeW

user32

SetWindowLongW
DefWindowProcW

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/sa_cache_sqlite.dll
.dll windows:4 windows x86 arch:x86

3b8794bb1773e8602953fadc60774de9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:4a:36:1e:16:8a:81:a8:f3:ef:aa:da:33:25:08:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/09/2008, 00:00

Not After

09/10/2011, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e8:0f:4e:83:fa:7b:08:3d:81:dc:39:71:14:42:33:f8:42:c5:26:0f
Signer

Actual PE Digest

e8:0f:4e:83:fa:7b:08:3d:81:dc:39:71:14:42:33:f8:42:c5:26:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\SACore3\BUILD\SACore32\RelWithDebInfo\sa_cache_sqlite.pdb

Imports

sqlite3

sqlite3_bind_double
sqlite3_bind_blob
sqlite3_reset
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_open
sqlite3_exec
sqlite3_close
sqlite3_prepare
sqlite3_bind_text
sqlite3_step
sqlite3_finalize

sacore

sacore_malloc
sacore_strdup
sa_map_next
sa_map_clear
sa_buffer_create
sacore_calloc
sa_cache_getcontext
sacore_free
sa_thread_mutex_create
sa_map_cloneitembyref
sa_map_comparestring
sa_map_freeitembyref
sa_map_hashstring
sa_map_create
sa_option_getstring
sa_util_getprivatelocation
sa_option_getint
sa_util_fileexists
sa_log
sa_cache_setdata
sa_thread_mutex_destroy
sa_map_destroy
sa_map_get
sa_map_delete
sa_map_set
sa_map_count
sa_cache_getname
sa_thread_mutex_unlock
sa_thread_mutex_lock
sa_cache_getdata

kernel32

InterlockedDecrement
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
FlushFileBuffers
CloseHandle
CreateFileA
GetLocaleInfoW
HeapSize
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RtlUnwind
HeapReAlloc
VirtualAlloc
InitializeCriticalSection
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
FatalAppExitA
GetOEMCP
GetACP
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
WriteFile
SetFilePointer
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
GetCurrentThread
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime

Exports

Exports

SA_CACHE_SQLITE_OPTION_CACHEFILE
SA_CACHE_SQLITE_OPTION_MEMCACHESIZE
cache_finalize_sqlite
cache_flush_sqlite
cache_getvalue_sqlite
cache_initialize_sqlite
cache_setvalue_sqlite

Sections

.text
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/sa_http_win32.dll
.dll windows:4 windows x86 arch:x86

1aedb614903f26d345ddfa9a10372e74

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:4a:36:1e:16:8a:81:a8:f3:ef:aa:da:33:25:08:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/09/2008, 00:00

Not After

09/10/2011, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2d:70:46:56:4d:70:59:d8:af:6f:e2:b7:f7:9b:72:27:6a:c4:a3:1d
Signer

Actual PE Digest

2d:70:46:56:4d:70:59:d8:af:6f:e2:b7:f7:9b:72:27:6a:c4:a3:1d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\SACore3\BUILD\SACore32\RelWithDebInfo\sa_http_win32.pdb

Imports

kernel32

GlobalFree
GetLastError
InterlockedExchange
Sleep
CompareStringW
CompareStringA
CreateFileA
GetLocaleInfoW
HeapSize
CloseHandle
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
LoadLibraryA
FreeLibrary
SetConsoleCtrlHandler
VirtualAlloc
HeapReAlloc
RtlUnwind
InitializeCriticalSection
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
WriteFile
SetFilePointer
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
FatalAppExitA
ExitProcess
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCurrentThread
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetProcAddress
GetOEMCP
GetSystemTimeAsFileTime
WideCharToMultiByte
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
SetEnvironmentVariableA

advapi32

ImpersonateLoggedOnUser
RevertToSelf

sacore

sa_thread_create
sa_releasepool_push
sa_releasepool_pop
sa_http_request_getpostdata
SA_OPTION_PROXY_INFO_ORIGIN
SA_OPTION_PROXYHOST
SA_OPTION_PROXYPORT
SA_OPTION_PROXYUSER
SA_OPTION_PROXYPASSWORD
sa_buffer_create
sa_map_freeitembycopy
sa_map_cloneitembycopy
sa_map_comparestringi
sa_map_hashstringi
sa_map_create
sa_http_request_setdata
sa_buffer_append
sa_map_set
sa_option_getstring
sa_option_getbool
SA_OPTION_PROXY_SECS_BEFORE_AUTO_RETRY
sa_option_getint
SA_OPTION_PROXYLASTAUTOCONFERROR
SA_OPTION_PROXY_TRY_AUTOCONFIG
sa_option_setbool
SA_OPTION_PROXYCONFIGURL
sa_option_setstring
SA_OPTION_PROXYHOSTPORT
SA_OPTION_PROXYBYPASS
SA_OPTION_PROXYTYPE
sa_option_setint
sacore_calloc
sacore_free
sacore_malloc
sa_thread_mutex_lock
sa_log
sa_thread_mutex_unlock
sa_http_request_getcontext
sa_option_getbinary
sa_buffer_destroy
sa_map_destroy
sa_http_request_getdata
sa_thread_mutex_create
sa_thread_mutex_destroy
sa_http_request_geturl

winhttp

WinHttpSendRequest
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpSetOption
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen

Exports

Exports

SA_OPTION_HTTPWIN32_USERTOKEN
sa_http_cancel_win32
sa_http_get_win32
sa_http_post_win32

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/sa_mbl.dll
.dll windows:4 windows x86 arch:x86

0047ec60ad30a0d1e1fa4384f0f5eded

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:4a:36:1e:16:8a:81:a8:f3:ef:aa:da:33:25:08:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/09/2008, 00:00

Not After

09/10/2011, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

21:c0:19:aa:3a:6b:94:80:79:22:e1:50:66:79:80:9d:3f:4c:02:98
Signer

Actual PE Digest

21:c0:19:aa:3a:6b:94:80:79:22:e1:50:66:79:80:9d:3f:4c:02:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\SACore3\BUILD\SACore32\RelWithDebInfo\sa_mbl.pdb

Imports

kernel32

GetProcAddress
LoadLibraryA
CompareStringW
CompareStringA
FlushFileBuffers
CloseHandle
CreateFileA
GetLocaleInfoW
HeapSize
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetLastError
GetCurrentThread
ExitProcess
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
FatalAppExitA
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
ReadFile
SetEnvironmentVariableA

sacore

sacore_calloc
sa_log
sacore_free
sacore_malloc

ws2_32

ntohl

Exports

Exports

sa_mbl_authenticate_hook
sa_mbl_lookup_hook

Sections

.text
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/sa_store_sqlite.dll
.dll windows:4 windows x86 arch:x86

5a9b988adb52ac30f6eeaa290c046dc8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:4a:36:1e:16:8a:81:a8:f3:ef:aa:da:33:25:08:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/09/2008, 00:00

Not After

09/10/2011, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d9:40:e4:ad:c7:44:25:f4:01:4d:17:0d:1f:4d:59:2d:bd:ec:80:4e
Signer

Actual PE Digest

d9:40:e4:ad:c7:44:25:f4:01:4d:17:0d:1f:4d:59:2d:bd:ec:80:4e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\SACore3\BUILD\SACore32\RelWithDebInfo\sa_store_sqlite.pdb

Imports

sqlite3

sqlite3_column_text
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_reset
sqlite3_prepare
sqlite3_bind_text
sqlite3_bind_blob
sqlite3_step
sqlite3_finalize
sqlite3_open
sqlite3_exec
sqlite3_close

sacore

sa_map_freeitembycopy
sa_map_cloneitembycopy
sa_map_comparestring
sa_map_hashstring
sa_map_create
sa_map_set
sa_list_freeitembycopy
sa_list_cloneitembycopy
sa_list_create
sa_list_append
sa_buffer_create
sa_map_next
sa_store_getname
sacore_calloc
sa_store_getcontext
sacore_free
sa_option_getstring
sa_util_getprivatelocation
sa_util_getsharedlocation
sa_util_fileexists
sa_log
sa_store_setdata
sa_store_getdata

kernel32

SetHandleCount
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
FlushFileBuffers
CloseHandle
CreateFileA
GetLocaleInfoW
HeapSize
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RtlUnwind
HeapReAlloc
VirtualAlloc
InitializeCriticalSection
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
FatalAppExitA
GetOEMCP
GetACP
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
GetCurrentThread
Sleep
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo

Exports

Exports

SA_STORE_SQLITE_OPTION_PRIVATEFILE
SA_STORE_SQLITE_OPTION_SHAREDFILE
store_finalize_sqlite
store_getkeys_sqlite
store_getkeysvalues_sqlite
store_getvalue_sqlite
store_initialize_sqlite
store_setvalue_sqlite
store_setvalues_sqlite

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/sacore.dll
.dll windows:4 windows x86 arch:x86

81e5e28f56ea755f442313d6154cdc30

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:4a:36:1e:16:8a:81:a8:f3:ef:aa:da:33:25:08:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/09/2008, 00:00

Not After

09/10/2011, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7f:e6:2f:22:f5:c2:f2:4a:87:ed:a3:41:9c:11:d9:b9:25:7f:52:6d
Signer

Actual PE Digest

7f:e6:2f:22:f5:c2:f2:4a:87:ed:a3:41:9c:11:d9:b9:25:7f:52:6d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\SACore3\BUILD\SACore32\RelWithDebInfo\sacore.pdb

Imports

kernel32

GetCurrentThreadId
GetCurrentThread
CreateMutexA
ReleaseMutex
CreateEventA
CreateSemaphoreA
SignalObjectAndWait
ReleaseSemaphore
GetLastError
CreateThread
MultiByteToWideChar
GetCurrentProcessId
GetLocaleInfoA
OpenThread
CreateDirectoryA
GetShortPathNameW
GetExitCodeThread
CloseHandle
ExitThread
InterlockedExchange
Sleep
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
HeapReAlloc
HeapFree
GetUserDefaultLCID
WaitForSingleObject
GetVersion
GetFileType
GetStdHandle
FlushConsoleInputBuffer
GetTickCount
QueryPerformanceCounter
GlobalMemoryStatus
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
GetSystemTimeAsFileTime
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
WideCharToMultiByte
GetCommandLineA
EnterCriticalSection
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetModuleHandleA
SetLastError
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
GetCPInfo
GetACP
GetOEMCP
RtlUnwind
GetFullPathNameW
GetCurrentDirectoryA
SetCurrentDirectoryA
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
WriteFile
ReadFile
GetConsoleCP
FlushFileBuffers
SetStdHandle
SetFilePointer
CreateFileA
GetTimeZoneInformation
LCMapStringA
LCMapStringW
InitializeCriticalSection
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
CreateFileW
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetDriveTypeA
GetFullPathNameA
HeapSize
GetLocaleInfoW
HeapAlloc
InterlockedIncrement
LeaveCriticalSection
InterlockedDecrement

shell32

SHGetSpecialFolderPathW

ws2_32

recvfrom
recv

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

shlwapi

PathAppendA

iphlpapi

GetAdaptersInfo

user32

MessageBoxA
GetUserObjectInformationW
GetDesktopWindow
GetProcessWindowStation

gdi32

BitBlt
GetObjectA
SelectObject
DeleteDC
GetDeviceCaps
CreateCompatibleDC
CreateDCA
GetBitmapBits
DeleteObject
CreateCompatibleBitmap

advapi32

ReportEventA
DeregisterEventSource
RegisterEventSourceA

Exports

Exports

SA_CACHE_DOMAIN_INFO
SA_CACHE_PROGRAM_INFO
SA_OPTION_AFFID
SA_OPTION_CLIENTTYPE
SA_OPTION_CLIENTVERSION
SA_OPTION_DSSURL
SA_OPTION_LOCALE
SA_OPTION_PASSWD
SA_OPTION_PIP
SA_OPTION_PRIVATEDIRECTORY
SA_OPTION_PROXYBYPASS
SA_OPTION_PROXYCONFIGURL
SA_OPTION_PROXYHOST
SA_OPTION_PROXYHOSTPORT
SA_OPTION_PROXYLASTAUTOCONFERROR
SA_OPTION_PROXYPASSWORD
SA_OPTION_PROXYPORT
SA_OPTION_PROXYTYPE
SA_OPTION_PROXYUSER
SA_OPTION_PROXY_INFO_ORIGIN
SA_OPTION_PROXY_SECS_BEFORE_AUTO_RETRY
SA_OPTION_PROXY_TRY_AUTOCONFIG
SA_OPTION_SHAREDDIRECTORY
SA_OPTION_USESSL
SA_OPTION_VERIFYSIGNATURE
sa_antiphishing_cancel
sa_antiphishing_engine_getcontext
sa_antiphishing_engine_getdata
sa_antiphishing_engine_setdata
sa_antiphishing_request_getcontext
sa_antiphishing_request_getdata
sa_antiphishing_request_getengine
sa_antiphishing_request_gethtml
sa_antiphishing_request_getpopularity
sa_antiphishing_request_geturl
sa_antiphishing_request_setdata
sa_antiphishing_run
sa_buffer_append
sa_buffer_clone
sa_buffer_concat
sa_buffer_create
sa_buffer_delete
sa_buffer_destroy
sa_buffer_insert
sa_buffer_joinbuffers
sa_buffer_joinstrings
sa_buffer_length
sa_buffer_lowercase
sa_buffer_read
sa_buffer_readline
sa_buffer_recv
sa_buffer_recvfrom
sa_buffer_replace
sa_buffer_split
sa_buffer_string
sa_buffer_trim
sa_buffer_truncate
sa_buffer_update
sa_buffer_uppercase
sa_cache_flush
sa_cache_get
sa_cache_getcontext
sa_cache_getdata
sa_cache_getname
sa_cache_getvalue
sa_cache_setdata
sa_cache_setvalue
sa_checksum_create
sa_checksum_destroy
sa_checksum_final
sa_checksum_update
sa_colors
sa_ctype_isalnum
sa_ctype_isalpha
sa_ctype_isdigit
sa_ctype_islower
sa_ctype_isprint
sa_ctype_isspace
sa_ctype_isupper
sa_ctype_isxdigit
sa_ctype_tolower
sa_ctype_toupper
sa_dsa_create
sa_dsa_destroy
sa_dsa_sign
sa_dsa_verify
sa_dss_cancelrequest
sa_dss_deletestatistics
sa_dss_getstatistics
sa_dss_lookupchecksums
sa_dss_lookupurls
sa_dss_maintenance
sa_dss_recordstatistics
sa_dss_reportstatistics
sa_dss_setmessagecallback
sa_finalize
sa_http_request_cancel
sa_http_request_create
sa_http_request_destroy
sa_http_request_get
sa_http_request_getcontent
sa_http_request_getcontext
sa_http_request_getdata
sa_http_request_getheaders
sa_http_request_getid
sa_http_request_getpostdata
sa_http_request_getqueryargs
sa_http_request_geturl
sa_http_request_iscanceled
sa_http_request_isfordss
sa_http_request_post
sa_http_request_setdata
sa_http_request_setfordss
sa_http_request_setpostdata
sa_http_request_setqueryargs
sa_http_request_seturl
sa_initialize
sa_json_parse
sa_list_append
sa_list_clear
sa_list_clone
sa_list_cloneitembycopy
sa_list_cloneitembyref
sa_list_count
sa_list_create
sa_list_delete
sa_list_destroy
sa_list_extend
sa_list_find
sa_list_freeitembycopy
sa_list_freeitembyref
sa_list_get
sa_list_insert
sa_list_next
sa_list_retain
sa_list_set
sa_list_slice
sa_list_sort
sa_log
sa_map_clear
sa_map_clone
sa_map_cloneitembycopy
sa_map_cloneitembyref
sa_map_comparepointers
sa_map_comparestring
sa_map_comparestringi
sa_map_count
sa_map_create
sa_map_delete
sa_map_destroy
sa_map_freeitembycopy
sa_map_freeitembyref
sa_map_get
sa_map_hashpointer
sa_map_hashstring
sa_map_hashstringi
sa_map_next
sa_map_retain
sa_map_set
sa_mbl_authenticate
sa_mbl_cancel
sa_mbl_lookup
sa_option_getbinary
sa_option_getbool
sa_option_getdouble
sa_option_getint
sa_option_getstring
sa_option_getvalue
sa_option_setbinary
sa_option_setbool
sa_option_setdouble
sa_option_setint
sa_option_setstring
sa_option_setvalue
sa_regex_clone
sa_regex_compare
sa_regex_create
sa_regex_createset
sa_regex_execute
sa_regex_hash
sa_regex_matches
sa_regex_release
sa_regex_retain
sa_reinitialize
sa_releasepool_calloc
sa_releasepool_create
sa_releasepool_destroy
sa_releasepool_malloc
sa_releasepool_pop
sa_releasepool_push
sa_releasepool_realloc
sa_releasepool_register
sa_releasepool_strdup
sa_releasepool_unregister
sa_scores
sa_set_add
sa_set_clear
sa_set_clone
sa_set_contains
sa_set_count
sa_set_create
sa_set_delete
sa_set_destroy
sa_set_intersect
sa_set_next
sa_set_retain
sa_set_subtract
sa_set_union
sa_setantiphishinghooks
sa_setcachehooks
sa_sethttphooks
sa_setloghooks
sa_setmblhooks
sa_setmemhooks
sa_setstorehooks
sa_setthreadhooks
sa_settlshooks
sa_store_get
sa_store_getcontext
sa_store_getdata
sa_store_getkeys
sa_store_getkeysvalues
sa_store_getname
sa_store_getvalue
sa_store_setdata
sa_store_setvalue
sa_store_setvalues
sa_thread_cond_broadcast
sa_thread_cond_create
sa_thread_cond_destroy
sa_thread_cond_signal
sa_thread_cond_timedwait
sa_thread_cond_wait
sa_thread_create
sa_thread_exit
sa_thread_join
sa_thread_mutex_create
sa_thread_mutex_destroy
sa_thread_mutex_lock
sa_thread_mutex_trylock
sa_thread_mutex_unlock
sa_thread_pop_handler
sa_thread_push_handler
sa_thread_rwlock_create
sa_thread_rwlock_destroy
sa_thread_rwlock_rdlock
sa_thread_rwlock_tryrdlock
sa_thread_rwlock_trywrlock
sa_thread_rwlock_unlock
sa_thread_rwlock_wrlock
sa_thread_self
sa_tlsdata_get
sa_uds_getbasedomain
sa_uds_isspecialuseaddress
sa_uds_removealldomainsplits
sa_uds_removedomainsplit
sa_uds_removedomainsplits
sa_uds_removefiletype
sa_uds_removefiletypes
sa_uds_removehostingregex
sa_uds_removehostingregexes
sa_uds_removetld
sa_uds_removetlds
sa_uds_resolve
sa_uds_translateregex
sa_uds_updatedomainsplit
sa_uds_updatedomainsplits
sa_uds_updatefiletype
sa_uds_updatefiletypes
sa_uds_updatehostingregex
sa_uds_updatehostingregexes
sa_uds_updatetld
sa_uds_updatetlds
sa_unichar_isalpha
sa_unichar_iscombining
sa_unichar_isdigit
sa_unichar_islower
sa_unichar_isspace
sa_unichar_istitle
sa_unichar_isupper
sa_unichar_isxdigit
sa_unichar_todigit
sa_unichar_tolower
sa_unichar_totitle
sa_unichar_toupper
sa_unicode_decodepuny_string
sa_unicode_decodeutf8_char
sa_unicode_decodeutf8_string
sa_unicode_encodeutf8_char
sa_unicode_encodeutf8_string
sa_unicode_normalize_string
sa_util_crc32
sa_util_directoryexists
sa_util_fileexists
sa_util_fopen
sa_util_generateuuid
sa_util_getlocale
sa_util_getmacaddress
sa_util_getprivatelocation
sa_util_getprocessid
sa_util_getsharedlocation
sa_util_getuuid
sa_util_hexstring
sa_util_quicksort
sa_util_readline
sa_util_roundpow2
sa_util_sha1
sa_util_stringhex
sa_win32_maperrortoerrno
sacore_calloc
sacore_default_calloc
sacore_default_free
sacore_default_malloc
sacore_default_realloc
sacore_default_strdup
sacore_default_tlsalloc
sacore_default_tlsfree
sacore_default_tlsget
sacore_default_tlsset
sacore_free
sacore_malloc
sacore_realloc
sacore_strdup
sacore_tlsalloc
sacore_tlsfree
sacore_tlsget
sacore_tlsset

Sections

.text
Size: 648KB - Virtual size: 645KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_1_/sacoredata/uds_filetypes.txt
$_1_/sacoredata/uds_hosting.txt
$_1_/sacoredata/uds_tlds.txt
$_1_/signlic.txt
$_1_/sqlite3.dll
.dll windows:4 windows x86 arch:x86

e39dc569024e2bb048c8c01dc41b0a40

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:4a:36:1e:16:8a:81:a8:f3:ef:aa:da:33:25:08:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/09/2008, 00:00

Not After

09/10/2011, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:4f:3c:bc:98:44:44:b2:48:1b:3e:5d:a1:d9:f3:a0:7d:c9:2c:62
Signer

Actual PE Digest

07:4f:3c:bc:98:44:44:b2:48:1b:3e:5d:a1:d9:f3:a0:7d:c9:2c:62

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\SACore3\BUILD\SACore32\sqlite-amalgamation-3070701\RelWithDebInfo\sqlite3.pdb

Imports

kernel32

Sleep
InitializeCriticalSection
InterlockedCompareExchange
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
AreFileApisANSI
UnlockFile
LockFile
GetLastError
LockFileEx
UnlockFileEx
LoadLibraryA
LoadLibraryW
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTime
GetSystemTimeAsFileTime
LocalFree
FormatMessageA
FormatMessageW
SetFilePointer
CloseHandle
ReadFile
WriteFile
SetEndOfFile
FlushFileBuffers
GetFileSize
GetTempPathA
GetTempPathW
GetFileAttributesA
DeleteFileA
GetFileAttributesW
DeleteFileW
GetFileAttributesExW
GetFullPathNameA
GetFullPathNameW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
UnmapViewOfFile
CreateFileA
CreateFileW
GetSystemInfo
MapViewOfFile
CreateFileMappingA
HeapFree
HeapAlloc
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeZoneInformation
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
ExitProcess
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetACP
GetOEMCP
RtlUnwind
SetConsoleCtrlHandler
InterlockedExchange
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
HeapSize
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_complete
sqlite3_complete16
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_handle
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_sql
sqlite3_step
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf

Sections

.text
Size: 388KB - Virtual size: 385KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_34_/SecurityScanner.dll
.dll windows:5 windows x86 arch:x86

75b9f36d40cc1c98e71e3b881f8feb7a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/10/2011, 00:00

Not After

31/12/2013, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

85:ff:39:6f:91:9d:07:44:2d:6e:2e:7b:d4:b2:b9:56:23:05:ee:e8
Signer

Actual PE Digest

85:ff:39:6f:91:9d:07:44:2d:6e:2e:7b:d4:b2:b9:56:23:05:ee:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

secur32

GetUserNameExW

wininet

InternetQueryOptionA

kernel32

LoadLibraryW
Sleep
GetVersionExW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
GetACP
MultiByteToWideChar
GetLastError
GetCurrentDirectoryW
GetThreadLocale
GetProcAddress
GlobalFree
FindClose
GetPrivateProfileStringA
GetLocalTime
WritePrivateProfileStringA
RemoveDirectoryW
GetPrivateProfileStructA
FindNextFileW
DeleteCriticalSection
GetShortPathNameW
GetCurrentThreadId
ReleaseMutex
CloseHandle
DeleteFileW
GetCurrentProcessId
SetFileAttributesW
SetEvent
TerminateThread
CreateEventA
LeaveCriticalSection
SetCurrentDirectoryA
EnterCriticalSection
ResetEvent
LoadLibraryA
LocalAlloc
OpenEventA
WaitForMultipleObjects
GetModuleFileNameA
GetModuleHandleA
GetCurrentDirectoryA
GetVersionExA
GetVersion
LocalFree
GetModuleHandleW
GetPrivateProfileStringW
lstrlenW
IsBadReadPtr
SystemTimeToFileTime
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
lstrlenA
SetWaitableTimer
LoadLibraryExW
GetSystemWindowsDirectoryW
GetComputerNameW
WideCharToMultiByte
GetGeoInfoW
GetUserGeoID
CreateEventW
SetCurrentDirectoryW
CreateWaitableTimerW
EnumResourceLanguagesW
CreateThread
GetLocaleInfoW
GetCalendarInfoW
lstrcpynW
MulDiv
IsBadWritePtr
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
FindFirstFileExW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
GetTimeZoneInformation
GetStdHandle
ExitProcess
HeapCreate
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
GetConsoleMode
UnhandledExceptionFilter
TerminateProcess
LCMapStringW
GetCPInfo
GetFullPathNameW
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
GetSystemInfo
VirtualAlloc
VirtualProtect
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
InitializeCriticalSectionAndSpinCount
RaiseException
GetProcessHeap
HeapSize
GetSystemDirectoryW
GlobalAlloc
OpenProcess
InitializeCriticalSection
WriteFile
OutputDebugStringW
GetWindowsDirectoryA
InterlockedCompareExchange
WaitForSingleObject
CreateDirectoryW
GetCurrentProcess
InterlockedDecrement
MoveFileExW
InterlockedIncrement
CreateProcessW
FreeLibrary
VirtualQuery
GetLocaleInfoA
WritePrivateProfileStructA
SetFilePointer
FindFirstFileW
CreateMutexW
GetFileSize
CreateFileA
GetEnvironmentStringsW
QueryPerformanceCounter
GetDriveTypeW
SetEnvironmentVariableA
FlushFileBuffers
GetUserDefaultLCID
GetTickCount
GetConsoleCP
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
CompareStringW
SetEndOfFile
SetStdHandle
WriteConsoleW
IsValidLocale
EnumSystemLocalesA

user32

SetCapture
MsgWaitForMultipleObjects
GetDC
IsDialogMessageW
SetRect
ReleaseDC
GetDlgItem
GetDesktopWindow
SetWindowPos
LoadStringW
ShowWindow
CreateDialogParamW
ReleaseCapture
SetForegroundWindow
LoadImageW
GetClientRect
TranslateMessage
GetForegroundWindow
LoadIconW
BringWindowToTop
SystemParametersInfoW
PeekMessageW
MonitorFromWindow
MsgWaitForMultipleObjectsEx
GetLastInputInfo
MessageBoxW
GetSystemMetrics
IsWindowVisible
SendMessageW
GetMonitorInfoW
GetWindowThreadProcessId
GetWindow
DispatchMessageW
GetWindowRect
DestroyWindow
ClientToScreen
GetWindowInfo
wsprintfW

gdi32

GetDeviceCaps
SetBkMode
DeleteObject
GetObjectW
GetStockObject
CreateFontIndirectW

advapi32

CreateWellKnownSid
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
LookupAccountNameW
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
LookupAccountSidW
RegQueryValueExW
EqualSid
GetTokenInformation
OpenProcessToken

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetFolderPathW

ole32

CoGetClassObject
CoInitialize
CoUninitialize

oleaut32

SysAllocString
SysFreeString
SafeArrayGetLBound
VariantClear
CreateDispTypeInfo
VariantCopy
SysAllocStringByteLen
SafeArrayDestroy
VariantInit
VariantChangeType
SafeArrayGetElement
SysStringByteLen
SafeArrayGetUBound
CreateStdDispatch
SafeArrayCreate
SafeArrayPutElement

shlwapi

PathRemoveFileSpecW
PathAppendW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW

Exports

Exports

DoPersistAfterUninstall
IsEnterpriseEnvironment
LaunchAppAsUser
LaunchMcAfeeExe
OnAppAbort
OnAppInit
OnAppShutdown
OnBrowserInit

Sections

.text
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_34_/ftconfig.ini
uninstall.exe.nsis

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8Certificate

Extended Key Usages

Key Usages

cb:5c:89:82:9a:d1:91:95:51:fd:14:5e:bb:0a:94:df:1f:00:46:cfSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 72KB

.rsrc Size: 32KB - Virtual size: 31KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

75b9f36d40cc1c98e71e3b881f8feb7a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8Certificate

Extended Key Usages

Key Usages

85:ff:39:6f:91:9d:07:44:2d:6e:2e:7b:d4:b2:b9:56:23:05:ee:e8Signer

Headers

DLL Characteristics

File Characteristics

Imports

secur32

wininet

kernel32

user32

gdi32

advapi32

shell32

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

cb:5c:89:82:9a:d1:91:95:51:fd:14:5e:bb:0a:94:df:1f:00:46:cf
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 72KB

.rsrc
Size: 32KB - Virtual size: 31KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

85:ff:39:6f:91:9d:07:44:2d:6e:2e:7b:d4:b2:b9:56:23:05:ee:e8
Signer

.text
Size: 256KB - Virtual size: 256KB

.rdata
Size: 86KB - Virtual size: 85KB

.data
Size: 12KB - Virtual size: 23KB

.rsrc
Size: 96KB - Virtual size: 96KB

.reloc
Size: 22KB - Virtual size: 21KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate

b8:2d:a6:69:46:c2:73:cb:f4:1c:50:6e:65:68:f3:19:0b:6c:1c:17
Signer

.text
Size: 311KB - Virtual size: 311KB

.rdata
Size: 105KB - Virtual size: 104KB

.data
Size: 13KB - Virtual size: 21KB

.rsrc
Size: 10KB - Virtual size: 9KB

.reloc
Size: 25KB - Virtual size: 24KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

68:a5:c8:47:24:52:e9:8d:42:54:88:c3:98:1c:28:f8
Certificate