setup[.]zip | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

setup.zip
Size

23.9MB
MD5

4446b379278d2ca64882ec46015fc363
SHA1

460b05e7cfff86b484f657917ddc768cca2100e3
SHA256

9bff935ec8c2618fe262d931924c031e18eee550d9701e3cfb83c07918fd02ce
SHA512

923ad8a378a67198e5dbaabf9b94ca84d0ffac10f348f7e7c3d0a0b76717b3194556893a39dfc02038159cbaf5c5941573cb47bbee4598b02a410238092fcd1c
SSDEEP

393216:xvqrmxujE3K8U0y+t/nN3NZAv2ZV+jsmvGlAZlDhs5jiXhVeJFHVL/aRmuv3SLx4:srm84auySZLAv2LUMARs5jIVeJRF/aRn

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/Launcher.dll
unpack001/data/appInfo/services/Launhcer.dll
unpack001/data/appInfo/services/data/Launcher.dll

Files

setup.zip
.zip
Launcher.dll
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Launcher.exe
.exe windows:6 windows x86 arch:x86

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

18-09-2019 12:58

Not After

11-12-2022 11:53

Subject

CN=Adersoft,O=Adersoft,L=Paris,C=FR,1.2.840.113549.1.9.1=#0c14737570706f72744061646572736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 09:55

Not After

28-06-2032 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:fb:58:56:78:83:c0:9f:de:c5:ac:2a:33:b7:94:e6:e3:17:b1:5a:f9:ed:78:3e:8f:61:f7:67:75:db:dd:23
Signer

Actual PE Digest

03:fb:58:56:78:83:c0:9f:de:c5:ac:2a:33:b7:94:e6:e3:17:b1:5a:f9:ed:78:3e:8f:61:f7:67:75:db:dd:23

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleW
lstrcmpiW
MultiByteToWideChar
LoadLibraryExW
ExitProcess
LocalAlloc
LocalFree
FormatMessageW
WaitForSingleObject
GetExitCodeProcess
CreateThread
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
FindResourceExW
GetACP
WideCharToMultiByte
FreeResource
SetFilePointer
ReadFile
CreateFileW
CreateFileMappingW
MapViewOfFile
IsBadReadPtr
UnmapViewOfFile
GetCurrentProcessId
EnumResourceNamesW
GetFileAttributesW
GetFileSize
OpenEventW
SetEvent
ExpandEnvironmentStringsW
Sleep
FlushFileBuffers
GetFileType
WriteFile
WriteConsoleW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
CloseHandle
FindNextFileW
FindFirstFileExW
FindClose
GetFileSizeEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
LCMapStringW
GetStdHandle
GetModuleHandleExW
GetCommandLineW
GetCommandLineA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
SizeofResource
LockResource
LoadResource
FindResourceW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
HeapFree
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
FreeLibrary
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
IsValidCodePage

user32

UnregisterClassW
MessageBoxW
GetDlgItem
SetWindowPos
MapWindowPoints
GetClientRect
wsprintfA
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindowLongW
GetWindow
SetTimer
SendMessageW
GetParent
SetWindowTextW
CharNextW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
CreateWindowExW
DestroyWindow
LoadCursorW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
SetWindowLongW
DefWindowProcW
DialogBoxParamW
EndDialog
GetActiveWindow
KillTimer

advapi32

RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
CreateProcessWithLogonW
RegDeleteKeyW
RegCreateKeyExW

shell32

ShellExecuteW

ole32

CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoGetObject
CoGetInstanceFromFile
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoTaskMemFree

oleaut32

VariantCopy
VariantClear
SafeArrayUnaccessData
VariantChangeType
SafeArrayAccessData
SysAllocString
SysFreeString
VariantInit
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
LoadTypeLibEx
SysAllocStringLen

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CryptQueryObject

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Launcher.exe.manifest
data/014oU1vDDqJy
data/06nxowxyv2NX
data/0DLnoQJvQOVI
data/0d8FEgLJNkZ0
data/0iae67k9sRIz
data/0lNJtfGWyuxv
data/0tV6DkzxepxL
data/11lsz3K2ujqR
data/1IiGySF3hN0q
data/1k0wXoFJreDV
data/21tO7I2z0E6T
data/2G3hMt3RJ9mJ
data/2MpGlHmwonTF
data/2OEbTk7FiRUh
data/2OUTTFQw59ds
data/2U5XNmKnAjfy
data/2XXHyc7ZgLOo
data/2YWi2EnXTLhS
data/2aN4ZQZJCf5y
data/2myxgUZmbaA7
data/2nXvPRkHbFzZ
data/2r4n9QhggX8G
data/311K43f7NCLG
data/31LHh8gRZpFW
data/338fA236sZiM
data/38VTuLRhiGjB
data/3AquvveCxyMx
data/3M4fDMGe13vt
data/3O0pyqNl65O4
data/3gn8jyo4WwuP
data/3mXepl6yKibh
data/4BZnSAbca1Zb
data/4EwNLNeJcUA7
data/4G9ysiSHtlL2
data/4aqqOlWAiBK2
data/4br8WCXeZnzu
data/4o4kLJ4HNEJf
data/4qaENWn4RvZq
data/4wynQvHjpCM1
data/5CjnBtQoy5LP
data/5FtaG11peMcu
data/5In4pNMsPdfg
data/5JlZfBlbwc8J
data/5O2vXtw9AOFX
data/5YURkmwPV4yM
data/5b4oQOfk8AGa
data/5cY7cGOx2g8D
data/5pe0CyOTa47m
data/5r9u9epEViuD
data/5wWSTZ9DNyvT
data/6CHl53eAFQyj
data/6EyvnEzlfkqk
data/6UZaEeQVAb3f
data/6fWZ1kI90Jo7
data/6g9YHheqh9jW
data/6krRW0mcVYYY
data/6xOp3yPoXqkY
data/71lCjjVOpm60
data/7BEnS4duuByN
data/7Mi9dIky3Q1H
data/7QSjDA5cPcMP
data/7Rkgn605lrqY
data/7fcUKSLZQWpL
data/7glr3agjDEuH
data/7iFYoD4tnn6H
data/7keurDcqm6EV
data/7uAls6tui9Kd
data/7w05xcr06snS
data/7wgI4I26Vpsw
data/87FUAb9I9L7G
data/8AVcBmYHBIKI
data/8DxTwcnpClvH
data/8TrVKusgKHzN
data/8YjpCrccpVo2
data/8gdbaPackon7
data/8hTHIlIiIKOC
data/8hsAiKFucKH0
data/8jQHL9RyZnxN
data/8otdSVVMmPNi
data/95p8qm34aFgi
data/9Cg8FhJBjRtZ
data/9JdHKNt6qj94
data/9LBivYkk8GUu
data/9Wv59Ybokm8y
data/9Z51fQN4Ntk5
data/9n6kIXhA3SCN
data/9r9HJcbBtTML
data/9t9g5lF1WVmV
data/A1WpdWCRnytc
data/AEjRczTBkxrx
data/AHg9EZNrMuXW
data/ANcPcOqMrEjA
data/AQdhiq08WdEz
data/AZXlT8AYYB0P
data/AanG7Nu4CqTy
data/AjYoWRAUfDjV
data/AkiYG8PSzPSO
data/AnrEQLGselQD
data/Arj9tsgDnnZd
data/AwiY1BiKbTte
data/Ax521XxAPhtu
data/BGPAxElwCE3T
data/BIvJax0DdAfh
data/BIwUVHcZwFhv
data/BUs1zTZtqO0S
data/BdxT0bHM86kQ
data/BffPYi9SNLKi
data/BgoywCS88ld7
data/Bx0B3BL51bmb
data/C3k8c93aEwDs
data/CETvoRFPbkHF
data/CFhtPLiId8ZP
data/CUFANCgjKEgJ
data/CdRvOgvptMa6
data/CwU72cTtEMxh
data/D0UR3Qt6pz27
data/D0vXK4aOrBhj
data/D6g5HVldvJDR
data/DDamLwRtVJ1C
data/DDv7rCdB66k4
data/DNTPcLXCpdgc
data/DOKasG5BjqTN
data/DX3nfpeMSH9B
data/Dekx7HbLGxTX
data/DeufpoHy8tAc
data/DhPtvBG5tiLA
data/DifQNSieCmo6
data/Dj0spF2x7iy8
data/DjIr4rCe0lrj
data/DtX62zMHSPqF
data/EEYSxWxIEN2r
data/ETY1kPCjR3KG
data/EUxCcfwXH7bG
data/EVdRqFsvKe0y
data/EbaQxPD7CEmw
data/EepusDrZJ3lt
data/EzCbW0oqmvOe
data/F6wzhqXDCTZw
data/FLW3iF04qrEq
data/FhdXyBpxunjG
data/FlMIZA60av6v
data/FoCMfVRr2LlR
data/G6D0m0GHEA3g
data/GFOh1KxRymIS
data/GJtaVw9N0b3J
data/GJxyttdcZ8Kz
data/GKSGsclxwrAi
data/GUtFIq06kEuD
data/H50J8Wcw5A6v
data/HKfZ7wc3YnIN
data/HKttdKS44CX9
data/HTUUqY99b8go
data/HbOKf2lLTue5
data/HhQAourcKye4
data/HiFdOzXcfcDI
data/IEV6bVvWfyes
data/IhMNxLjLDUAJ
data/Ij49HJNyGiCS
data/JkUcJFAlqqZW
data/Jm7XPrg2xQpq
data/Jo8FGvR94JRC
data/JoghRp3tQgYs
data/Jos22bGVs978
data/Jx1lqXR0gOgD
data/K0XZs0Kok7Io
data/K4v0YjDiR4sB
data/KAMSIvyXNx4H
data/KARzJLNT3NXE
data/KCRpBUTHEJLg
data/KGEtXj6Aojwh
data/KPIbBrvckUsC
data/KQiiraCCQP8M
data/KkrvZZE7Ryw4
data/Koqixab2i3fm
data/KqFJECQVVxdK
data/aHnQFCczSe84
data/aPocLoLUt2fo
data/appInfo/KRYxZyGiTjwC
data/appInfo/KVifew3yiihf
data/appInfo/Kxfuo0fYjZwS
data/appInfo/L2O0DUdYOiCN
data/appInfo/LApAJbQPztVn
data/appInfo/LaKhE9bWrEgi
data/appInfo/LvVhCNlyXX3Z
data/appInfo/Lvz1m3ToZhZS
data/appInfo/M47rdxrTEAWo
data/appInfo/MD4yTtgF2aCx
data/appInfo/MEK9J6pn7kSK
data/appInfo/MIPNXeRfPckU
data/appInfo/MStzxMReS83h
data/appInfo/MYFWFjuDpBUr
data/appInfo/MfPcdEe57zJz
data/appInfo/NAVUC5aHOarA
data/appInfo/NBSGuk91wWUY
data/appInfo/NXUtCaP7MLTF
data/appInfo/NYCPsHsHtyXM
data/appInfo/NkyARdr35RR9
data/appInfo/NlqyDrjQ2LOr
data/appInfo/NsNUJBrDxcE4
data/appInfo/Nt2wPO9kgFW4
data/appInfo/NtbNWcJN6uPo
data/appInfo/Ntc26cLIIxiw
data/appInfo/O6oi3TrqVqFE
data/appInfo/OEDp3pVcyk4D
data/appInfo/OGnoiNhUl8wQ
data/appInfo/OaKLGKvicJSW
data/appInfo/Odl287RuYeI9
data/appInfo/Otl3eTW1CCuj
data/appInfo/Ovm98cQ1CqO2
data/appInfo/P3KLDeCbkHTH
data/appInfo/P3XGWc5b1zSD
data/appInfo/P3ukVLdIDkG6
data/appInfo/P4YE4KC7th1G
data/appInfo/PFAtdxo5BRBO
data/appInfo/PFfb5xak0bUB
data/appInfo/PGd2xeYRO7Yq
data/appInfo/PLJ21nS2NbO2
data/appInfo/PVx5J69YzfPr
data/appInfo/PkcK2dgqyZVa
data/appInfo/Pl1fLP3hGnyD
data/appInfo/PsrjTZybNVOE
data/appInfo/PvbVyPBUqCm9
data/appInfo/PxtWwELExF7A
data/appInfo/QKNfNpc9g4hE
data/appInfo/QQNQv9Shk9jS
data/appInfo/QQWK9gWnnvH7
data/appInfo/QbZOWwBzPzBa
data/appInfo/Qds0ghRWw9iG
data/appInfo/QeYscaQc2RD3
data/appInfo/Qo13bs99ty1m
data/appInfo/QsmkDnPH3l2G
data/appInfo/R1XZMVmzEAeO
data/appInfo/RGmd7yYckXRZ
data/appInfo/RHTNyoUejQY7
data/appInfo/RMPWBcWtw69y
data/appInfo/RQyzq4DPs6DR
data/appInfo/RYuTzxUpbpDg
data/appInfo/RaS9EG4PVF00
data/appInfo/RgSzajPX5anc
data/appInfo/RhtuALKARpNU
data/appInfo/RlUfscG0oNsF
data/appInfo/RqFfgF7L0TSa
data/appInfo/RtpvjIfRBap0
data/appInfo/SK97jzzd6bip
data/appInfo/SVYFUfdlQTsZ
data/appInfo/SVwABwDdzcrQ
data/appInfo/ScwQdaTncAT6
data/appInfo/ShawMdMYvQCE
data/appInfo/SsJLHftQEvnP
data/appInfo/SvIAG3FPzgYh
data/appInfo/SvtuxxvNC0I4
data/appInfo/T1U3ock0fbjV
data/appInfo/TZgnawvSdIag
data/appInfo/TdQ5jjiAk5pf
data/appInfo/TfP2tEhlv681
data/appInfo/TjsXNaFj0RG1
data/appInfo/TxZ6cJKPSllO
data/appInfo/UFfu0ytbTgRq
data/appInfo/UNFH1ukwebNw
data/appInfo/UTg8P25wbuTp
data/appInfo/UUCiqdR3KliM
data/appInfo/UqMzKrVz3cKr
data/appInfo/Usvj3hD4kLvf
data/appInfo/UyETAiT7nt3D
data/appInfo/V1yOYce313DU
data/appInfo/V2a2kZzQSsx7
data/appInfo/V9xCOOmX93Zh
data/appInfo/VAkTfwrXrOsj
data/appInfo/VJdkYzLYgXcK
data/appInfo/VN0wxfL4mSJ1
data/appInfo/VP7PZdDP78C4
data/appInfo/Va30tpdPhQQ5
data/appInfo/VetTiA2nmIMI
data/appInfo/VhQOHF3ISExC
data/appInfo/VnkTsgVTyhsq
data/appInfo/W3LEwod3c7ZF
data/appInfo/W6dPAzXVKv0A
data/appInfo/WBr94moxKkqa
data/appInfo/Wiq4VtyDwT3f
data/appInfo/WsjEpggpUAQz
data/appInfo/WwogAjGaBYVO
data/appInfo/X9B4JKflptEy
data/appInfo/X9rsecScjmGd
data/appInfo/XE1r4IjCvj3Z
data/appInfo/XHWfBEDIr6vj
data/appInfo/XIaDzoyIQwJr
data/appInfo/XJti9F5qvTVp
data/appInfo/XXzJNItePzqI
data/appInfo/XcF3grBIFAWe
data/appInfo/XpBerhBqv4tK
data/appInfo/YC79BdP5wLV5
data/appInfo/YHEw5Ble9pCW
data/appInfo/YIx8wpZjZ5wG
data/appInfo/YOgJNrMVug2M
data/appInfo/YPAFaQqDtzOt
data/appInfo/YXgXzbV9eGKU
data/appInfo/YhQxW3BUttOy
data/appInfo/YlpML4a3on0u
data/appInfo/Yxarrgevpg2O
data/appInfo/Z1RQDjQXRbLZ
data/appInfo/ZMluxfldUJmW
data/appInfo/ZYGrB135H2mI
data/appInfo/ZeoDxusiRe0F
data/appInfo/ZgTnv4Hic8R2
data/appInfo/ZjPvNjHfPFZT
data/appInfo/kRMOhVrx8aEG
data/appInfo/l5bTdTfEztkQ
data/appInfo/lI9KrSqls8AK
data/appInfo/lQiNm7mwtX5e
data/appInfo/lUa520TawYg4
data/appInfo/lVaQH6aFdtPY
data/appInfo/laPwdAnhBeXY
data/appInfo/lggum2NFzDH0
data/appInfo/lv0VwR8Vr4v7
data/appInfo/m9z8prHLkH3x
data/appInfo/mBF1M0SPHhYT
data/appInfo/mCxBrmoLrsxX
data/appInfo/mHdnDPwVpkwN
data/appInfo/mNKn8LrQSRLn
data/appInfo/mgYXDqIXFBNn
data/appInfo/moysihT3jB6V
data/appInfo/mpi1NFGxMd9F
data/appInfo/msxqNCPpwBqp
data/appInfo/nEbU70BPCPeF
data/appInfo/nL2zmFENNaut
data/appInfo/nLSVGTpGubxF
data/appInfo/nOIiBTqCs2xy
data/appInfo/ndhbvJKIJKd7
data/appInfo/noIRjELHJPWz
data/appInfo/noYDPZVVr9Uc
data/appInfo/o52QiGDRq7rN
data/appInfo/oFrw8KLDLQpn
data/appInfo/oLFUd8S7660T
data/appInfo/oM8VwiIcRXK8
data/appInfo/oZiWwmsUaOTk
data/appInfo/oarQpssh4GPD
data/appInfo/ocoTrlD9G9w7
data/appInfo/ojwE66gCs5q6
data/appInfo/pE7ZF4CJxzPD
data/appInfo/pITFat8BZD72
data/appInfo/pb5pjfp5AFst
data/appInfo/piAm657GNhyo
data/appInfo/pt3mTkmZM8xO
data/appInfo/q1MPEjycL3TQ
data/appInfo/qAkXiaIEpMBh
data/appInfo/qG63WUWsQBnA
data/appInfo/qIVt2np3saB9
data/appInfo/qLeatLjCInup
data/appInfo/qUF2jc6pa0Ad
data/appInfo/qXl8UosuvdGS
data/appInfo/qZMM9e5RiDzR
data/appInfo/qZqmoJkYVBg3
data/appInfo/qi3mHtv57tJR
data/appInfo/qifvQfFm3SLA
data/appInfo/qirXXY6kl686
data/appInfo/qqT11uZ5PirZ
data/appInfo/r0QN3eOY5nL7
data/appInfo/r73aTwpK1JLQ
data/appInfo/rNckp4nL6ZlU
data/appInfo/rOtmlsFc0sLv
data/appInfo/rTPzXhATStrE
data/appInfo/rU8PBZ60ryL7
data/appInfo/rm1znOMTd6m3
data/appInfo/rpWEBEjYAQxU
data/appInfo/rqmLFtbovq7y
data/appInfo/sNwPJUPNhf5p
data/appInfo/services/Launhcer.dll
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
data/appInfo/services/Launhcer.exe
.exe windows:6 windows x86 arch:x86

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

18-09-2019 12:58

Not After

11-12-2022 11:53

Subject

CN=Adersoft,O=Adersoft,L=Paris,C=FR,1.2.840.113549.1.9.1=#0c14737570706f72744061646572736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 09:55

Not After

28-06-2032 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b1:2c:12:6f:38:81:22:3b:4b:eb:ee:5a:25:d8:c4:d1:03:ac:88:dd:95:a1:f9:d2:d7:1a:c0:b8:bd:2d:9b:73
Signer

Actual PE Digest

b1:2c:12:6f:38:81:22:3b:4b:eb:ee:5a:25:d8:c4:d1:03:ac:88:dd:95:a1:f9:d2:d7:1a:c0:b8:bd:2d:9b:73

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleW
lstrcmpiW
MultiByteToWideChar
LoadLibraryExW
ExitProcess
LocalAlloc
LocalFree
FormatMessageW
WaitForSingleObject
GetExitCodeProcess
CreateThread
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
FindResourceExW
GetACP
WideCharToMultiByte
FreeResource
SetFilePointer
ReadFile
CreateFileW
CreateFileMappingW
MapViewOfFile
IsBadReadPtr
UnmapViewOfFile
GetCurrentProcessId
EnumResourceNamesW
GetFileAttributesW
GetFileSize
OpenEventW
SetEvent
ExpandEnvironmentStringsW
Sleep
FlushFileBuffers
GetFileType
WriteFile
WriteConsoleW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
CloseHandle
FindNextFileW
FindFirstFileExW
FindClose
GetFileSizeEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
LCMapStringW
GetStdHandle
GetModuleHandleExW
GetCommandLineW
GetCommandLineA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
SizeofResource
LockResource
LoadResource
FindResourceW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
HeapFree
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
FreeLibrary
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
IsValidCodePage

user32

UnregisterClassW
MessageBoxW
GetDlgItem
SetWindowPos
MapWindowPoints
GetClientRect
wsprintfA
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindowLongW
GetWindow
SetTimer
SendMessageW
GetParent
SetWindowTextW
CharNextW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
CreateWindowExW
DestroyWindow
LoadCursorW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
SetWindowLongW
DefWindowProcW
DialogBoxParamW
EndDialog
GetActiveWindow
KillTimer

advapi32

RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
CreateProcessWithLogonW
RegDeleteKeyW
RegCreateKeyExW

shell32

ShellExecuteW

ole32

CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoGetObject
CoGetInstanceFromFile
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoTaskMemFree

oleaut32

VariantCopy
VariantClear
SafeArrayUnaccessData
VariantChangeType
SafeArrayAccessData
SysAllocString
SysFreeString
VariantInit
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
LoadTypeLibEx
SysAllocStringLen

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CryptQueryObject

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/appInfo/services/Launhcer.exe.manifest
data/appInfo/services/WinRAR.exe
.exe windows:5 windows x86 arch:x86

93d6ffbeb6eb5774e72f7a9d4e82b889

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-06-2017 00:00

Not After

01-06-2020 23:59

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-06-2017 00:00

Not After

01-06-2020 23:59

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9b:89:b1:5c:05:2f:38:7e:09:3a:9b:ba:f5:18:32:e8:d1:da:b9:ba:5f:c1:9b:a2:77:d0:7f:99:b8:79:42:d7
Signer

Actual PE Digest

9b:89:b1:5c:05:2f:38:7e:09:3a:9b:ba:f5:18:32:e8:d1:da:b9:ba:5f:c1:9b:a2:77:d0:7f:99:b8:79:42:d7

Digest Algorithm

sha256

PE Digest Matches

true

98:17:ce:4e:f2:84:39:06:72:2c:9f:e2:57:6b:95:0b:7c:60:2e:bb
Signer

Actual PE Digest

98:17:ce:4e:f2:84:39:06:72:2c:9f:e2:57:6b:95:0b:7c:60:2e:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Projects\WinRAR\build\winrar32\Release\WinRAR.pdb

Imports

kernel32

DeviceIoControl
BackupRead
BackupSeek
GetShortPathNameW
GetLongPathNameW
GetFileType
GetStdHandle
FlushFileBuffers
GetFileTime
GetDiskFreeSpaceExW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
LoadResource
SizeofResource
FindResourceW
LoadLibraryExW
CompareStringA
GetCurrentThread
SetThreadPriority
SetThreadExecutionState
CreateEventW
GetSystemDirectoryW
SetCurrentDirectoryW
GetFullPathNameA
SetPriorityClass
GetProcessAffinityMask
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
CreateSemaphoreW
GetSystemTime
TzSpecificLocalTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
WideCharToMultiByte
CompareStringW
GetModuleHandleExW
GetCompressedFileSizeW
EnumResourceNamesW
EnumResourceLanguagesW
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
GetLocaleInfoW
GetNumberFormatW
GetLogicalDrives
LockResource
SuspendThread
ResumeThread
GetStartupInfoW
GetCurrentThreadId
FormatMessageW
CopyFileW
GetThreadPriority
SetErrorMode
GetPriorityClass
WaitForMultipleObjects
MulDiv
CompareFileTime
FindNextChangeNotification
HeapSize
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetStringTypeW
WriteConsoleW
SetStdHandle
LCMapStringW
HeapReAlloc
GetModuleFileNameA
ExitProcess
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
QueryPerformanceFrequency
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
RtlUnwind
InitializeSListHead
QueryPerformanceCounter
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileInformationByHandle
GetLocalTime
FindCloseChangeNotification
FindFirstChangeNotificationW
ExpandEnvironmentStringsW
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FindNextFileW
GetDiskFreeSpaceW
CreateHardLinkW
SetLastError
DosDateTimeToFileTime
LocalFileTimeToFileTime
HeapFree
HeapAlloc
HeapDestroy
HeapCreate
DeleteFileW
SetFileAttributesW
CreateFileW
RemoveDirectoryW
CreateDirectoryW
LoadLibraryW
GetSystemTimeAsFileTime
SetFileTime
SetFilePointer
SetEndOfFile
ReadFile
WriteFile
GetFileSize
FreeLibrary
MoveFileW
GetTickCount
GetCPInfoExW
GetOEMCP
GetACP
GetVolumeInformationW
GetDriveTypeW
Sleep
GetCurrentProcessId
GetCurrentProcess
CreateMutexW
ReleaseMutex
GetLastError
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
DecodePointer
MultiByteToWideChar
GetVersionExA
GetModuleHandleW
GetProcAddress
GetTempPathW
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CloseHandle
WaitForSingleObject
GetCommandLineW
GetModuleFileNameW
GetDateFormatW
GetTimeFormatW
FindFirstFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
FindClose
Beep
GetFileAttributesW

user32

CopyImage
FindWindowExW
FillRect
MessageBoxW
CreateIcon
EnumWindows
SetForegroundWindow
IsCharAlphaW
FlashWindow
CopyRect
RegisterClassExW
GetSysColor
ValidateRect
DrawIconEx
LoadImageW
SystemParametersInfoW
GetSystemMenu
KillTimer
SetTimer
MessageBoxIndirectW
CharLowerW
ExitWindowsEx
CharLowerA
LoadStringW
GetWindow
SetProcessDefaultLayout
CharToOemBuffW
OemToCharBuffA
OemToCharA
GetComboBoxInfo
RedrawWindow
MessageBeep
CharToOemA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
PeekMessageW
GetScrollInfo
EnableMenuItem
CheckMenuItem
GetFocus
MoveWindow
GetClientRect
GetWindowTextLengthW
EndPaint
BeginPaint
UpdateWindow
AppendMenuW
DrawMenuBar
wsprintfW
ScreenToClient
ClientToScreen
CallWindowProcW
PtInRect
SetMenuItemInfoW
GetMenuItemInfoW
InsertMenuItemW
TrackPopupMenu
DeleteMenu
InsertMenuW
GetSubMenu
SetMenu
LoadMenuW
LoadAcceleratorsW
IsChild
RegisterClassW
PostQuitMessage
SetScrollRange
SetScrollPos
ScrollWindowEx
GetClipboardData
LoadIconW
RegisterWindowMessageW
CreateDialogParamW
PostThreadMessageW
IsDialogMessageW
GetIconInfo
CreateIconIndirect
FindWindowW
RemovePropW
GetPropW
SendMessageW
DefWindowProcW
CreateWindowExW
DestroyWindow
SetFocus
GetWindowTextW
GetWindowLongW
SetWindowLongW
SetWindowPos
GetWindowPlacement
SetWindowPlacement
IsWindowVisible
DialogBoxParamW
SetPropW
GetForegroundWindow
TranslateAcceleratorW
CreateDialogIndirectParamW
BringWindowToTop
GetMenuState
GetMenuItemID
GetLastActivePopup
DispatchMessageW
TranslateMessage
DestroyMenu
CreatePopupMenu
GetMenu
IsWindow
WaitForInputIdle
LoadCursorW
EndDialog
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
SendDlgItemMessageW
GetWindowRect
MapWindowPoints
GetParent
DestroyIcon
CheckDlgButton
PostMessageW
InvalidateRect
EnumChildWindows
GetClassNameW
ShowWindow
CharToOemBuffA
SetDlgItemInt
GetDlgItemInt
GetMessageW
GetMenuItemCount
GetWindowThreadProcessId
WindowFromPoint
SetCursor
GetKeyState
RegisterClipboardFormatW
SystemParametersInfoA
GetDesktopWindow
IntersectRect
GetCursorPos
SetWindowTextW
ReleaseDC
GetDC
GetSystemMetrics
EnableWindow
IsIconic
IsWindowEnabled
IsDlgButtonChecked
CharUpperW

gdi32

TextOutA
SetPixel
Rectangle
GetTextExtentPoint32W
CreateSolidBrush
CreateDIBSection
GetPixel
DPtoLP
StretchBlt
SetMapMode
GetMapMode
GetDeviceCaps
CreateCompatibleBitmap
CreateBitmap
ExtTextOutW
SetBkColor
DeleteDC
CreateCompatibleDC
BitBlt
GetObjectW
TextOutW
MoveToEx
SetTextColor
LineTo
CreatePen
GetTextFaceW
GetTextMetricsW
SelectObject
DeleteObject
CreateFontW

comdlg32

GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError
ChooseFontW

advapi32

AllocateAndInitializeSid
AccessCheck
OpenProcessToken
MapGenericMask
GetFileSecurityW
RegCloseKey
IsTextUnicode
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
CheckTokenMembership
FreeSid
DuplicateToken
SetFileSecurityW
GetSecurityDescriptorLength
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegOpenKeyExW

shell32

FindExecutableW
DragFinish
DragQueryFileW
Shell_NotifyIconW
DragAcceptFiles
ShellExecuteW
SHGetSpecialFolderLocation
SHAddToRecentDocs
SHFileOperationW
SHGetFolderPathW
ShellExecuteExW
SHBrowseForFolderW
SHGetMalloc
SHChangeNotify
SHGetDesktopFolder
SHGetFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW
ord100

ole32

RevokeDragDrop
RegisterDragDrop
OleUninitialize
OleInitialize
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemAlloc
CoInitializeEx
CoTaskMemFree
CoCreateInstance
OleSetClipboard
DoDragDrop

oleaut32

VariantClear
SysAllocString

shlwapi

StrCmpLogicalW
SHAutoComplete

powrprof

SetSuspendState

comctl32

CreateStatusWindowW
ImageList_Create
ImageList_ReplaceIcon
InitCommonControlsEx
PropertySheetW

uxtheme

IsThemeActive
IsAppThemed

gdiplus

GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipBitmapGetPixel
GdipBitmapSetPixel

msimg32

GradientFill

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 646KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 888KB - Virtual size: 888KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/appInfo/services/data/Launcher.dll
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
data/appInfo/services/data/Launcher.exe
.exe windows:6 windows x86 arch:x86

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

18-09-2019 12:58

Not After

11-12-2022 11:53

Subject

CN=Adersoft,O=Adersoft,L=Paris,C=FR,1.2.840.113549.1.9.1=#0c14737570706f72744061646572736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2021 09:55

Not After

28-06-2032 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20-02-2019 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:fb:58:56:78:83:c0:9f:de:c5:ac:2a:33:b7:94:e6:e3:17:b1:5a:f9:ed:78:3e:8f:61:f7:67:75:db:dd:23
Signer

Actual PE Digest

03:fb:58:56:78:83:c0:9f:de:c5:ac:2a:33:b7:94:e6:e3:17:b1:5a:f9:ed:78:3e:8f:61:f7:67:75:db:dd:23

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleW
lstrcmpiW
MultiByteToWideChar
LoadLibraryExW
ExitProcess
LocalAlloc
LocalFree
FormatMessageW
WaitForSingleObject
GetExitCodeProcess
CreateThread
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
FindResourceExW
GetACP
WideCharToMultiByte
FreeResource
SetFilePointer
ReadFile
CreateFileW
CreateFileMappingW
MapViewOfFile
IsBadReadPtr
UnmapViewOfFile
GetCurrentProcessId
EnumResourceNamesW
GetFileAttributesW
GetFileSize
OpenEventW
SetEvent
ExpandEnvironmentStringsW
Sleep
FlushFileBuffers
GetFileType
WriteFile
WriteConsoleW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
CloseHandle
FindNextFileW
FindFirstFileExW
FindClose
GetFileSizeEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
LCMapStringW
GetStdHandle
GetModuleHandleExW
GetCommandLineW
GetCommandLineA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
SizeofResource
LockResource
LoadResource
FindResourceW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
HeapFree
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
FreeLibrary
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
IsValidCodePage

user32

UnregisterClassW
MessageBoxW
GetDlgItem
SetWindowPos
MapWindowPoints
GetClientRect
wsprintfA
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindowLongW
GetWindow
SetTimer
SendMessageW
GetParent
SetWindowTextW
CharNextW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
CreateWindowExW
DestroyWindow
LoadCursorW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
SetWindowLongW
DefWindowProcW
DialogBoxParamW
EndDialog
GetActiveWindow
KillTimer

advapi32

RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
CreateProcessWithLogonW
RegDeleteKeyW
RegCreateKeyExW

shell32

ShellExecuteW

ole32

CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoGetObject
CoGetInstanceFromFile
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoTaskMemFree

oleaut32

VariantCopy
VariantClear
SafeArrayUnaccessData
VariantChangeType
SafeArrayAccessData
SysAllocString
SysFreeString
VariantInit
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
LoadTypeLibEx
SysAllocStringLen

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CryptQueryObject

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/appInfo/services/data/Launcher.exe.manifest
data/appInfo/services/wget.exe
.exe windows:4 windows x86 arch:x86

9d364237d29bd7c53899e2d70965daa7

Code Sign

70:3f:38:4b:e7:0a:dd:9e:6a:17:5d:f4:be:6e:02:fe
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

24-02-2021 00:00

Not After

24-02-2024 23:59

Subject

CN=Jernej Simončič,O=Jernej Simončič,STREET=Herbersteinova 29,L=Ljubljana,C=SI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:8d:da:4e:59:e5:fb:68:5d:37:c0:7c:ef:b5:5c:bf:64:26:7a:3d:04:ac:4d:09:38:b7:1d:6c:22:98:0c:00
Signer

Actual PE Digest

d0:8d:da:4e:59:e5:fb:68:5d:37:c0:7c:ef:b5:5c:bf:64:26:7a:3d:04:ac:4d:09:38:b7:1d:6c:22:98:0c:00

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEnumProvidersW
CryptExportKey
CryptGenRandom
CryptGetProvParam
CryptGetUserKey
CryptReleaseContext
CryptSetHashParam
CryptSignHashW
DeregisterEventSource
GetUserNameW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegisterEventSourceW
ReportEventW

bcrypt

BCryptGenRandom

crypt32

CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

kernel32

CloseHandle
ConvertFiberToThread
ConvertThreadToFiber
CreateDirectoryA
CreateDirectoryW
CreateEventA
CreateFiber
CreateFileA
CreateFileMappingA
CreateFileW
CreateHardLinkA
CreatePipe
CreateProcessA
CreateProcessW
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFiber
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FormatMessageA
FormatMessageW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetConsoleWindow
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesA
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileType
GetHandleInformation
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNamedPipeInfo
GetNumberOfConsoleInputEvents
GetPriorityClass
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetThreadLocale
GetTickCount64
GetTickCount
GetVersion
GetVersionExA
GetVolumeInformationW
GetWindowsDirectoryA
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsDBCSLeadByteEx
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
LockFileEx
MapViewOfFile
MoveFileExA
MultiByteToWideChar
OpenFileMappingA
PeekConsoleInputA
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleA
ReadConsoleW
ReadFile
ReleaseSemaphore
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleTitleA
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFilePointer
SetFilePointerEx
SetFileTime
SetLastError
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepEx
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnlockFile
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

__getmainargs
__initenv
__lconv_init
__mb_cur_max
__p___argv
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_access
_amsg_exit
_assert
_cexit
_chdir
_dup
_dup2
_environ
_errno
_chmod
_close
_exit
_fdopen
_filelengthi64
_fileno
_findclose
_fullpath
_get_osfhandle
_getch
_getcwd
_getmaxstdio
_getmbcp
_getpid
_gmtime64
_initterm
_iob
_isatty
_isctype
_localtime64
_lock
_lseeki64
_onexit
_open
_open_osfhandle
_pipe
_putenv
_read
_rmdir
_setmaxstdio
_setmode
_vsnwprintf
_strdup
_stricmp
_strnicmp
_sys_errlist
_sys_nerr
_telli64
_time64
_unlink
_unlock
_vscprintf
_vsnprintf
_waccess
_wfopen
_wopen
_write
abort
atoi
bsearch
calloc
clearerr
clock
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwrite
getc
getenv
isalnum
isalpha
iscntrl
isgraph
islower
isprint
ispunct
isspace
isupper
iswctype
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
localtime
gmtime
_mkdir
perror
puts
qsort
raise
rand
realloc
rewind
setbuf
setlocale
setvbuf
signal
srand
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
tmpfile
tolower
toupper
towlower
towupper
ungetc
vfprintf
time
wcscat
wcscmp
wcscpy
wcslen
wcsstr
wcstombs
_stat
_fstat
_findnext
_findfirst
_write
_strnicmp
_strdup
_setmode
_read
_putenv
_open
_lseek
_isatty
_getpid
_fileno
_dup
_close
_access

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize

shell32

SHGetSpecialFolderPathW

user32

DispatchMessageA
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage

ws2_32

WSAAddressToStringA
WSACleanup
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSASetLastError
WSASocketW
WSAStartup
WSAStringToAddressW
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
gethostname
getnameinfo
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 466KB - Virtual size: 465KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/14
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/appInfo/sfI6vwrUef7y
data/appInfo/sfr48RJsRRHA
data/appInfo/sihmY6QlDKcc
data/appInfo/sq59vMVDAeSA
data/appInfo/sxbuzYf4S2cX
data/appInfo/syhN6QLVY0sR
data/appInfo/t1stBib8LPLY
data/appInfo/tFJmHT3Pgzke
data/appInfo/tSbhSA8QawiX
data/appInfo/tUSbo3XihzcQ
data/appInfo/td30oukabCww
data/appInfo/tqcvY4MLmtRQ
data/appInfo/uQdV6ELCmFDo
data/appInfo/ub3ShuKZJ8vv
data/appInfo/ugkIMCxx3o3g
data/appInfo/ujF4PiHtTUgq
data/appInfo/ujKwynKndafv
data/appInfo/unrY2ge9RaHW
data/appInfo/urKQ0Al0EUdp
data/appInfo/uv7Bdm9B6ITw
data/appInfo/v5wucXfmywPe
data/appInfo/v9B1be2eoLYR
data/appInfo/vA1H7KQKaR77
data/appInfo/vR9N7wUQWz9m
data/appInfo/vSg3ercIQywz
data/appInfo/vYH1EClHcNVp
data/appInfo/vqoRjqLGjvw6
data/appInfo/vwi9nPLzdPir
data/appInfo/wBpp7PuzgZmm
data/appInfo/wLDuclufX5wC
data/appInfo/wT1qGVIhKlJX
data/appInfo/wUAwxdKFUvdI
data/appInfo/wbmdkQZrwz3G
data/appInfo/wwNfuAdd6WzD
data/appInfo/wxyqE1AieZWP
data/appInfo/xIIiw0WNWWvz
data/appInfo/xKved6XVxfUh
data/appInfo/xO8otQKxwATQ
data/appInfo/xbDJHVzLVzbJ
data/appInfo/xtKtFsF9MSUi
data/appInfo/xtdQc7T5jPL8
data/appInfo/xxm0W05c7UMo
data/appInfo/y3n72v8NcTAa
data/appInfo/yRPwcitpvmXb
data/appInfo/yRczYXGdbhdA
data/appInfo/yUVxWS6NNFNs
data/appInfo/yWQLYfSROyUE
data/appInfo/yYwaiKVFON8l
data/appInfo/yaJHvk6FJubX
data/appInfo/yeTYCLG69p5Z
data/appInfo/yhKgKs4bIfrj
data/appInfo/ykerH1vty4fN
data/appInfo/ysR9nHTPLrO7
data/appInfo/yuDleGsyyS4N
data/appInfo/yv84pOS0oKXN
data/appInfo/yxY9uqqFTb8P
data/appInfo/z2YOdta6ho3G
data/appInfo/zB7Lm6fbrEJw
data/appInfo/zF2bJlovnPjz
data/appInfo/zFjyNSiytZbp
data/appInfo/zdIYacIgigMT
data/appInfo/zi1S27KImRYP
data/appInfo/ziegsZAjJvqC
data/appInfo/zuNrHORxVzin
data/b0W1nQZN072m
data/b22xa8ysDx4T
data/b9U4gnrnI5DJ
data/bCtZ9LBWyLS8
data/bF6BpjRLOQgr
data/bHIMYSsdXlxb
data/bXybz6qvzeeA
data/bpsHnBm5sFDF
data/bus7W694Pb1P
data/c0dcwPn32apY
data/c5Ii5ucgTFIe
data/c9mPB7AR5BUy
data/cAWCaDHqb9Jw
data/caABk01i64cd
data/cfrO9pF0S4Y9
data/cx6bF479ctsO
data/czTTvm472O0J
data/d3d9VUdKRJ1q
data/d5fUY68N40xH
data/d7QlN3xJAAmP
data/d7XzknJky4Il
data/dELo0LLqETfT
data/dGNbxcSV7aYi
data/dHspJvPuDoxd
data/dQ39iZlqIfcg
data/dTKJmPeIDxsq
data/dUPqe8nrWc7J
data/db9QTeHpdY8f
data/ddpRxIcVim06
data/dhXJB0fBwqki
data/dpLSJaMW0bv9
data/drddUO4ziLqT
data/dvELFrq9obcl
data/eBkkFfE2Ow1V
data/eMOD3qs6Bd5d
data/ftieiNzeqMmT
data/fwFrts5f2Vc6
data/fzbVQv6ZhnTZ
data/g6c7VTFmsd5o
data/gePg0gv2PCTC
data/gpWlwZtMECDR
data/grRuO490nktw
data/h3CKKHyA0WPC
data/h4TWDU5fqRnO
data/h9vJFVPTmBhm
data/hM3cR3lW1Zyh
data/hRkqnhkfvZXo
data/hWL65Fsz3wex
data/hkRmqWPGrSjr
data/hm246rUXe1i7
data/hxRFZRaaochZ
data/hxZT7JFDqgVE
data/hxxT5URoiC9m
data/i2iqYy122ZHo
data/i5nb680r0E2O
data/iAkBfPsDmqUX
data/iFEsdcLY2PJf
data/iFOIrUKUwEXM
data/iKfVMbRCmXxu
data/ibuFyQoMvraK
data/iq3I6007KIkq
data/ixL9z4Vl1esK
data/j8cFffUpBr4b
data/jHOxFnOx91S2
data/jRNQDxZo7zkw
data/jbogvpGSnKMq
data/jkMuJV05gdwu
data/jo4bNEuNvo6V
data/jtJJO751RRUO
data/k0uQCdaGXMwi
data/kBC6g6KRVOWE
data/kEdAd4D1yhOt
data/kHf7FHW1ZIwS
data/kP2pEH9vbENF
data/kacZERAmpFmb
data/kld8Tfzafvet
data/kolT2ruBJWAI

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 140B

.rsrc Size: 2KB - Virtual size: 1KB

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8fCertificate

Extended Key Usages

Key Usages

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9fCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

03:fb:58:56:78:83:c0:9f:de:c5:ac:2a:33:b7:94:e6:e3:17:b1:5a:f9:ed:78:3e:8f:61:f7:67:75:db:dd:23Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

wintrust

crypt32

version

Sections

.text Size: 221KB - Virtual size: 220KB

.rdata Size: 68KB - Virtual size: 68KB

.data Size: 6KB - Virtual size: 12KB

.rsrc Size: 46KB - Virtual size: 46KB

.reloc Size: 11KB - Virtual size: 11KB

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 140B

.rsrc Size: 2KB - Virtual size: 2KB

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8fCertificate

Extended Key Usages

Key Usages

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9fCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

b1:2c:12:6f:38:81:22:3b:4b:eb:ee:5a:25:d8:c4:d1:03:ac:88:dd:95:a1:f9:d2:d7:1a:c0:b8:bd:2d:9b:73Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

.rdata
Size: 512B - Virtual size: 140B

.rsrc
Size: 2KB - Virtual size: 1KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

03:fb:58:56:78:83:c0:9f:de:c5:ac:2a:33:b7:94:e6:e3:17:b1:5a:f9:ed:78:3e:8f:61:f7:67:75:db:dd:23
Signer

.text
Size: 221KB - Virtual size: 220KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 6KB - Virtual size: 12KB

.rsrc
Size: 46KB - Virtual size: 46KB

.reloc
Size: 11KB - Virtual size: 11KB

.rdata
Size: 512B - Virtual size: 140B

.rsrc
Size: 2KB - Virtual size: 2KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

b1:2c:12:6f:38:81:22:3b:4b:eb:ee:5a:25:d8:c4:d1:03:ac:88:dd:95:a1:f9:d2:d7:1a:c0:b8:bd:2d:9b:73
Signer

.text
Size: 221KB - Virtual size: 220KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 6KB - Virtual size: 12KB

.rsrc
Size: 46KB - Virtual size: 46KB

.reloc
Size: 11KB - Virtual size: 11KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

9b:89:b1:5c:05:2f:38:7e:09:3a:9b:ba:f5:18:32:e8:d1:da:b9:ba:5f:c1:9b:a2:77:d0:7f:99:b8:79:42:d7
Signer

98:17:ce:4e:f2:84:39:06:72:2c:9f:e2:57:6b:95:0b:7c:60:2e:bb
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 104KB - Virtual size: 103KB

.data
Size: 17KB - Virtual size: 646KB

.gfids
Size: 512B - Virtual size: 248B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 888KB - Virtual size: 888KB

.reloc
Size: 53KB - Virtual size: 53KB