c8172e64861bb97e51fc9b5543ba55fe_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

c8172e64861bb97e51fc9b5543ba55fe_JaffaCakes118
Size

12.4MB
MD5

c8172e64861bb97e51fc9b5543ba55fe
SHA1

648cf3e381ac61f8b6bfc8129546f8adfd85af37
SHA256

a6e5a8a215a0dc10694aea0b7f38f48793fec4310df633d9fa91038e29bfe626
SHA512

6204aa4ca50bce92916a8a4825101391a4abf76e5cd8a8eca2cdd4c80bfb461d176711e1878d9c5ab0f13fc509372655925938d7d2d780671c5ed61571f3498d
SSDEEP

196608:YDxyHasJ4mcdeFdLAiqolsWoVsOaJFFUSrNGngbFQ59wb4tiVXNWBRpuR:YFGJ5cdeF+ifyyHPrqgbaTCPWBDuR

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	upx

Unsigned PE 13 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/ButtonEvent.dll
unpack001/$PLUGINSDIR/MyNsisExtend.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsRandom.dll
unpack002/out.upx
unpack001/$TEMP/$_9_/MyNsisSkin.dll
unpack001/7za.exe
unpack001/Greening.dll
unpack001/NsisPlugin.dll
unpack001/aq7z.dll
unpack001/aqhttp.dll
unpack001/Խ֮ǹ޵а.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

c8172e64861bb97e51fc9b5543ba55fe_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e160ef8e55bb9d162da4e266afd9eef3

Code Sign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-07-1999 18:31

Not After

09-07-2019 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

18:fd:a0:51:a2:db:0a:97:a2:90:46:3e:07:a4:27:41
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

30-03-2015 05:15

Not After

30-03-2016 06:15

Subject

CN=津市市瓦力网络技术有限公司,O=津市市瓦力网络技术有限公司,L=常德市,ST=湖南省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-07-1999 18:31

Not After

09-07-2019 18:40

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
Sleep
CloseHandle
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
SetErrorMode
GetCommandLineA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary

user32

CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA

advapi32

RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ButtonEvent.dll
.dll windows:4 windows x86 arch:x86

0ece15e7d9bb35972aec701f46192460

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GlobalAlloc
lstrcpyA
lstrcpynA
GlobalFree

user32

PostMessageA
CallWindowProcA
GetDlgItem
FindWindowExA
SetWindowLongA
wsprintfA

Exports

Exports

AddEventHandler
Unload
UnsetEventHandler
WhichButtonId

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/MyNsisExtend.dll
.dll windows:4 windows x86 arch:x86

0b0f6f2578ce650dcdda31f442fb709d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\svn\GameMgr_trunk\build_temp\Win32\compile\release_staticA2\tool\GMNsisExtend\MyNsisExtend.pdb

Imports

shlwapi

PathSkipRootA
PathCombineA
StrStrIA

wininet

InternetOpenA
InternetSetOptionA
InternetOpenUrlA
InternetConnectA
InternetSetFilePointer
HttpOpenRequestA
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetCloseHandle

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

psapi

GetModuleFileNameExA

kernel32

GetCommandLineA
MoveFileA
DeleteFileA
FindNextFileA
FindFirstFileA
SetEvent
Sleep
ResetEvent
CreateEventA
ReadFile
GetFileSize
CreateFileA
SetEndOfFile
WriteFile
SetFilePointer
lstrlenA
GetPrivateProfileStringA
WritePrivateProfileStringA
CloseHandle
GetPrivateProfileIntA
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
lstrcmpiA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDriveStringsA
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
GetLastError
CreateProcessA
OpenProcess
DisableThreadLibraryCalls
GetFileAttributesA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MoveFileExA
lstrcmpA
CreateFileW
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentThreadId
ResumeThread
GetTickCount
LoadLibraryA
GetProcAddress
FreeLibrary
Module32First
Process32Next
Process32First
Module32Next
CreateToolhelp32Snapshot
SetFileAttributesA
CreateDirectoryA
RemoveDirectoryA
CopyFileA
GetProcessHeap
ExpandEnvironmentStringsA
SetEnvironmentVariableA
GetVersion
DeviceIoControl
GetFullPathNameA
SearchPathA
GetFileInformationByHandle
GetTempFileNameA
GetTempPathA
GetFileSizeEx
SetCurrentDirectoryA
SetFileTime
GetWindowsDirectoryA
GetCurrentDirectoryA
GetLongPathNameA
GetSystemDirectoryA
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
GetSystemInfo
lstrcatA
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionA
GetFileTime
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
ExitProcess
GetTimeZoneInformation
HeapAlloc
GetStdHandle
HeapReAlloc
VirtualAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
LCMapStringW
LCMapStringA
GetCurrentThread
SetLastError
TlsFree
TlsSetValue
TlsAlloc
GetDateFormatA
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSection
SetConsoleCtrlHandler
GetLocaleInfoW
InterlockedExchange
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CompareStringA
CompareStringW
ExitThread
CreateThread
GetCPInfo
FindClose
InterlockedCompareExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
HeapFree
RtlUnwind
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
RaiseException
InterlockedIncrement

user32

GetClassNameA
wsprintfA
SendMessageA
CreateWindowExA
ShowWindow
GetWindowRect
GetWindowLongA
SystemParametersInfoA
IsWindowVisible
AttachThreadInput
SetWindowTextA
MapWindowPoints
GetForegroundWindow
IsIconic
SetWindowPos
GetWindow
IsChild
GetWindowTextA
IsZoomed
GetClientRect
GetWindowTextLengthA
GetSystemMetrics
GetActiveWindow
GetDlgItem
GetParent
LoadStringW
EnumThreadWindows
SetForegroundWindow
SendMessageTimeoutA
GetWindowThreadProcessId
KillTimer
SetTimer
GetDC
DrawTextA
ReleaseDC

gdi32

SelectObject
CreateFontA

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegQueryValueExA
RegLoadKeyA
RegSetValueExA
RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
RegSaveKeyA
RegDeleteValueA
RegRestoreKeyA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegQueryInfoKeyA
FreeSid

shell32

ShellExecuteA
SHGetSpecialFolderPathA
SHGetFolderPathA
ShellExecuteExA
SHBrowseForFolderA
SHGetPathFromIDListA

ole32

CoUninitialize
CoInitialize
CoInitializeEx
CoCreateInstance

oleaut32

SysFreeString
SysAllocString

Exports

Exports

AddExistAdvertID
AddInsAdvertID
AddStatExtendParams
AddToFirewall
AllHomePageChecksOut
ChangeInstDirtoMax
Check360Install
CheckHomeState
CheckInstallLimit
CheckInstalled
CheckKuaibaInstalled
ConvertSoftInstallTime
CreateShortcut
CreateTimer
DestroyTimer
Exec
ExecWait
ForceDeleteFile
Get360InstallState
Get7zOriginalSize
GetAdvertFileName
GetAdvertID
GetAdvertIDEx
GetAdvertIcon
GetAdvertLocalFile
GetAdvertName
GetAdvertUrl
GetBaiduHomePageURL
GetChoiceResult
GetChromeHomePageURL
GetExeFileNameFromUrl
GetForceAdvertFileName
GetForceAdvertID
GetForceAdvertIDEx
GetForceAdvertLocalFile
GetForceAdvertName
GetForceAdvertUrl
GetHomePageName
GetHomePageName2
GetIEHomePageURL
GetSingleFileSize
GetSougouHomePageURL
GetSpecialBuild
GetSubChannel
HideAllAdvert
HomePageChecksOut
Init
InitAdvert
InitPopUpInfo
InstallAdvert
InstallAllAdvert
IsAdvertExist
IsAdvertInstalled
IsAutoRun
IsCurrHomePageURL
IsHomePageForced
IsLastDownloadSuccessed
LoadEncrypedXML
LoadEncrypedXMLFromUrl
LoadEncrypedXMLFromUrlEx
LoadXMLBufferFromUrl
LoadXMLFromUrl
LoadXml
OpenUrl
PinToTaskbar
PopUp
PopupAD
SendExitInstallStat
SendResearchResult
SetAllHomePage
SetChoice
SetHomePage
SetHomePageUrl
SetUnGameList
ShowAdvert
TaskKillByHwnd
TaskKillByWindow
UnPinFromTaskBar
UpdateAllAdvertChoice

Sections

.text
Size: 868KB - Virtual size: 865KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 851B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 610B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

38e7b5c3ee58b43a91f9679e94aabd09

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc

user32

DestroyWindow
CallWindowProcA
SetCursor
GetPropA
CharPrevA
MapWindowPoints
DrawFocusRect
GetWindowLongA
GetClientRect
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
LoadCursorA
RemovePropA
DrawTextA

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsRandom.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetRandom

Sections

UPX0
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 73B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/$_9_/GMSkin_Image_2012_v1.zip
.zip
skin.xml
skin/Thumbs.db
skin/icon1.png
.png
skin/保存目录.png
.png
skin/关闭.png
.png
skin/协议背景.png
.png
skin/卸载完成.png
.png
skin/卸载完成按钮.png
.png
skin/卸载背景.png
.png
skin/取消.png
.png
skin/图片背景框.png
.png
skin/多选.png
.png
skin/多选2.png
.png
skin/安装.png
.png
skin/安装01.png
.png
skin/安装02.png
.png
skin/安装03.png
.png
skin/安装04.png
.png
skin/安装协议.png
.png
skin/安装完成.png
.png
skin/安装完成按钮.png
.png
skin/完成.png
.png
skin/广告关闭.png
.png
skin/底部背景.png
.png
skin/开始安装.png
.png
skin/按钮.png
.png
skin/最小化.png
.png
skin/最小化2.png
.png
skin/格子.png
.png
skin/欢迎.png
.png
skin/浏览.png
.png
skin/游戏弹出.png
.png
skin/立即卸载.png
.png
skin/软件弹出.png
.png
skin/进度条.png
.png
skin/进度条背景.png
.png
skin/退出.png
.png
skin/选项.png
.png
skin/默认背景.png
.png
$TEMP/$_9_/MyNsisSkin.dll
.dll windows:4 windows x86 arch:x86

8b2c18b411d31cbef33f61e5be07509a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVN\v2.2\install\build\MSVC.2005\Tool\GMSkin\release_static2\MyNsisSkin.pdb

Imports

msimg32

TransparentBlt
AlphaBlend

kernel32

DosDateTimeToFileTime
CreateDirectoryW
GetCurrentDirectoryW
SetFileTime
WriteFile
SetEndOfFile
GetLastError
GetFileTime
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
SystemTimeToFileTime
InitializeCriticalSection
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetModuleFileNameA
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
GetCurrentProcess
DuplicateHandle
GetFileType
SetFilePointer
WideCharToMultiByte
lstrcpyW
GetCurrentThreadId
MulDiv
lstrcatW
CreateFileW
GetFileSize
CreateFileA
ReadFile
CloseHandle
MultiByteToWideChar
lstrcmpiW
DisableThreadLibraryCalls
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
HeapCreate
HeapDestroy
RaiseException
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapReAlloc
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
Sleep
HeapSize
ExitProcess

user32

ScreenToClient
ClientToScreen
UpdateWindow
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
SetWindowTextW
CharNextW
InvalidateRect
EnumChildWindows
SetCapture
ReleaseCapture
ShowWindow
SetWindowRgn
OffsetRect
wsprintfW
GetSystemMetrics
SetWindowPos
GetSystemMenu
GetMenuItemInfoW
PostMessageW
PtInRect
SetTimer
GetClassNameW
GetParent
MapWindowPoints
SetPropW
CallWindowProcW
GetPropW
DefWindowProcW
GetClientRect
GetWindowRect
IsWindow
GetWindowLongW
LoadCursorW
SetCursor
TrackMouseEvent
BeginPaint
EndPaint
IsWindowEnabled
GetWindowTextW
SendMessageW
DrawTextW
SetWindowLongW
GetCursorPos
KillTimer

gdi32

CreatePen
SetStretchBltMode
StretchBlt
CreateFontIndirectW
CreateDIBSection
SetBkColor
CreateSolidBrush
CreateRoundRectRgn
RoundRect
GetStockObject
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
SetBkMode
SetTextColor
BitBlt
DeleteObject

oleaut32

SysFreeString

Exports

Exports

AddShowImage
AddShowImageFromFile
AddShowText
ClearAllShow
DelShowImage
DelShowText
InitSkin
SetBkImage
SetBtnImage
SetCloseBtnImage
SetEditBkColor
SetProgressBKImage
SetProgressImage
SetProgressTextWindow
SetTextClr
SetWindowID
SlideOff
SlideOn

Sections

.text
Size: 260KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/$_9_/game.jpg
.jpg
7za.exe
.exe windows:4 windows x86 arch:x86

15847eb10d7d06dcd5980e8a9b786fd6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysAllocString
SysAllocStringByteLen
VariantClear
VariantCopy
SysFreeString

user32

CharLowerA
CharUpperA
CharLowerW
CharPrevExA
CharNextA
CharUpperW

kernel32

SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetConsoleCtrlHandler
FileTimeToLocalFileTime
GetCommandLineW
SetFileApisToOEM
GetVersionExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
SetConsoleMode
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
GetLastError
FreeLibrary
LoadLibraryA
AreFileApisANSI
GetModuleFileNameA
LocalFree
FormatMessageA
FormatMessageW
GetWindowsDirectoryA
GetWindowsDirectoryW
CloseHandle
SetFileTime
CreateFileW
SetLastError
SetFileAttributesA
RemoveDirectoryA
MoveFileA
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
lstrlenA
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryA
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryW
SearchPathA
SearchPathW
GetTempPathA
GetTempPathW
GetTempFileNameA
GetTempFileNameW
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
CreateFileA
GetFileSize
SetFilePointer
DeviceIoControl
ReadFile
WriteFile
GetCurrentProcess
GetProcAddress
CompareFileTime
FileTimeToSystemTime
GetSystemInfo
GlobalMemoryStatus
GetModuleHandleA
DosDateTimeToFileTime
FileTimeToDosDateTime
SystemTimeToFileTime
GetSystemTime
WaitForMultipleObjects
OpenEventA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetTickCount
GetProcessTimes
LocalFileTimeToFileTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
VirtualAlloc
VirtualFree
WaitForSingleObject
CreateEventA
SetEvent
ResetEvent
CreateSemaphoreA
ReleaseSemaphore
InitializeCriticalSection
RtlUnwind
RaiseException
HeapAlloc
HeapFree
HeapReAlloc
CreateThread
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
ExitProcess
TlsAlloc
SetUnhandledExceptionFilter
TerminateProcess
HeapSize
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
SetHandleCount
GetFileType
GetStartupInfoA
FlushFileBuffers
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
InterlockedDecrement
InterlockedIncrement
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetCPInfo
GetACP
GetOEMCP

Sections

.text
Size: 483KB - Virtual size: 483KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExeConfig.ini
Greening.dll
.dll windows:6 windows x86 arch:x86

66dd4cd47a25ca4dda9367864f4c1913

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\Work\Public\Greening\Temp\Greening\Release\Greening.pdb

Imports

kernel32

OutputDebugStringW
WriteFile
WideCharToMultiByte
CreateProcessA
TerminateProcess
MultiByteToWideChar
lstrlenW
WaitForSingleObject
GetLastError
GetProcAddress
GetPrivateProfileStringA
LoadLibraryA
GetModuleFileNameA
OutputDebugStringA
CloseHandle
FreeLibrary
VirtualQuery
CreateDirectoryA
CreateFileA
SetEndOfFile
CreateFileW
SetStdHandle
HeapReAlloc
GetConsoleCP
FlushFileBuffers
LoadLibraryExW
SetFilePointerEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStringTypeW
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
ReadFile
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
RtlUnwind
RaiseException
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
AreFileApisANSI
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
GetConsoleMode
ReadConsoleW

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteExA
SHGetPathFromIDListA
SHGetFolderLocation

shlwapi

PathRemoveFileSpecA
PathFileExistsA
PathStripPathA
PathIsDirectoryA
PathAddBackslashA
StrCpyW

aqhttp

AQHTTP_Get
AQHTTP_DownloadFile
AQHTTP_Free

Exports

Exports

FixFromConfig
ParseConfig
SetCallbackProc
UpdateConfig

Sections

.text
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NsisPlugin.dll
.dll windows:6 windows x86 arch:x86

805da0dd95417c54a738367388b73e70

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\Work\Public\FyNsisPlugin\Temp\NsisPlugin\Release\NsisPlugin.pdb

Imports

kernel32

ReadProcessMemory
GetProcAddress
VirtualAllocEx
CloseHandle
WriteProcessMemory
VirtualFreeEx
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
OutputDebugStringW
OpenProcess
GetModuleHandleW
WriteConsoleW
GetCurrentProcess
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetCommandLineA
GetCurrentThreadId
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetLastError
SetLastError
MultiByteToWideChar
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
HeapSize
HeapFree
RaiseException
HeapAlloc
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
LCMapStringW
WriteFile
GetModuleFileNameW
LoadLibraryExW
HeapReAlloc
RtlUnwind
CreateFileW

user32

GetWindowLongW
SetWindowLongW
FindWindowExW
SendMessageW
GetWindowThreadProcessId
FindWindowW

advapi32

LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges

Exports

Exports

IsAscii
SamePath
SwapDesktopIcon

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
aq7z.dll
.dll windows:6 windows x86 arch:x86

c754325baab3e30ae04ade81a19fded9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Administrator\Desktop\aq7z\Temp\aq7z\Release\aq7z.pdb

Imports

shlwapi

PathAppendW
PathAddBackslashW
PathRemoveFileSpecW

kernel32

SetUnhandledExceptionFilter
CreateFileW
FlushFileBuffers
OutputDebugStringW
VirtualQuery
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
GetModuleFileNameW
EncodePointer
DecodePointer
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
HeapSize
HeapFree
HeapAlloc
SetLastError
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
CloseHandle
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
HeapReAlloc
LCMapStringW
SetStdHandle
WriteConsoleW
GetStringTypeW

Exports

Exports

ExtractArchive

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
aqhttp.dll
.dll windows:6 windows x86 arch:x86

9e6113e08a4e737e8d9ed8a18fecdd0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Administrator\Desktop\aqhttp\Temp\aqhttp\Release\aqhttp.pdb

Imports

shlwapi

PathAddBackslashW
PathIsRootW
PathCombineW
PathRemoveExtensionW

ws2_32

WSAStartup
WSACleanup
getaddrinfo
freeaddrinfo
getpeername
WSAIoctl
connect
ioctlsocket
ntohs
getsockname
setsockopt
recv
bind
socket
WSASetLastError
closesocket
getsockopt
WSAGetLastError
__WSAFDIsSet
select
send
htons

kernel32

GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
OutputDebugStringW
GetStringTypeW
LCMapStringW
CompareStringW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
MoveFileExW
WideCharToMultiByte
CreateFileW
MultiByteToWideChar
GetTempPathW
GetFileSizeEx
CloseHandle
DeleteFileW
InitializeCriticalSection
LeaveCriticalSection
GetLastError
SetLastError
EnterCriticalSection
DeleteCriticalSection
SleepEx
GetVersionExW
WaitForSingleObject
ExpandEnvironmentStringsA
Sleep
FormatMessageA
GetTickCount
GetCurrentDirectoryW
SetEnvironmentVariableA
WriteConsoleW
SetEndOfFile
GetTimeZoneInformation
GetTempFileNameW
HeapAlloc
SetFilePointerEx
GetConsoleCP
HeapFree
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
CreateThread
GetCurrentThreadId
ExitThread
GetProcAddress
LoadLibraryExW
HeapReAlloc
GetCommandLineA
RaiseException
RtlUnwind
GetProcessHeap
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
ReadFile
GetConsoleMode
ReadConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStdHandle
GetFileType
WriteFile
GetModuleFileNameW
FindClose
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FlushFileBuffers

advapi32

CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
CryptHashData

shell32

SHCreateDirectoryExW

Exports

Exports

AQHTTP_DownloadFile
AQHTTP_Free
AQHTTP_Get
AQHTTP_Head
AQHTTP_Post

Sections

.text
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
flashplayer_10_sa_debug.exe
.exe windows:5 windows x86 arch:x86

7b79ac39f31a285f3182c031233d1a20

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-12-2010 00:00

Not After

14-12-2012 23:59

Subject

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

82:61:89:0b:3b:a8:96:84:80:bd:aa:36:08:03:29:bf:74:12:47:84
Signer

Actual PE Digest

82:61:89:0b:3b:a8:96:84:80:bd:aa:36:08:03:29:bf:74:12:47:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

FlashPlayer.pdb

Imports

crypt32

CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertCloseStore
CryptVerifyMessageSignature

urlmon

CopyStgMedium

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

waveInOpen
timeSetEvent
waveOutGetPosition
timeGetTime
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveInPrepareHeader
waveInReset
waveInUnprepareHeader
waveInClose
waveOutClose
waveInStop
waveInAddBuffer
waveInStart
waveOutReset
waveOutOpen
waveInGetNumDevs
waveOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeGetDevCaps
timeKillEvent
timeBeginPeriod
timeEndPeriod

oleaut32

SysFreeString

dsound

ord8

kernel32

CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
CreateSemaphoreW
GetTempPathA
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
CreateProcessW
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
DeleteFileA
CreateMutexA
SetFilePointerEx
GetFileSizeEx
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GetFullPathNameW
ExpandEnvironmentStringsW
OutputDebugStringA
GetFileSize
CreateDirectoryW
RaiseException
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
SetLastError
SetThreadPriority
GetSystemDirectoryA
TerminateThread
lstrcpyA
lstrlenA
QueryPerformanceFrequency
QueryPerformanceCounter
QueueUserAPC
OpenThread
SleepEx
FlushInstructionCache
GetModuleHandleA
GetCommandLineW
SetEndOfFile
SetFileAttributesA
CopyFileA
GetStartupInfoW
GetCommandLineA
FlushFileBuffers
GetNumberFormatW
GetCurrencyFormatW
CompareStringW
GetDateFormatW
GetTimeFormatW
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
VirtualProtect
IsProcessorFeaturePresent
RtlUnwind
ExitProcess
GetStartupInfoA
UnhandledExceptionFilter
SetStdHandle
GetFileType
GetStdHandle
TerminateProcess
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
SetHandleCount
HeapCreate
HeapReAlloc
ReadFile
GlobalFree
CreateFileA
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
SetFilePointer
WriteFile
GetUserDefaultUILanguage
GetUserDefaultLangID
VirtualQuery
GetFileAttributesW
DeleteFileW
MoveFileExW
GetModuleHandleW
GetSystemInfo
LoadLibraryA
GlobalAlloc
GlobalSize
GetCurrentProcessId
GlobalLock
GlobalUnlock
GetCurrentProcess
GetProcessTimes
FreeLibrary
CreateProcessA
LCMapStringW
GetTickCount
LocalFree
GetCurrentThreadId
GetLocaleInfoW
GetEnvironmentVariableW
GetLastError
ResetEvent
WaitForSingleObject
GetVersionExW
LoadLibraryW
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
CreateEventW
CloseHandle
ExitThread
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateNamedPipeA
ConnectNamedPipe
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
CompareStringA
SetEnvironmentVariableA
FormatMessageA
FormatMessageW
VirtualAlloc
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
CreateSemaphoreA
SwitchToThread
VirtualFree
DeviceIoControl
GetVersion
lstrlenW
InterlockedExchangeAdd
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
GetVersionExA
CreateEventA

user32

GetMenu
GetWindowTextW
DeleteMenu
LoadMenuW
PostQuitMessage
UnregisterClassA
GetWindowTextA
InsertMenuA
InsertMenuW
GetWindowTextLengthA
TranslateAcceleratorW
LoadAcceleratorsW
GetMenuStringA
GetMenuStringW
SetCaretPos
DestroyCaret
CreateCaret
ShowCaret
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
RegisterClipboardFormatW
IsWindow
TrackMouseEvent
CallWindowProcW
GetCapture
GetWindowThreadProcessId
AttachThreadInput
MessageBoxW
GetCursorPos
LoadStringA
GetFocus
EnableMenuItem
CheckMenuItem
GetQueueStatus
GetMenuItemInfoW
RemoveMenu
SetMenuItemInfoW
InsertMenuItemW
DrawMenuBar
SetMenuInfo
MapVirtualKeyW
GetKeyState
GetForegroundWindow
WaitForInputIdle
CreatePopupMenu
CreateMenu
ShowWindow
GetClassInfoExW
RegisterClassExW
GetSubMenu
TrackPopupMenu
ReleaseCapture
KillTimer
SetCapture
SetTimer
UpdateWindow
BeginPaint
EndPaint
DestroyWindow
GetActiveWindow
InvalidateRect
MessageBoxA
GetMessageW
EnableWindow
GetWindowTextLengthW
GetDlgItemTextA
IsWindowEnabled
SetDlgItemTextA
DialogBoxParamW
GetDlgItemTextW
SetDlgItemTextW
ScreenToClient
SetWindowTextA
GetClientRect
LoadStringW
RedrawWindow
DialogBoxIndirectParamW
PostMessageW
EndDialog
GetDesktopWindow
SetWindowPos
LoadIconW
GetDlgItem
SetWindowTextW
GetParent
SendMessageTimeoutW
SendMessageW
CreateIconIndirect
SetFocus
SetRectEmpty
SetWindowLongW
SetCursor
GetCursor
DestroyIcon
GetPropW
SetPropW
SystemParametersInfoW
ShowWindowAsync
GetWindow
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
IsZoomed
GetSystemMenu
SetMenu
EnumDisplaySettingsW
LoadCursorW
FlashWindowEx
GetSystemMetrics
GetClipboardFormatNameA
RegisterClipboardFormatA
CreateWindowExW
DdeInitializeW
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
DefWindowProcW
SendInput
GetKeyboardLayout
FillRect
GetWindowLongW
GetWindowRect
UpdateLayeredWindow
GetDC
ReleaseDC
ClientToScreen
GetMonitorInfoW
SetRect
OffsetRect
MonitorFromWindow
PeekMessageW
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
GetDoubleClickTime
DestroyMenu
MapWindowPoints
PostMessageA
RegisterWindowMessageA
MoveWindow
CloseClipboard

gdi32

BitBlt
SelectObject
RealizePalette
SelectPalette
ExtTextOutW
SetBkColor
CreateSolidBrush
StretchBlt
SetStretchBltMode
GetStretchBltMode
EnumFontFamiliesW
GetICMProfileA
CreateDCA
GetStockObject
SetPixel
CreateBitmap
CreateFontIndirectW
GetTextMetricsW
EnumFontFamiliesA
SetBkMode
CreateDIBSection
GetObjectW
SetTextAlign
IntersectClipRect
SelectClipRgn
ExtTextOutA
SetTextColor
CreateFontIndirectA
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
SetTextCharacterExtra
GetTextExtentPoint32W
GetCurrentObject
GetBkColor
CreatePen
DPtoLP
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
GetWorldTransform
CreatePalette
GetSystemPaletteEntries
LPtoDP
StartDocW
EndDoc
StrokePath
ExtCreatePen
FillPath
StretchDIBits
GetClipBox
GetDeviceCaps
CreateCompatibleBitmap
GetDIBits
GetFontData
EnumFontFamiliesExW
DeleteObject
GdiFlush
DeleteDC
CreateCompatibleDC
RestoreDC
SelectClipPath
PolyBezierTo
LineTo
MoveToEx
EndPath
BeginPath
SaveDC
SetPolyFillMode
StartPage
EndPage

comdlg32

GetSaveFileNameA
PrintDlgW
GetSaveFileNameW
GetOpenFileNameW
GetOpenFileNameA
CommDlgExtendedError

advapi32

RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

DragQueryFileA
DragAcceptFiles
SHGetDiskFreeSpaceExW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathA
DragQueryFileW

ole32

OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
ReleaseStgMedium
CreateBindCtx
CoTaskMemFree
CoTaskMemAlloc
OleGetClipboard
CoCreateInstance
PropVariantClear

mscms

CreateColorTransformW
CloseColorProfile
TranslateBitmapBits
DeleteColorTransform
OpenColorProfileW

ws2_32

recv
setsockopt
WSAStartup
WSASocketW
socket
WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
send
ntohs
htons
WSACloseEvent
inet_addr
gethostbyname
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
recvfrom
sendto
bind
WSAAddressToStringA
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
ioctlsocket
connect
ntohl
select
getsockname
gethostname

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 127KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 625KB - Virtual size: 624KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
flashplayer_11_sa_debug_32bit.exe
.exe windows:5 windows x86 arch:x86

9d935320e17a06db6b40261fb63f7841

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-12-2010 00:00

Not After

14-12-2012 23:59

Subject

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:0b:68:6e:f6:0c:8c:4a:82:58:98:56:c0:d0:44:a9:7f:6e:6a:75
Signer

Actual PE Digest

43:0b:68:6e:f6:0c:8c:4a:82:58:98:56:c0:d0:44:a9:7f:6e:6a:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

FlashPlayer.pdb

Imports

crypt32

CryptDecodeObjectEx
CertNameToStrW
CertVerifyTimeValidity
CertVerifyRevocation
CertFindRDNAttr
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertCreateCertificateContext
CryptGetMessageCertificates
CryptVerifyMessageSignature
CertRDNValueToStrW
CertOpenStore
CryptFindOIDInfo
CertCompareCertificateName
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertCompareCertificate
CertCloseStore
CertAddStoreToCollection

urlmon

CopyStgMedium

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

waveInStop
waveOutClose
waveInClose
waveInUnprepareHeader
waveInReset
waveInPrepareHeader
timeSetEvent
waveOutGetPosition
timeGetTime
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveInAddBuffer
waveInStart
waveOutReset
waveOutOpen
waveInGetNumDevs
waveOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeKillEvent
waveInOpen

oleaut32

SysFreeString

dsound

ord8

kernel32

VerifyVersionInfoW
VerSetConditionMask
CreateFileA
GlobalFree
ReadFile
GetFileSize
CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
CreateSemaphoreW
GetTempPathA
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
CreateProcessW
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
DeleteFileA
CreateMutexA
SetFilePointerEx
CreateFileW
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GetFullPathNameW
ExpandEnvironmentStringsW
GetVersionExA
CreateDirectoryW
TlsSetValue
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
SetThreadPriority
TerminateThread
lstrcpyA
lstrlenA
CompareFileTime
LocalFree
QueueUserAPC
OpenThread
SleepEx
GetModuleHandleA
SetEndOfFile
SetFileAttributesA
CopyFileA
GetCommandLineW
GetStartupInfoW
GetCommandLineA
SwitchToThread
SetFilePointer
WriteFile
GetUserDefaultUILanguage
GetUserDefaultLangID
VirtualQuery
GetFileAttributesW
DeleteFileW
MoveFileExW
GetModuleHandleW
GetSystemInfo
GlobalAlloc
GlobalSize
GetCurrentProcessId
GlobalLock
GlobalUnlock
CreateProcessA
GetVersionExW
LCMapStringW
CreateEventA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
InterlockedExchangeAdd
lstrlenW
GetVersion
DeviceIoControl
VirtualAlloc
VirtualFree
CreateSemaphoreA
FormatMessageW
TlsAlloc
TlsFree
FormatMessageA
ConnectNamedPipe
CreateNamedPipeA
FlushFileBuffers
GetNumberFormatW
GetCurrencyFormatW
CompareStringW
GetDateFormatW
GetTimeFormatW
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
VirtualProtect
GetProcessAffinityMask
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlUnwind
ExitProcess
GetStartupInfoA
SetStdHandle
GetFileType
GetSystemTimeAsFileTime
GetStdHandle
TerminateProcess
IsDebuggerPresent
HeapCreate
HeapReAlloc
GetOEMCP
GetTickCount
GetLocaleInfoW
GetEnvironmentVariableW
GetLastError
ResetEvent
WaitForSingleObject
LoadLibraryW
SetLastError
GetCurrentThreadId
FlushInstructionCache
RaiseException
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
CreateEventW
CloseHandle
ExitThread
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
OutputDebugStringA
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
GetProcessTimes
GetSystemTime
SystemTimeToFileTime
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
IsValidCodePage
GetConsoleCP
GetConsoleMode
SetHandleCount
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
GetFileSizeEx

user32

LoadMenuW
DeleteMenu
GetWindowTextW
IsIconic
GetMenu
ShowWindowAsync
GetWindow
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
IsZoomed
GetSystemMenu
SetMenu
EnumDisplaySettingsW
FlashWindowEx
GetActiveWindow
MapWindowPoints
SetCaretPos
DestroyCaret
ShowCaret
EnumDisplayDevicesW
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
IsWindow
TrackMouseEvent
GetCapture
EnumWindows
GetCursorPos
GetWindowThreadProcessId
AttachThreadInput
MessageBoxW
LoadStringA
GetWindowInfo
CopyRect
GetFocus
UnregisterClassA
CheckMenuItem
GetQueueStatus
RemoveMenu
SetMenuItemInfoW
GetMenuItemInfoW
InsertMenuItemW
DrawMenuBar
SetMenuInfo
MapVirtualKeyW
GetKeyState
GetForegroundWindow
WaitForInputIdle
CreatePopupMenu
CreateMenu
ShowWindow
GetSubMenu
TrackPopupMenu
ReleaseCapture
KillTimer
SetCapture
SetTimer
UpdateWindow
BeginPaint
EndPaint
InvalidateRect
DestroyMenu
MessageBoxA
EnableWindow
GetWindowTextLengthW
GetDlgItemTextA
SetDlgItemTextA
DialogBoxParamW
GetDlgItemTextW
SetDlgItemTextW
GetWindowTextA
InsertMenuA
InsertMenuW
GetWindowTextLengthA
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
GetMenuStringA
GetMenuStringW
EnableMenuItem
MoveWindow
ScreenToClient
SetWindowTextA
GetClientRect
LoadStringW
RedrawWindow
DialogBoxIndirectParamW
EndDialog
GetDesktopWindow
SetWindowPos
LoadIconW
GetDlgItem
SetWindowTextW
GetParent
SendMessageTimeoutW
SendMessageW
CreateIconIndirect
SetFocus
FillRect
PostMessageW
SetRectEmpty
DestroyWindow
SetCursor
GetCursor
DestroyIcon
GetPropW
SetPropW
GetMonitorInfoW
SystemParametersInfoW
GetClipboardFormatNameA
RegisterClipboardFormatA
GetDC
ReleaseDC
DdeInitializeW
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
ClientToScreen
SendInput
GetKeyboardLayout
GetWindowRect
UpdateLayeredWindow
EnumDisplayDevicesA
GetSystemMetrics
SetRect
OffsetRect
MonitorFromWindow
CreateWindowExW
RegisterClassExW
GetWindowLongW
CallWindowProcW
DefWindowProcW
PostQuitMessage
LoadCursorW
GetClassInfoExW
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
GetDoubleClickTime
PostMessageA
RegisterWindowMessageA
IsWindowEnabled
CreateCaret

gdi32

GetTextAlign
GetBkMode
GetTextColor
SelectClipRgn
CreateRectRgn
SetTextCharacterExtra
CreatePen
GetTextExtentPoint32W
SetBkMode
GetClipRgn
GetDeviceCaps
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
SelectObject
ExtTextOutW
GetCurrentObject
SetTextAlign
GetWorldTransform
CreatePalette
GetSystemPaletteEntries
RealizePalette
SelectPalette
LPtoDP
StartDocW
EndDoc
CreateSolidBrush
StrokePath
ExtCreatePen
FillPath
StretchDIBits
GetClipBox
IntersectClipRect
CreateFontIndirectA
BitBlt
CreateDIBSection
GetFontData
EnumFontFamiliesExW
GetObjectW
GdiFlush
DeleteDC
CreateCompatibleDC
RestoreDC
SelectClipPath
PolyBezierTo
DPtoLP
LineTo
MoveToEx
StartPage
EndPage
SetPolyFillMode
ExtTextOutA
SaveDC
BeginPath
GetBkColor
EndPath
EnumFontFamiliesA
GetTextMetricsW
CreateFontIndirectW
CreateBitmap
SetPixel
GetStockObject
CreateDCA
GetICMProfileA
EnumFontFamiliesW
DeleteObject
GetStretchBltMode
SetStretchBltMode
StretchBlt
SetBkColor
SetTextColor

comdlg32

CommDlgExtendedError
GetSaveFileNameW
PrintDlgW
GetOpenFileNameA
GetSaveFileNameA
GetOpenFileNameW

advapi32

CryptGenRandom
CryptReleaseContext
RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
CryptAcquireContextW
RegOpenKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

DragQueryFileA
DragAcceptFiles
SHGetDiskFreeSpaceExW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHAppBarMessage
SHGetFolderPathA
SHBrowseForFolderW
SHGetPathFromIDListW
DragQueryFileW

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CreateBindCtx
ReleaseStgMedium
OleUninitialize
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
OleInitialize
CoInitialize
CoUninitialize
PropVariantClear

ws2_32

socket
bind
listen
WSASetLastError
getservbyport
ntohs
gethostbyaddr
htons
getservbyname
htonl
recv
gethostbyname
WSAGetLastError
inet_addr
send
closesocket
WSACleanup
WSAStartup
select
WSAAsyncSelect
WSAIoctl
WSASocketW
setsockopt
getsockname
WSACloseEvent
recvfrom
sendto
WSAAddressToStringA
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
ioctlsocket
connect
gethostname
ntohl
accept
inet_ntoa

mscms

TranslateBitmapBits
CloseColorProfile
CreateColorTransformW
OpenColorProfileW
DeleteColorTransform

opengl32

wglGetProcAddress

Sections

.text
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 243KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 581KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
game.ico
uninst.exe.nsis
Խ֮ǹ޵а.exe
.exe windows:4 windows x86 arch:x86

677985dd414b6f56ecd6b5b040c4588e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\svn\APPS\GMStartGame\bin\win32\release\startgame.pdb

Imports

wininet

InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
HttpQueryInfoW
InternetSetOptionW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

msimg32

AlphaBlend

comctl32

_TrackMouseEvent

riched20

ord4

kernel32

GetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
SetFileAttributesW
GetCurrentThreadId
ResumeThread
ResetEvent
CreateEventW
SetEvent
WideCharToMultiByte
MultiByteToWideChar
FindClose
FindNextFileW
FindFirstFileW
LoadLibraryW
GetProcAddress
FreeLibrary
GetFullPathNameW
GetWindowsDirectoryW
GetCurrentDirectoryW
GetLongPathNameW
MoveFileW
MoveFileExW
SetCurrentDirectoryW
GetVersionExW
GetSystemInfo
InterlockedDecrement
GetCurrentProcess
TerminateProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
WriteProcessMemory
VirtualQueryEx
ReadProcessMemory
SetLastError
lstrcmpW
VirtualAllocEx
GetEnvironmentVariableW
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
MulDiv
InterlockedIncrement
FreeResource
FindResourceW
LoadResource
LockResource
SizeofResource
HeapFree
GetProcessHeap
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
ExitProcess
GetModuleHandleA
RaiseException
HeapReAlloc
RtlUnwind
CreateThread
ExitThread
GetStartupInfoW
GetVersionExA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
GetModuleHandleW
GetModuleFileNameW
Sleep
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetModuleFileNameA
GetTempFileNameW
GetTempPathW
GetLocalTime
GetCommandLineW
GetLastError
OpenMutexW
GetExitCodeProcess
ReleaseMutex
CreateMutexW
OpenProcess
GetPrivateProfileIntW
WriteFile
GetPrivateProfileStringW
WritePrivateProfileStringW
DeleteFileW
GetFileSize
SetEndOfFile
lstrlenW
lstrlenA
SetFilePointer
CreateFileW
ReadFile
CreateProcessW
GetTickCount
CloseHandle
WaitForSingleObject
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetStdHandle
LoadLibraryA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
VirtualProtectEx

user32

GetMonitorInfoW
ShowCaret
SetCapture
BeginPaint
CreateCaret
GetKeyState
GetUpdateRect
GetFocus
ReleaseCapture
EndPaint
SetCaretPos
DestroyWindow
RegisterClassExW
GetMessageW
LoadImageW
IsWindow
CreateWindowExW
RegisterClassW
SendMessageW
SetFocus
EnableWindow
GetClassInfoExW
DestroyIcon
CharNextA
GetDC
ReleaseDC
MoveWindow
RedrawWindow
PtInRect
IntersectRect
IsRectEmpty
SetCursor
CharNextW
LoadCursorW
MonitorFromWindow
ScreenToClient
HideCaret
SetWindowRgn
UpdateLayeredWindow
TranslateAcceleratorW
LoadStringW
GetActiveWindow
GetParent
AttachThreadInput
MapWindowPoints
GetWindowTextLengthW
GetWindowTextW
GetWindowRect
IsIconic
IsChild
IsZoomed
SetForegroundWindow
SetWindowTextW
ShowWindow
GetForegroundWindow
PostQuitMessage
SetWindowsHookExW
InvalidateRect
LoadBitmapW
OffsetRect
FillRect
CharPrevW
CopyImage
ChildWindowFromPointEx
ClientToScreen
GetSysColor
GetCursorPos
IsWindowEnabled
FindWindowW
MessageBoxW
GetSystemMetrics
GetWindowThreadProcessId
IsWindowVisible
CallNextHookEx
EnumThreadWindows
GetClientRect
SystemParametersInfoW
GetDesktopWindow
wsprintfA
wsprintfW
PeekMessageW
PostMessageW
KillTimer
TranslateMessage
SetWindowPos
DispatchMessageW
SetTimer
SetWindowLongW
GetClassNameW
CallWindowProcW
DefWindowProcW
GetWindow
SetPropW
GetWindowLongW
GetPropW
GetAsyncKeyState
InvalidateRgn
CreateAcceleratorTableW
DestroyAcceleratorTable
DrawTextW
DrawIconEx
DrawFocusRect

gdi32

CreatePen
CreateRectRgnIndirect
ExtSelectClipRgn
GetClipBox
CreateFontIndirectW
MoveToEx
CombineRgn
GetStockObject
GetTextExtentPoint32W
SetBitmapBits
GetBitmapBits
TextOutW
SetBkMode
RoundRect
SetBkColor
StretchBlt
SetStretchBltMode
GetCharABCWidthsW
CreateSolidBrush
CreateCompatibleBitmap
Rectangle
ExtTextOutW
BitBlt
GetTextMetricsW
LineTo
CreateRoundRectRgn
CreateRectRgn
EnumFontsW
CreateCompatibleDC
CreateEllipticRgn
DeleteDC
CreateDIBSection
GetDeviceCaps
DeleteObject
SelectObject
SelectClipRgn
SetTextColor
GetObjectW

advapi32

RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
CLSIDFromProgID
CLSIDFromString
OleLockRunning
DoDragDrop
CreateStreamOnHGlobal
OleDuplicateData
ReleaseStgMedium

oleaut32

SysFreeString
SysAllocString
VariantClear
OleLoadPicture

shlwapi

StrStrIA
StrStrIW

Sections

.text
Size: 848KB - Virtual size: 845KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Խ֮ǹ޵а.swf

Sharing

General

Malware Config

Signatures

Files

e160ef8e55bb9d162da4e266afd9eef3

Code Sign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

18:fd:a0:51:a2:db:0a:97:a2:90:46:3e:07:a4:27:41Certificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40Certificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 105KB

.ndata Size: - Virtual size: 64KB

.rsrc Size: 44KB - Virtual size: 43KB

0ece15e7d9bb35972aec701f46192460

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 512B - Virtual size: 503B

.data Size: 512B - Virtual size: 128B

.reloc Size: 512B - Virtual size: 220B

0b0f6f2578ce650dcdda31f442fb709d

Headers

File Characteristics

PDB Paths

Imports

shlwapi

wininet

version

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 868KB - Virtual size: 865KB

.rdata Size: 116KB - Virtual size: 113KB

.data Size: 16KB - Virtual size: 34KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 36KB - Virtual size: 35KB

8c8a576201f68de1a3f26fc723b9f30f

Headers

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

18:fd:a0:51:a2:db:0a:97:a2:90:46:3e:07:a4:27:41
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 105KB

.ndata
Size: - Virtual size: 64KB

.rsrc
Size: 44KB - Virtual size: 43KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 512B - Virtual size: 503B

.data
Size: 512B - Virtual size: 128B

.reloc
Size: 512B - Virtual size: 220B

.text
Size: 868KB - Virtual size: 865KB

.rdata
Size: 116KB - Virtual size: 113KB

.data
Size: 16KB - Virtual size: 34KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 36KB - Virtual size: 35KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 851B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 1024B - Virtual size: 610B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 616B

UPX0
Size: - Virtual size: 44KB

UPX1
Size: 19KB - Virtual size: 20KB

.rsrc
Size: 1024B - Virtual size: 4KB

CODE
Size: 28KB - Virtual size: 28KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 73B

.reloc
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 2KB

.text
Size: 260KB - Virtual size: 258KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 744B

.reloc
Size: 12KB - Virtual size: 9KB