c:\depot\Ghost\GSSTrunk\Ghost\ghost\src\core\vs2008\Win32\Release\Ghost32.pdb
Overview
overview
9Static
static
9Norton Gho...RR.txt
windows7-x64
1Norton Gho...RR.txt
windows10-2004-x64
1Norton Gho...32.exe
windows7-x64
6Norton Gho...32.exe
windows10-2004-x64
6Norton Gho...64.exe
windows7-x64
6Norton Gho...64.exe
windows10-2004-x64
6Norton Gho...xp.exe
windows7-x64
6Norton Gho...xp.exe
windows10-2004-x64
6Norton Gho...64.exe
windows7-x64
6Norton Gho...64.exe
windows10-2004-x64
6Norton Gho...32.dmp
windows7-x64
3Norton Gho...32.dmp
windows10-2004-x64
3Norton Gho...rn.txt
windows7-x64
1Norton Gho...rn.txt
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/GHOSTERR.txt
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/GHOSTERR.txt
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghost32.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghost32.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghost64.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghost64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghostexp.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral8
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghostexp.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral9
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghostexp64.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral10
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghostexp64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/ghost32.dmp
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/ghost32.dmp
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/ghstwarn.txt
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/ghstwarn.txt
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
ghost.zip
-
Size
9.0MB
-
MD5
c70763b3a3fb13ea9444b08816086d85
-
SHA1
9b3925f033737cfd5f99c98c52b7185b6e08b810
-
SHA256
2834a96c7b3f15e3d22b8f3b507874a6c281592096023c3ff28bc5ec3f0e4286
-
SHA512
d4f804d11f75a57026279f78ac8e13f3c3f2d85199caf785995d3c6a85d049bf7f0c732076f92c697365b57aeb8f79732ea656b2775e58aba3a5e32ee8923d56
-
SSDEEP
196608:pvsZOCE3wQUhyTsu2VgBtdfAIpgCNjBzm/9OyMoqr8H6rC2K5K:pveEAQUhyTqQtdvgE0IoQLJSK
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghostexp.exe cryptone -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghost32.exe unpack001/Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghost64.exe
Files
-
ghost.zip.zip
-
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/GHOSTERR.TXT
-
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghost32.exe.exe windows:5 windows x86 arch:x86
fc593133a245c9a8d25e287f8d08ff91
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
WSASocketA
ntohl
send
WSAIoctl
WSASetLastError
WSAAddressToStringA
getsockopt
getsockname
WSASendTo
WSARecvFrom
WSARecv
closesocket
getprotobyname
ioctlsocket
shutdown
setsockopt
recvfrom
sendto
inet_addr
htons
listen
htonl
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSASend
getservbyname
getservbyport
WSAGetLastError
recv
accept
connect
bind
WSAEventSelect
select
__WSAFDIsSet
gethostname
gethostbyname
inet_ntoa
WSACloseEvent
WSACleanup
WSAStartup
WSACreateEvent
socket
imm32
ImmDisableIME
kernel32
GlobalAlloc
SetLastError
GetProcAddress
FreeLibrary
CreateThread
CloseHandle
CreateEventA
WaitForSingleObject
GlobalFree
Sleep
IsDebuggerPresent
GetVersionExA
GetTickCount
GetLocaleInfoA
GetModuleFileNameA
FindClose
GetLogicalDrives
SetEvent
GetLogicalDriveStringsA
ReadProcessMemory
ReadConsoleInputA
SetConsoleMode
GetBinaryTypeA
LoadLibraryA
HeapAlloc
HeapFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
VirtualLock
SetProcessWorkingSetSize
GetProcessWorkingSetSize
GetCurrentProcess
VirtualUnlock
VirtualQuery
GetSystemInfo
InterlockedDecrement
DeviceIoControl
GetLastError
SetFilePointer
GetFileSize
SetEndOfFile
CreateFileA
CreateFileW
ReadFile
WriteFile
GetOverlappedResult
GetModuleHandleA
SetErrorMode
FormatMessageA
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
RaiseException
SetUnhandledExceptionFilter
GlobalMemoryStatus
FreeConsole
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
ResetEvent
GetVolumeInformationA
GetCurrentThread
InitializeCriticalSection
GetExitCodeThread
LocalFree
GlobalUnlock
GlobalLock
ExitProcess
LoadLibraryW
DebugBreak
GetExitCodeProcess
CreateProcessW
GetFileAttributesW
GetModuleFileNameW
GetModuleHandleW
GetCurrentDirectoryW
DefineDosDeviceW
DeleteVolumeMountPointW
GetVolumeNameForVolumeMountPointW
SetVolumeMountPointW
VirtualFree
VirtualAlloc
OutputDebugStringA
GetDriveTypeW
GetVolumePathNameW
ExpandEnvironmentStringsW
GetBinaryTypeW
GetFileInformationByHandle
CreateDirectoryW
DeleteFileW
RemoveDirectoryW
MoveFileW
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetFullPathNameW
FindFirstFileW
SetFileTime
SetFileAttributesW
LocalAlloc
BackupSeek
BackupRead
FindNextFileW
QueryPerformanceCounter
QueryPerformanceFrequency
SystemTimeToFileTime
GetSystemTime
GetProcessHeap
GetProcessTimes
GetThreadTimes
GetStdHandle
FindResourceA
LoadResource
FindResourceExA
MultiByteToWideChar
LockResource
CreateEventW
ResumeThread
FormatMessageW
GetFileAttributesExA
GetVersionExW
GetFileAttributesExW
GetThreadContext
FindResourceW
SizeofResource
WideCharToMultiByte
GetStringTypeA
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToLocalFileTime
VirtualProtectEx
GetLocaleInfoW
IsValidCodePage
IsDBCSLeadByteEx
GetOEMCP
GetConsoleCP
GetConsoleOutputCP
GetACP
FileTimeToSystemTime
LocalFileTimeToFileTime
TerminateProcess
GetEnvironmentVariableW
InterlockedExchange
InterlockedCompareExchange
RtlUnwind
GetTimeFormatA
GetDateFormatA
SetConsoleCtrlHandler
GetFullPathNameA
GetCommandLineA
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
GetTimeZoneInformation
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FlushFileBuffers
GetCurrentDirectoryA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
WriteConsoleW
rpcrt4
RpcStringFreeW
UuidToStringW
UuidCreate
secur32
AcquireCredentialsHandleA
EncryptMessage
DecryptMessage
QueryContextAttributesA
FreeCredentialsHandle
DeleteSecurityContext
CompleteAuthToken
InitializeSecurityContextW
imagehlp
ImageRemoveCertificate
ImageGetCertificateHeader
SymGetModuleInfo
SymFromAddr
SymInitialize
SymCleanup
SymGetTypeInfo
StackWalk
SymEnumSymbols
SymSetContext
SymFunctionTableAccess
SymGetModuleBase
SymGetLineFromAddr
SymLoadModule
SymSetOptions
netapi32
Netbios
user32
RegisterDeviceNotificationA
DefWindowProcA
CreateWindowExA
UnregisterClassA
KillTimer
SetTimer
DestroyWindow
ReleaseDC
GetKeyState
ShowWindow
ToAscii
GetKeyboardState
SetCursor
LoadCursorA
SetFocus
RegisterClassA
GetUpdateRect
AdjustWindowRect
SetWindowPos
GetWindowRect
GetDC
SetWindowTextW
ScreenToClient
FindWindowExW
ExitWindowsEx
DispatchMessageA
TranslateMessage
GetOpenClipboardWindow
PeekMessageA
GetFocus
GetProcessWindowStation
GetQueueStatus
GetCapture
GetMessagePos
GetInputState
GetDesktopWindow
GetCursorPos
GetCaretPos
GetActiveWindow
GetClipboardViewer
GetClipboardOwner
GetMessageTime
ValidateRect
gdi32
CreateSolidBrush
GetPixel
StretchDIBits
CreatePalette
SelectPalette
RealizePalette
SelectObject
DeleteObject
advapi32
CreateServiceA
StartServiceA
OpenSCManagerA
OpenServiceA
RegDeleteValueW
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteValueA
RegSetValueExA
RegDeleteKeyA
RegCreateKeyExA
RegUnLoadKeyA
RegLoadKeyA
RegEnumValueW
RegEnumKeyExW
RegSetKeySecurity
RegGetKeySecurity
RegUnLoadKeyW
RegLoadKeyW
LookupPrivilegeValueW
DeleteService
SetServiceStatus
RegNotifyChangeKeyValue
QueryServiceConfigW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
OpenThreadToken
RegSetValueExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyA
StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
QueryServiceStatus
ControlService
GetFileSecurityW
SetFileSecurityW
RegOpenKeyExA
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
ole32
CoSetProxyBlanket
OleRun
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeSecurity
CoTaskMemFree
CoInitializeEx
oleaut32
SysFreeString
SysAllocString
SafeArrayDestroy
SafeArrayAccessData
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
Sections
.text Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 888KB - Virtual size: 887KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 259KB - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mixcrt Size: 512B - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghost64.exe.exe windows:5 windows x64 arch:x64
e7821076fcbcf4c09f91710f33290701
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
c:\depot\Ghost\GSSTrunk\Ghost\ghost\src\core\vs2008\x64\Release\Ghost64.pdb
Imports
ws2_32
WSASocketA
ntohl
send
WSAIoctl
WSASetLastError
WSAAddressToStringA
getsockopt
getsockname
WSASendTo
WSARecvFrom
WSARecv
closesocket
getprotobyname
ioctlsocket
shutdown
setsockopt
recvfrom
sendto
inet_addr
htons
listen
htonl
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSASend
getservbyname
getservbyport
WSAGetLastError
recv
accept
connect
bind
WSAEventSelect
select
__WSAFDIsSet
gethostname
gethostbyname
inet_ntoa
WSACloseEvent
WSACleanup
WSAStartup
WSACreateEvent
socket
imm32
ImmDisableIME
kernel32
GlobalAlloc
SetLastError
GetProcAddress
FreeLibrary
CreateThread
CloseHandle
CreateEventA
WaitForSingleObject
GlobalFree
Sleep
IsDebuggerPresent
GetVersionExA
GetTickCount
GetLocaleInfoA
GetModuleFileNameA
FindClose
GetLogicalDrives
SetEvent
GetLogicalDriveStringsA
ReadProcessMemory
ReadConsoleInputA
SetConsoleMode
GetBinaryTypeA
LoadLibraryA
HeapAlloc
HeapFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
VirtualLock
SetProcessWorkingSetSize
GetProcessWorkingSetSize
GetCurrentProcess
VirtualUnlock
VirtualQuery
GetSystemInfo
DeviceIoControl
GetLastError
SetFilePointer
GetFileSize
SetEndOfFile
CreateFileA
CreateFileW
ReadFile
WriteFile
GetOverlappedResult
GetModuleHandleA
SetErrorMode
FormatMessageA
SetUnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
RaiseException
GlobalMemoryStatus
FreeConsole
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ResetEvent
GetVolumeInformationA
GetCurrentThread
InitializeCriticalSection
GetExitCodeThread
LocalFree
GlobalUnlock
GlobalLock
ExitProcess
LoadLibraryW
DebugBreak
GetExitCodeProcess
CreateProcessW
GetFileAttributesW
GetModuleFileNameW
GetModuleHandleW
GetCurrentDirectoryW
DefineDosDeviceW
DeleteVolumeMountPointW
GetVolumeNameForVolumeMountPointW
SetVolumeMountPointW
VirtualFree
VirtualAlloc
OutputDebugStringA
GetDriveTypeW
GetVolumePathNameW
ExpandEnvironmentStringsW
GetBinaryTypeW
GetFileInformationByHandle
CreateDirectoryW
DeleteFileW
RemoveDirectoryW
MoveFileW
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetFullPathNameW
FindFirstFileW
SetFileTime
SetFileAttributesW
LocalAlloc
BackupSeek
BackupRead
FindNextFileW
QueryPerformanceCounter
QueryPerformanceFrequency
SystemTimeToFileTime
GetSystemTime
RtlCaptureStackBackTrace
GetProcessHeap
GetProcessTimes
GetThreadTimes
GetStdHandle
FindResourceA
LoadResource
FindResourceExA
MultiByteToWideChar
LockResource
CreateEventW
ResumeThread
FormatMessageW
GetFileAttributesExA
GetVersionExW
GetFileAttributesExW
GetThreadContext
FindResourceW
SizeofResource
WideCharToMultiByte
GetStringTypeA
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToLocalFileTime
GetLocaleInfoW
IsValidCodePage
IsDBCSLeadByteEx
GetOEMCP
GetConsoleCP
GetConsoleOutputCP
GetACP
FileTimeToSystemTime
LocalFileTimeToFileTime
TerminateProcess
GetEnvironmentVariableW
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
GetDateFormatA
GetTimeFormatA
SetConsoleCtrlHandler
GetFullPathNameA
GetCommandLineA
UnhandledExceptionFilter
RtlCaptureContext
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
GetTimeZoneInformation
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
RtlVirtualUnwind
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FlushFileBuffers
GetCurrentDirectoryA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
WriteConsoleW
rpcrt4
RpcStringFreeW
UuidToStringW
UuidCreate
secur32
AcquireCredentialsHandleA
EncryptMessage
DecryptMessage
QueryContextAttributesA
FreeCredentialsHandle
DeleteSecurityContext
CompleteAuthToken
InitializeSecurityContextW
imagehlp
ImageRemoveCertificate
ImageGetCertificateHeader
SymFromAddr
SymLoadModule64
SymInitialize
SymGetModuleInfo64
SymGetTypeInfo
SymEnumSymbols
SymSetContext
StackWalk64
SymFunctionTableAccess64
SymGetModuleBase64
SymCleanup
SymSetOptions
SymGetLineFromAddr64
netapi32
Netbios
user32
RegisterDeviceNotificationA
DefWindowProcA
CreateWindowExA
UnregisterClassA
KillTimer
SetTimer
DestroyWindow
ReleaseDC
GetKeyState
ToAscii
GetKeyboardState
AdjustWindowRect
SetFocus
SetCursor
LoadCursorA
RegisterClassA
GetUpdateRect
SetWindowPos
GetWindowRect
GetDC
ShowWindow
SetWindowTextW
ScreenToClient
FindWindowExW
ExitWindowsEx
PeekMessageA
DispatchMessageA
TranslateMessage
GetOpenClipboardWindow
GetFocus
GetProcessWindowStation
GetQueueStatus
GetCapture
GetMessagePos
GetInputState
GetDesktopWindow
GetCursorPos
GetCaretPos
GetActiveWindow
GetClipboardViewer
GetClipboardOwner
GetMessageTime
ValidateRect
gdi32
GetPixel
StretchDIBits
CreatePalette
SelectPalette
RealizePalette
CreateSolidBrush
SelectObject
DeleteObject
advapi32
CreateServiceA
StartServiceA
OpenSCManagerA
OpenServiceA
RegDeleteValueW
RegEnumValueA
RegEnumKeyExA
RegUnLoadKeyA
RegLoadKeyA
RegCreateKeyExA
RegDeleteValueA
RegSetValueExA
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumValueW
RegEnumKeyExW
RegUnLoadKeyW
RegLoadKeyW
RegSetKeySecurity
RegGetKeySecurity
LookupPrivilegeValueW
DeleteService
SetServiceStatus
RegNotifyChangeKeyValue
QueryServiceConfigW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
OpenThreadToken
RegSetValueExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyA
CloseServiceHandle
OpenSCManagerW
OpenServiceW
StartServiceW
QueryServiceStatus
ControlService
GetFileSecurityW
SetFileSecurityW
RegOpenKeyExA
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
ole32
CoSetProxyBlanket
OleRun
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeSecurity
CoTaskMemFree
CoInitializeEx
oleaut32
SysFreeString
SysAllocString
SafeArrayDestroy
SafeArrayAccessData
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
Sections
.text Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 299KB - Virtual size: 482KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 415KB - Virtual size: 414KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mixcrt Size: 512B - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghostexp.exe.exe windows:5 windows x86 arch:x86
09f81f37fbc5cbd977ba3a06e1e607e3
Code Sign
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before21/12/2012, 00:00Not After30/12/2020, 23:59SubjectCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate
IssuerCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USNot Before18/10/2012, 00:00Not After29/12/2020, 23:59SubjectCN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before08/11/2006, 00:00Not After07/11/2021, 23:59SubjectCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
10:80:bf:e8:73:b9:31:80:3a:3a:1d:b2:4e:b1:2e:dfCertificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before12/10/2012, 00:00Not After12/10/2014, 23:59SubjectCN=Symantec Corporation,OU=Endpoint Management Group+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Symantec Corporation,L=Lindon,ST=Utah,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
a0:1c:67:4a:61:bb:2d:a2:7b:16:9b:6f:d2:a9:3a:f1:f1:c6:ed:e2Signer
Actual PE Digesta0:1c:67:4a:61:bb:2d:a2:7b:16:9b:6f:d2:a9:3a:f1:f1:c6:ed:e2Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\depot\Ghost\GSSTrunk\Ghost\explorer\vs2008\Win32\Release\enterprise\GhostExp.pdb
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
GetEnvironmentStringsW
SetHandleCount
GetFileType
FatalAppExitA
SetConsoleCtrlHandler
GetTimeZoneInformation
CompareStringW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
GetConsoleMode
GetLocaleInfoW
WriteConsoleA
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
GetFullPathNameA
GetModuleFileNameA
GetModuleHandleA
FormatMessageW
ReadProcessMemory
GetOverlappedResult
VirtualUnlock
SetProcessWorkingSetSize
VirtualLock
GetBinaryTypeA
SetProcessAffinityMask
GetCurrentProcess
CloseHandle
GetLastError
GetCurrentThread
SetCurrentDirectoryA
GetDiskFreeSpaceA
GetProcAddress
LoadLibraryA
GetLongPathNameA
WideCharToMultiByte
FindResourceA
SizeofResource
LockResource
LoadResource
MultiByteToWideChar
GetFileAttributesA
lstrcpyA
lstrlenA
FreeLibrary
GlobalAlloc
lstrcmpA
GlobalLock
InterlockedExchange
CompareStringA
GetLocaleInfoA
EnumResourceLanguagesA
GetEnvironmentVariableW
GetLocalTime
GetThreadTimes
GetProcessWorkingSetSize
GetProcessTimes
QueryPerformanceCounter
VirtualProtectEx
FindResourceW
GetThreadContext
GetFileAttributesExW
FindNextFileW
BackupRead
BackupSeek
SetFileAttributesW
FindFirstFileW
GetFullPathNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
MoveFileW
RemoveDirectoryW
DeleteFileW
CreateDirectoryW
GetFileInformationByHandle
GetDriveTypeW
ExpandEnvironmentStringsW
SetVolumeMountPointW
GetVolumeNameForVolumeMountPointW
DeleteVolumeMountPointW
DefineDosDeviceW
ResetEvent
GetLogicalDrives
GetSystemTime
GlobalMemoryStatus
GetProcessHeap
HeapAlloc
HeapFree
DeviceIoControl
GetWindowsDirectoryA
GetSystemDirectoryA
WaitForMultipleObjects
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
GetProfileIntA
InterlockedCompareExchange
ConvertDefaultLocale
GetCurrentThreadId
GlobalDeleteAtom
SetLastError
GlobalUnlock
SetThreadPriority
ResumeThread
WaitForSingleObject
SetEvent
SuspendThread
CreateEventA
GlobalAddAtomA
GetCurrentProcessId
GetVersionExA
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
FreeResource
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetTickCount
GetModuleFileNameW
InterlockedDecrement
MulDiv
lstrlenW
LocalFree
FormatMessageA
GlobalSize
CopyFileA
GlobalFree
MoveFileA
DeleteFileA
GetStringTypeExA
GetThreadLocale
lstrcmpiA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
FindClose
FindFirstFileA
GetVolumeInformationA
GetShortPathNameA
CreateFileA
GetCurrentDirectoryA
GlobalFlags
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
InterlockedIncrement
GetCPInfo
GetOEMCP
GetAtomNameA
GetModuleHandleW
FileTimeToSystemTime
SystemTimeToFileTime
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesExA
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileSizeEx
GetFileTime
CreateFileW
GetExitCodeThread
CreateThread
RaiseException
IsDebuggerPresent
Sleep
ExitProcess
LoadLibraryW
DebugBreak
GetExitCodeProcess
CreateProcessW
GetFileAttributesW
GetCurrentDirectoryW
SetUnhandledExceptionFilter
TerminateThread
GetLogicalDriveStringsA
GetDriveTypeA
GetTempPathA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
LCMapStringW
LCMapStringA
GetDateFormatA
GetTimeFormatA
VirtualProtect
ExitThread
GetStartupInfoA
GetCommandLineA
RtlUnwind
GetSystemTimeAsFileTime
GetACP
GetConsoleOutputCP
GetConsoleCP
IsDBCSLeadByteEx
IsValidCodePage
GetStdHandle
OpenProcess
GetStringTypeA
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
GetVersionExW
OutputDebugStringA
SetCurrentDirectoryW
CreateEventW
GetBinaryTypeW
FindResourceExA
InitializeCriticalSectionAndSpinCount
CreateDirectoryA
GetTempFileNameA
user32
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
SetFocus
GetWindowTextLengthA
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
WinHelpA
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
IsDialogMessageA
TrackPopupMenuEx
RegisterWindowMessageA
RegisterClipboardFormatA
RemoveMenu
InsertMenuA
AppendMenuA
GetMenuStringA
FillRect
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
TrackPopupMenu
SetMenu
ClientToScreen
GetWindowDC
BeginPaint
EndPaint
GetNextDlgTabItem
CreateDialogIndirectParamA
IsDlgButtonChecked
SetDlgItemInt
IsWindowVisible
GetActiveWindow
DispatchMessageA
GetKeyState
PeekMessageA
GetDesktopWindow
CharUpperA
DeleteMenu
SetWindowTextA
CheckDlgButton
GetDlgItemInt
CheckRadioButton
EndDeferWindowPos
GetDlgItemTextA
MoveWindow
ShowWindow
ScrollWindowEx
TranslateMessage
SendMessageA
GetWindowTextA
UpdateWindow
MessageBoxA
EnumWindows
ReleaseDC
GetClientRect
GetDC
DialogBoxParamA
LoadStringA
GetDlgItem
SetDlgItemTextA
SendDlgItemMessageA
LoadIconA
EndDialog
SetCapture
WindowFromPoint
LoadCursorA
ReleaseCapture
WaitMessage
GetSysColorBrush
DestroyIcon
TranslateAcceleratorA
BringWindowToTop
CreatePopupMenu
InsertMenuItemA
InvalidateRect
LoadAcceleratorsA
GetMenuBarInfo
DestroyMenu
LoadMenuA
ReuseDDElParam
UnpackDDElParam
SetRect
SetTimer
KillTimer
InflateRect
GetMenuItemInfoA
PostThreadMessageA
UnregisterClassA
GetDialogBaseUnits
GetKeyNameTextA
MapVirtualKeyA
IsRectEmpty
GetSystemMenu
SetParent
UnionRect
GetDCEx
LockWindowUpdate
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
MessageBeep
RegisterDeviceNotificationA
ScrollWindow
wsprintfA
PostQuitMessage
PostMessageA
EnableWindow
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
GetMessageA
SetMenuItemBitmaps
ValidateRect
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
CopyRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
PtInRect
GetMenu
SetWindowLongA
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetWindowRect
OffsetRect
SetRectEmpty
IsZoomed
GetSystemMetrics
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
ShowOwnedPopups
SetCursor
SetWindowsHookExA
CallNextHookEx
RedrawWindow
SetCursorPos
DestroyCursor
IsClipboardFormatAvailable
MsgWaitForMultipleObjects
DrawIcon
SetWindowRgn
InSendMessage
WindowFromDC
CopyAcceleratorTableA
CreateMenu
GetTabbedTextExtentA
SendNotifyMessageA
GetOpenClipboardWindow
GetClipboardOwner
GetClipboardViewer
GetCaretPos
GetInputState
GetQueueStatus
GetProcessWindowStation
GetCursorPos
gdi32
SetAbortProc
AbortDoc
EndDoc
GetViewportOrgEx
Rectangle
CreateEllipticRgn
LPtoDP
Ellipse
GetNearestColor
EndPage
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextColor
GetTextAlign
GetTextFaceA
GetTextExtentPointA
GetWindowOrgEx
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
StartPage
GetBkMode
StretchDIBits
CreateFontA
GetCharWidthA
DPtoLP
PatBlt
GetMapMode
CombineRgn
SetRectRgn
CreateRectRgnIndirect
GetBkColor
CreateCompatibleBitmap
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
CreatePen
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
CreateCompatibleDC
CreatePatternBrush
CreateDIBPatternBrushPt
DeleteDC
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
StartDocA
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
GetDeviceCaps
SetBkColor
SetTextColor
GetClipBox
GetDCOrgEx
GetTextMetricsA
CreateBitmap
DeleteObject
GetStockObject
GetObjectA
CreateFontIndirectA
SelectObject
GetTextExtentPoint32A
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
GetJobA
ClosePrinter
OpenPrinterA
advapi32
LookupPrivilegeValueA
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceA
StartServiceA
OpenSCManagerA
OpenServiceA
SetFileSecurityW
GetFileSecurityW
GetFileSecurityA
SetFileSecurityA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegSetValueA
RegCreateKeyA
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
QueryServiceConfigW
ControlService
RegNotifyChangeKeyValue
SetServiceStatus
QueryServiceStatus
StartServiceW
SetNamedSecurityInfoW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFolderLocation
ShellExecuteA
FindExecutableA
SHGetFileInfoA
ExtractIconA
DragFinish
ShellExecuteExA
DragQueryFileA
comctl32
InitCommonControlsEx
shlwapi
PathRemoveFileSpecW
PathFindFileNameA
PathRemoveExtensionA
PathFindExtensionA
PathIsUNCA
PathAddBackslashA
PathStripToRootA
ole32
CoGetMalloc
StgCreateDocfile
StgOpenStorage
StgIsStorageFile
CreateFileMoniker
CreateDataAdviseHolder
OleSetMenuDescriptor
OleQueryCreateFromData
OleQueryLinkFromData
CoInitialize
GetRunningObjectTable
CreateOleAdviseHolder
CreateGenericComposite
StringFromGUID2
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
CoDisconnectObject
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoTaskMemFree
CreateItemMoniker
OleGetIconOfClass
OleCreateLinkToFile
OleCreateFromFile
OleSetContainedObject
GetHGlobalFromILockBytes
StgOpenStorageOnILockBytes
OleLoad
OleCreate
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleLockRunning
OleSaveToStream
WriteClassStm
OleSave
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
OleRegGetMiscStatus
OleRegEnumVerbs
OleGetClipboard
DoDragDrop
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
CLSIDFromString
OleRun
CLSIDFromProgID
CreateStreamOnHGlobal
OleIsRunning
oleaut32
VarCyFromStr
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarDateFromStr
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
VarBstrFromDate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysAllocString
SafeArrayCreate
dbghelp
MiniDumpWriteDump
SymGetTypeInfo
StackWalk
SymEnumSymbols
SymSetContext
SymFunctionTableAccess
SymGetModuleBase
SymSetOptions
SymLoadModule
SymGetLineFromAddr
SymCleanup
SymInitialize
SymGetModuleInfo
SymFromAddr
imagehlp
ImageGetCertificateHeader
ImageRemoveCertificate
rpcrt4
UuidCreate
secur32
DeleteSecurityContext
FreeCredentialsHandle
QueryContextAttributesA
AcquireCredentialsHandleA
InitializeSecurityContextW
CompleteAuthToken
DecryptMessage
EncryptMessage
ws2_32
ioctlsocket
closesocket
ntohl
htonl
recv
connect
bind
setsockopt
socket
send
shutdown
WSAStartup
htons
getservbyname
WSAIoctl
WSAEnumNetworkEvents
ntohs
getservbyport
WSACleanup
getprotobyname
inet_addr
gethostbyname
recvfrom
sendto
WSAGetLastError
WSASocketA
accept
WSAEventSelect
listen
netapi32
Netbios
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 561KB - Virtual size: 560KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 66KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mixcrt Size: 512B - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 230KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/Ghostexp64.exe.exe windows:5 windows x64 arch:x64
c1df2a90bae867dedcceab4301c66831
Code Sign
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before21/12/2012, 00:00Not After30/12/2020, 23:59SubjectCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate
IssuerCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USNot Before18/10/2012, 00:00Not After29/12/2020, 23:59SubjectCN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before08/11/2006, 00:00Not After07/11/2021, 23:59SubjectCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
10:80:bf:e8:73:b9:31:80:3a:3a:1d:b2:4e:b1:2e:dfCertificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before12/10/2012, 00:00Not After12/10/2014, 23:59SubjectCN=Symantec Corporation,OU=Endpoint Management Group+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Symantec Corporation,L=Lindon,ST=Utah,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
b7:a8:60:3f:f5:69:5f:6a:a2:6b:07:70:ee:df:7a:3e:c7:87:99:33Signer
Actual PE Digestb7:a8:60:3f:f5:69:5f:6a:a2:6b:07:70:ee:df:7a:3e:c7:87:99:33Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
c:\depot\Ghost\GSSTrunk\Ghost\explorer\vs2008\x64\Release\enterprise\GhostExp64.pdb
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
FatalAppExitA
SetConsoleCtrlHandler
GetTimeZoneInformation
CompareStringW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
GetConsoleMode
GetLocaleInfoW
WriteConsoleA
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
GetFullPathNameA
GetModuleFileNameA
GetModuleHandleA
FormatMessageW
ReadProcessMemory
GetOverlappedResult
VirtualUnlock
SetProcessWorkingSetSize
VirtualLock
GetBinaryTypeA
SetProcessAffinityMask
GetCurrentProcess
CloseHandle
GetLastError
GetCurrentThread
SetCurrentDirectoryA
GetDiskFreeSpaceA
GetProcAddress
LoadLibraryA
GetLongPathNameA
WideCharToMultiByte
FindResourceA
SizeofResource
LockResource
LoadResource
MultiByteToWideChar
GetFileAttributesA
lstrcpyA
lstrlenA
FreeLibrary
GlobalAlloc
lstrcmpA
GlobalLock
CompareStringA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetEnvironmentVariableW
GetLocalTime
GetThreadTimes
GetProcessWorkingSetSize
GetProcessTimes
QueryPerformanceCounter
FindResourceW
GetThreadContext
GetFileAttributesExW
FindNextFileW
BackupRead
BackupSeek
SetFileAttributesW
FindFirstFileW
GetFullPathNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
MoveFileW
RemoveDirectoryW
DeleteFileW
CreateDirectoryW
GetFileInformationByHandle
GetDriveTypeW
ExpandEnvironmentStringsW
SetVolumeMountPointW
GetVolumeNameForVolumeMountPointW
DeleteVolumeMountPointW
DefineDosDeviceW
ResetEvent
GetLogicalDrives
GetSystemTime
GlobalMemoryStatus
GetProcessHeap
HeapAlloc
HeapFree
DeviceIoControl
GetWindowsDirectoryA
GetSystemDirectoryA
WaitForMultipleObjects
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
GetProfileIntA
GetCurrentThreadId
GlobalDeleteAtom
SetLastError
GlobalUnlock
SetThreadPriority
ResumeThread
WaitForSingleObject
SetEvent
SuspendThread
CreateEventA
GlobalAddAtomA
GetCurrentProcessId
GetVersionExA
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
FreeResource
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetTickCount
GetModuleFileNameW
MulDiv
GlobalFree
lstrlenW
LocalFree
FormatMessageA
GlobalSize
CopyFileA
MoveFileA
DeleteFileA
GetStringTypeExA
GetThreadLocale
lstrcmpiA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
FindClose
FindFirstFileA
GetVolumeInformationA
GetShortPathNameA
CreateFileA
GetCurrentDirectoryA
GlobalFlags
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
InitializeCriticalSection
TlsAlloc
GlobalReAlloc
GlobalHandle
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GetAtomNameA
FileTimeToSystemTime
SystemTimeToFileTime
GetCPInfo
GetOEMCP
GetModuleHandleW
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesExA
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileSizeEx
GetFileTime
CreateFileW
GetExitCodeThread
CreateThread
RaiseException
IsDebuggerPresent
Sleep
ExitProcess
LoadLibraryW
DebugBreak
GetExitCodeProcess
CreateProcessW
GetFileAttributesW
GetCurrentDirectoryW
SetUnhandledExceptionFilter
TerminateThread
GetLogicalDriveStringsA
GetDriveTypeA
GetTempPathA
GetTempFileNameA
CreateDirectoryA
InitializeCriticalSectionAndSpinCount
RtlCaptureStackBackTrace
FindResourceExA
GetBinaryTypeW
CreateEventW
SetCurrentDirectoryW
LCMapStringA
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
DecodePointer
EncodePointer
GetTimeFormatA
GetDateFormatA
VirtualProtect
ExitThread
GetStartupInfoA
GetCommandLineA
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
GetSystemTimeAsFileTime
GetACP
GetConsoleOutputCP
GetConsoleCP
IsDBCSLeadByteEx
IsValidCodePage
GetStdHandle
OpenProcess
GetStringTypeA
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
GetVersionExW
OutputDebugStringA
user32
IsChild
GetCapture
GetClassLongA
GetClassNameA
GetClassLongPtrA
SetPropA
GetPropA
RemovePropA
IsWindow
SetFocus
GetWindowTextLengthA
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetWindowDC
GetWindowLongPtrA
SetWindowLongPtrA
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
IsDialogMessageA
ScrollWindow
TrackPopupMenuEx
WinHelpA
SetMenu
BeginPaint
EndPaint
GetNextDlgTabItem
IsDlgButtonChecked
SetDlgItemInt
GetKeyState
PeekMessageA
CreateDialogIndirectParamA
GetDesktopWindow
RemoveMenu
InsertMenuA
SetScrollRange
GetScrollRange
AppendMenuA
GetMenuStringA
CharUpperA
DeleteMenu
SetWindowTextA
CheckDlgButton
GetDlgItemTextA
CheckRadioButton
IsWindowVisible
GetActiveWindow
DispatchMessageA
RegisterWindowMessageA
RegisterClipboardFormatA
FillRect
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
TrackPopupMenu
ClientToScreen
GetDlgItemInt
DestroyWindow
MoveWindow
ShowWindow
ScrollWindowEx
TranslateMessage
SendMessageA
GetWindowTextA
UpdateWindow
MessageBoxA
EnumWindows
ReleaseDC
GetClientRect
GetDC
DialogBoxParamA
LoadStringA
GetDlgItem
SetDlgItemTextA
SendDlgItemMessageA
LoadIconA
EndDialog
SetCapture
WindowFromPoint
LoadCursorA
ReleaseCapture
WaitMessage
GetSysColorBrush
DestroyIcon
TranslateAcceleratorA
BringWindowToTop
CreatePopupMenu
InsertMenuItemA
InvalidateRect
LoadAcceleratorsA
GetMenuBarInfo
DestroyMenu
LoadMenuA
ReuseDDElParam
UnpackDDElParam
SetRect
SetTimer
KillTimer
InflateRect
GetMenuItemInfoA
PostThreadMessageA
UnregisterClassA
GetDialogBaseUnits
GetKeyNameTextA
MapVirtualKeyA
IsRectEmpty
GetSystemMenu
SetParent
UnionRect
GetDCEx
LockWindowUpdate
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
MessageBeep
RegisterDeviceNotificationA
MapWindowPoints
wsprintfA
PostQuitMessage
PostMessageA
EnableWindow
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetParent
GetMessageA
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
SetWindowPlacement
GetDlgCtrlID
PtInRect
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetWindowRect
OffsetRect
SetRectEmpty
IsZoomed
GetSystemMetrics
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
ShowOwnedPopups
SetCursor
SetWindowsHookExA
CallNextHookEx
RedrawWindow
SetCursorPos
DestroyCursor
IsClipboardFormatAvailable
MsgWaitForMultipleObjects
DrawIcon
SetWindowRgn
InSendMessage
WindowFromDC
CopyAcceleratorTableA
CreateMenu
GetTabbedTextExtentA
SendNotifyMessageA
GetOpenClipboardWindow
GetClipboardOwner
GetClipboardViewer
GetCaretPos
GetInputState
GetQueueStatus
GetProcessWindowStation
GetCursorPos
gdi32
SetAbortProc
AbortDoc
EndDoc
GetViewportOrgEx
Rectangle
CreateEllipticRgn
LPtoDP
Ellipse
GetNearestColor
EndPage
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextColor
GetTextAlign
GetTextFaceA
GetTextExtentPointA
GetWindowOrgEx
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
StartPage
GetBkMode
StretchDIBits
CreateFontA
GetCharWidthA
DPtoLP
PatBlt
GetMapMode
CombineRgn
SetRectRgn
CreateRectRgnIndirect
GetBkColor
CreateCompatibleBitmap
CreateDCA
CopyMetaFileA
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
CreatePen
GetDeviceCaps
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
CreateCompatibleDC
CreatePatternBrush
CreateDIBPatternBrushPt
DeleteDC
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
StartDocA
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
GetDCOrgEx
GetTextMetricsA
CreateBitmap
DeleteObject
GetStockObject
GetObjectA
CreateFontIndirectA
SelectObject
GetTextExtentPoint32A
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
GetJobA
ClosePrinter
OpenPrinterA
advapi32
LookupPrivilegeValueA
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceA
StartServiceA
OpenSCManagerA
OpenServiceA
SetFileSecurityW
GetFileSecurityW
GetFileSecurityA
SetFileSecurityA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegSetValueA
RegCreateKeyA
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
QueryServiceConfigW
ControlService
RegNotifyChangeKeyValue
SetServiceStatus
QueryServiceStatus
StartServiceW
SetNamedSecurityInfoW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
shell32
SHBrowseForFolderW
SHGetFolderLocation
ShellExecuteA
FindExecutableA
SHGetFileInfoA
ExtractIconA
DragFinish
ShellExecuteExA
DragQueryFileA
SHGetPathFromIDListW
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameA
PathRemoveFileSpecW
PathStripToRootA
PathIsUNCA
PathRemoveExtensionA
PathFindExtensionA
PathAddBackslashA
ole32
CoGetMalloc
StgCreateDocfile
StgOpenStorage
StgIsStorageFile
CreateFileMoniker
CreateDataAdviseHolder
OleSetMenuDescriptor
OleQueryCreateFromData
OleQueryLinkFromData
CoInitialize
GetRunningObjectTable
CreateOleAdviseHolder
CreateGenericComposite
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
CoDisconnectObject
CLSIDFromString
StringFromGUID2
OleDuplicateData
CoTaskMemAlloc
CoSetProxyBlanket
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoInitializeEx
CoCreateInstance
CoUninitialize
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoTaskMemFree
CreateItemMoniker
OleGetIconOfClass
OleCreateLinkToFile
OleCreateFromFile
OleSetContainedObject
GetHGlobalFromILockBytes
StgOpenStorageOnILockBytes
OleLoad
OleCreate
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleLockRunning
OleSaveToStream
WriteClassStm
OleSave
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
OleRegGetMiscStatus
OleRegEnumVerbs
OleGetClipboard
DoDragDrop
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
CoRegisterMessageFilter
OleRun
CLSIDFromProgID
CreateStreamOnHGlobal
OleIsRunning
oleaut32
LoadTypeLi
RegisterTypeLi
VarBstrFromDate
VarCyFromStr
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarDateFromStr
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
LoadRegTypeLi
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysStringLen
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysAllocString
SafeArrayAllocData
dbghelp
MiniDumpWriteDump
SymGetTypeInfo
SymEnumSymbols
SymSetContext
StackWalk64
SymFunctionTableAccess64
SymGetModuleBase64
SymGetLineFromAddr64
SymSetOptions
SymGetModuleInfo64
SymInitialize
SymLoadModule64
SymFromAddr
SymCleanup
imagehlp
ImageGetCertificateHeader
ImageRemoveCertificate
rpcrt4
UuidCreate
secur32
DecryptMessage
CompleteAuthToken
InitializeSecurityContextW
AcquireCredentialsHandleA
QueryContextAttributesA
FreeCredentialsHandle
DeleteSecurityContext
EncryptMessage
ws2_32
ioctlsocket
closesocket
ntohl
htonl
recv
connect
bind
setsockopt
socket
send
shutdown
WSAStartup
htons
getservbyname
WSAIoctl
WSAEnumNetworkEvents
ntohs
getservbyport
WSACleanup
getprotobyname
inet_addr
gethostbyname
recvfrom
sendto
WSAGetLastError
WSASocketA
accept
WSAEventSelect
listen
netapi32
Netbios
Sections
.text Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 85KB - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 358KB - Virtual size: 358KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mixcrt Size: 512B - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 230KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/ghost32.dmp
-
Norton Ghost 12 + Ghost Explorer 2013 (x32-x64) Portable [ENDO]/ghstwarn.txt