c:\Projects\VS2005\BrowserDownloadsView\x64\Release\BrowserDownloadsView.pdb
Overview
overview
9Static
static
9ExCraft Kontrol.rar
windows10-1703-x64
3BrowserDow...ew.cfg
windows10-1703-x64
3BrowserDow...ew.chm
windows10-1703-x64
1BrowserDow...ew.exe
windows10-1703-x64
7Everything...up.exe
windows10-1703-x64
4$PLUGINSDI...ng.exe
windows10-1703-x64
6$PLUGINSDI...se.txt
windows10-1703-x64
1$PLUGINSDI...ns.dll
windows10-1703-x64
3$PLUGINSDI...ns.ini
windows10-1703-x64
1$PLUGINSDI...s2.ini
windows10-1703-x64
1$PLUGINSDI...LL.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...al.ini
windows10-1703-x64
1$PLUGINSDI...rd.bmp
windows10-1703-x64
4Journal-To...ce.exe
windows10-1703-x64
3Journal-To...ol.exe
windows10-1703-x64
9LastActivi...ew.chm
windows10-1703-x64
1LastActivi...ew.exe
windows10-1703-x64
4Okuyun
windows10-1703-x64
1Process Ha... 2.lnk
windows10-1703-x64
3ShellBag/s...er.exe
windows10-1703-x64
3ShellBag/s...er.ini
windows10-1703-x64
1USBDriveLo...og.chm
windows10-1703-x64
1USBDriveLo...og.exe
windows10-1703-x64
3WinPrefetc...ew.chm
windows10-1703-x64
1WinPrefetc...ew.exe
windows10-1703-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ExCraft Kontrol.rar
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
BrowserDownloadView/BrowserDownloadsView.cfg
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
BrowserDownloadView/BrowserDownloadsView.chm
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral4
Sample
BrowserDownloadView/BrowserDownloadsView.exe
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
Everything/Everything-1.4.1.1024.x64-Setup.exe
Resource
win10-20240611-en
windows10-1703-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Everything/Everything.exe
Resource
win10-20240404-en
windows10-1703-x64
5 signatures
300 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Everything/License.txt
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
300 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.ini
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions2.ini
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
300 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240611-en
windows10-1703-x64
3 signatures
300 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10-20240404-en
windows10-1703-x64
6 signatures
300 seconds
Behavioral task
behavioral15
Sample
Journal-Tool/JournalTrace.exe
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral16
Sample
Journal-Tool/journal-tool.exe
Resource
win10-20240404-en
windows10-1703-x64
5 signatures
300 seconds
Behavioral task
behavioral17
Sample
LastActivityView/LastActivityView.chm
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral18
Sample
LastActivityView/LastActivityView.exe
Resource
win10-20240404-en
windows10-1703-x64
4 signatures
300 seconds
Behavioral task
behavioral19
Sample
Okuyun
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
Process Hacker 2/Process Hacker 2.lnk
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral21
Sample
ShellBag/shellbag_analyzer_cleaner.exe
Resource
win10-20240404-en
windows10-1703-x64
2 signatures
300 seconds
Behavioral task
behavioral22
Sample
ShellBag/shellbag_analyzer_cleaner.ini
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral23
Sample
USBDriveLog/USBDriveLog.chm
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
USBDriveLog/USBDriveLog.exe
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral25
Sample
WinPrefetchView/WinPrefetchView.chm
Resource
win10-20240611-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral26
Sample
WinPrefetchView/WinPrefetchView.exe
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
300 seconds
General
-
Target
ExCraft Kontrol.rar
-
Size
8.7MB
-
MD5
8862a68e7c9587bd19881bd5c154044b
-
SHA1
c0c3fd9193846e34bc0eecb90fb93a4b8e8614c4
-
SHA256
405fb6100da747fa137b3192788160ab05b3507a7c62e0269de4f5318fd48bcd
-
SHA512
74add8c1a284b8192730fe44da09f8a04f1598cbc373782705b0deec2399653aa3f5913c42fc5eaef777f1e4c71deae089fe8ccd3f3d96a631ac1b1999563366
-
SSDEEP
196608:fp8JD3f091p+aIIYHi0zE2EZAe1Eror0oASxnlu90Mqps3vL6m:2h389qh1zh9xorDxw90A/L6m
Score
9/10
Malware Config
Signatures
-
Detected Nirsoft tools 2 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/LastActivityView/LastActivityView.exe Nirsoft static1/unpack001/WinPrefetchView/WinPrefetchView.exe Nirsoft -
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/BrowserDownloadView/BrowserDownloadsView.exe unpack003/$PLUGINSDIR/InstallOptions.dll unpack003/$PLUGINSDIR/LangDLL.dll unpack003/$PLUGINSDIR/System.dll unpack001/Journal-Tool/JournalTrace.exe unpack001/USBDriveLog/USBDriveLog.exe
Files
-
ExCraft Kontrol.rar.rar
Password: a
-
BrowserDownloadView/BrowserDownloadsView.cfg
-
BrowserDownloadView/BrowserDownloadsView.chm.chm
-
BrowserDownloadView/BrowserDownloadsView.exe.exe windows:4 windows x64 arch:x64
Password: a
1ae3ae5ddfc4378d6fe55e27ce846a3c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvcrt
_c_exit
_exit
_cexit
wcsncat
exit
_endthreadex
strftime
_gmtime64
strcmp
_beginthreadex
realloc
_msize
calloc
_XcptFilter
_wcslwr
strlen
qsort
_wcsnicmp
memmove
free
_wcsicmp
modf
wcschr
memcmp
wcstoul
sprintf
strchr
__C_specific_handler
_onexit
__dllonexit
atoi
wcscmp
malloc
swscanf
_memicmp
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memcpy
_itow
_wtoi
_purecall
wcslen
wcscpy
memset
wcscat
_snwprintf
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
_stricmp
_wcsupr
wcsrchr
_strcmpi
comctl32
ImageList_Create
ord17
ImageList_Add
ImageList_AddMasked
ImageList_SetImageCount
CreateStatusWindowW
CreateToolbarEx
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
kernel32
GetCurrentThreadId
HeapAlloc
DeleteCriticalSection
SetEndOfFile
HeapSize
InitializeCriticalSection
FormatMessageA
HeapCompact
FlushFileBuffers
CreateMutexW
GetProcessHeap
GetSystemInfo
UnlockFileEx
CreateFileA
OutputDebugStringA
LockFileEx
EnterCriticalSection
QueryPerformanceCounter
GetDiskFreeSpaceW
CopyFileW
GetStartupInfoW
GetFileAttributesExW
HeapReAlloc
OutputDebugStringW
DeleteFileA
GetDiskFreeSpaceA
FileTimeToSystemTime
SystemTimeToFileTime
GetDriveTypeW
CompareFileTime
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleW
LoadLibraryW
GetTickCount
GlobalLock
GlobalAlloc
GlobalUnlock
lstrcpyW
GetLocaleInfoW
GetFileSize
GetTempPathW
LocalFileTimeToFileTime
SizeofResource
GetLastError
FindFirstFileW
FormatMessageW
SetFilePointer
GetVersionExW
FindNextFileW
GetTimeFormatW
FindClose
GetFileAttributesW
WriteFile
FindResourceW
TzSpecificLocalTimeToSystemTime
ReadFile
LoadResource
GetModuleFileNameW
SystemTimeToTzSpecificLocalTime
CreateFileW
CloseHandle
LoadLibraryExW
GetWindowsDirectoryW
GetSystemDirectoryW
FileTimeToLocalFileTime
WideCharToMultiByte
MultiByteToWideChar
GetNumberFormatW
GetDateFormatW
lstrlenW
LockResource
GetTempFileNameW
LocalFree
GetCurrentProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetPrivateProfileStringW
EnumResourceNamesW
WritePrivateProfileStringW
GetPrivateProfileIntW
FreeLibrary
GetStdHandle
GetCurrentDirectoryW
GlobalFree
DeleteFileW
SetErrorMode
CreateProcessW
Sleep
ResumeThread
CreateThread
ExpandEnvironmentStringsW
ExitProcess
GetCurrentProcessId
ReadProcessMemory
OpenProcess
EnumResourceTypesW
GetVersionExA
HeapFree
HeapDestroy
LeaveCriticalSection
WaitForSingleObject
GetFileAttributesA
CreateFileMappingA
HeapCreate
UnlockFile
HeapValidate
FlushViewOfFile
GetFullPathNameW
GetTempPathA
LockFile
GetFullPathNameA
GetSystemTime
WaitForSingleObjectEx
AreFileApisANSI
user32
SetForegroundWindow
CallWindowProcW
RegisterWindowMessageW
RemoveMenu
IsDialogMessageW
InsertMenuW
RegisterClipboardFormatW
SetWindowPlacement
MonitorFromWindow
GetDC
ReleaseDC
SetCursor
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
SetWindowPos
GetWindow
SendDlgItemMessageW
EndDialog
GetDlgItem
DrawFrameControl
SetWindowTextW
UpdateWindow
SendMessageW
InvalidateRect
SetDlgItemTextW
GetWindowRect
GetDlgItemTextW
SetWindowLongPtrW
GetDlgItemInt
GetWindowPlacement
GetSystemMetrics
SetDlgItemInt
EndPaint
DeferWindowPos
BeginPaint
CreateWindowExW
GetClientRect
SetMenu
TranslateAcceleratorW
GetForegroundWindow
LoadAcceleratorsW
DefWindowProcW
RegisterClassW
PostMessageW
MessageBoxW
LoadImageW
DestroyIcon
GetSysColor
SetWindowLongW
GetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
GetParent
GetFocus
KillTimer
SetTimer
OpenClipboard
GetSubMenu
InsertMenuItemW
CheckMenuItem
GetMenuItemCount
SetClipboardData
GetCursorPos
CheckMenuRadioItem
EnableWindow
GetMenuStringW
MapWindowPoints
CloseClipboard
GetMenu
MoveWindow
EmptyClipboard
EnableMenuItem
GetClassNameW
TranslateMessage
DispatchMessageW
CreateDialogParamW
DialogBoxParamW
EnumChildWindows
LoadStringW
GetDesktopWindow
DestroyWindow
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
GetKeyState
CreatePopupMenu
LoadIconW
SetMenuItemInfoW
TrackPopupMenu
PostQuitMessage
DrawTextExW
GetMessageW
GetMonitorInfoW
gdi32
SetStretchBltMode
CreateCompatibleBitmap
StretchBlt
GetObjectW
DeleteDC
GetPixel
SetPixel
SelectObject
CreateCompatibleDC
SetTextColor
CreateFontIndirectW
GetDeviceCaps
SetBkMode
DeleteObject
SetBkColor
GetTextExtentPoint32W
GetStockObject
comdlg32
GetSaveFileNameW
ChooseFontW
FindTextW
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
CryptHashData
CryptDestroyHash
shell32
Shell_NotifyIconW
SHBindToParent
SHGetDesktopFolder
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
ShellExecuteW
ShellExecuteExW
ole32
DoDragDrop
OleInitialize
OleUninitialize
Sections
.text Size: 367KB - Virtual size: 367KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Everything/Everything-1.4.1.1024.x64-Setup.exe.exe windows:4 windows x86 arch:x86
Password: a
61259b55b8912888e90f516ca08dc514
Code Sign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29/04/2021, 00:00Not After28/04/2036, 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
03:0f:a0:91:94:b2:2d:c5:1d:00:65:31:c9:c1:61:04Certificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before21/12/2021, 00:00Not After17/03/2025, 23:59SubjectCN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AUExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before21/09/2022, 00:00Not After21/11/2033, 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
b5:5d:a9:cb:22:0f:84:e1:18:3f:d7:25:dd:1b:ec:6a:f5:ee:61:f2:fd:1e:66:63:85:74:38:a0:e9:44:33:eaSigner
Actual PE Digestb5:5d:a9:cb:22:0f:84:e1:18:3f:d7:25:dd:1b:ec:6a:f5:ee:61:f2:fd:1e:66:63:85:74:38:a0:e9:44:33:eaDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 136KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/Everything/Everything.exe.exe windows:4 windows x64 arch:x64
Password: a
d67c7cffdc58fd075aa466c7917d6010
Code Sign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29/04/2021, 00:00Not After28/04/2036, 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
03:0f:a0:91:94:b2:2d:c5:1d:00:65:31:c9:c1:61:04Certificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before21/12/2021, 00:00Not After17/03/2025, 23:59SubjectCN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AUExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before21/09/2022, 00:00Not After21/11/2033, 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
4b:dd:dc:90:28:fb:53:b2:c7:4b:ac:95:5f:6d:b0:5a:a2:a6:13:8a:51:6b:dd:75:0c:d0:7a:46:4d:3d:4c:12Signer
Actual PE Digest4b:dd:dc:90:28:fb:53:b2:c7:4b:ac:95:5f:6d:b0:5a:a2:a6:13:8a:51:6b:dd:75:0c:d0:7a:46:4d:3d:4c:12Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
comctl32
ImageList_GetIconSize
ImageList_DrawEx
_TrackMouseEvent
InitCommonControlsEx
ws2_32
WSAGetLastError
WSACleanup
closesocket
send
recv
connect
WSAAsyncSelect
setsockopt
socket
WSAStartup
shutdown
listen
bind
getpeername
ntohs
getsockname
accept
inet_addr
htons
gethostbyname
shlwapi
SHRegGetUSValueW
PathIsRootW
PathCombineW
PathRemoveFileSpecW
kernel32
GetSystemTime
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
GetSystemDefaultLangID
LoadLibraryA
CopyFileW
TerminateProcess
OpenProcess
CreateMutexW
SetLastError
GetStartupInfoW
HeapAlloc
GetProcessHeap
HeapFree
VirtualAlloc
VirtualFree
QueryDosDeviceW
SetErrorMode
DeleteFileW
RemoveDirectoryW
MoveFileW
MoveFileExW
CreateDirectoryW
GetFileAttributesW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetComputerNameW
GetVolumeInformationW
GetDiskFreeSpaceW
GetFullPathNameW
GetFileSize
FindFirstFileW
FindNextFileW
GetDriveTypeW
GetThreadPriority
CreateEventW
GetProcAddress
FreeLibrary
GetModuleFileNameW
FileTimeToSystemTime
GetCurrentDirectoryW
GetFileAttributesExW
LocalFileTimeToFileTime
SystemTimeToFileTime
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
__C_specific_handler
WaitForMultipleObjects
GetSystemDirectoryW
LoadLibraryW
ExpandEnvironmentStringsW
GetSystemInfo
GetVersionExA
LocalFree
LocalAlloc
ConnectNamedPipe
CreateNamedPipeW
GetTimeZoneInformation
MulDiv
GetTimeFormatW
GetNumberFormatW
GetDateFormatW
MultiByteToWideChar
HeapCreate
HeapSetInformation
GetModuleFileNameA
FlsAlloc
TlsSetValue
FlsFree
TlsFree
FlsSetValue
FlsGetValue
GetModuleHandleA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
CreateThread
ExitThread
SetFilePointer
GetTempPathW
CreateFileW
FreeConsole
AllocConsole
SetStdHandle
SetConsoleScreenBufferSize
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
WriteFile
FlushFileBuffers
GetStdHandle
GetFileType
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
WriteConsoleW
GetLocaleInfoW
GetCalendarInfoW
DeviceIoControl
GetOverlappedResult
ResetEvent
Sleep
FindNextChangeNotification
FindFirstChangeNotificationW
GetFileInformationByHandle
GetLocalTime
FindCloseChangeNotification
FindClose
GetSystemTimeAsFileTime
GetCurrentThread
SetThreadPriority
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
GetTickCount
LeaveCriticalSection
SetEvent
GetCommandLineW
GetCurrentThreadId
GetModuleHandleW
ReadFile
GetLastError
CloseHandle
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetCurrentProcessId
HeapReAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
GetWindowsDirectoryW
user32
IsWindowVisible
SetCursor
SetCapture
ChangeClipboardChain
DrawEdge
DrawFrameControl
EqualRect
GetSubMenu
GetMenu
SetClipboardViewer
EnumWindows
ActivateKeyboardLayout
LoadIconW
IsDlgButtonChecked
SetScrollInfo
UpdateWindow
ScrollWindowEx
SetDlgItemInt
GetMenuState
RemoveMenu
GetMenuItemID
GetMenuDefaultItem
EnableMenuItem
AdjustWindowRect
GetSysColorBrush
OffsetRect
InvalidateRgn
MessageBeep
SetCursorPos
GetDlgItemInt
GetDlgCtrlID
SendDlgItemMessageW
GetDesktopWindow
ValidateRect
CharLowerW
CharUpperW
CreateIconIndirect
UnregisterHotKey
PostQuitMessage
IsClipboardFormatAvailable
OpenIcon
GetForegroundWindow
AttachThreadInput
SetActiveWindow
BringWindowToTop
EnumChildWindows
CheckDlgButton
GetMenuItemInfoW
GetKeyboardLayoutList
LoadCursorW
GetScrollInfo
InvalidateRect
ClientToScreen
ScreenToClient
ShowWindow
IsIconic
GetWindowPlacement
IsZoomed
GetWindowTextLengthW
GetWindowTextW
GetParent
CopyRect
EmptyClipboard
SetClipboardData
GetWindowLongPtrW
SetWindowLongPtrW
SetFocus
PtInRect
FindWindowW
InsertMenuW
SetDlgItemTextW
SetForegroundWindow
BeginPaint
EndPaint
OpenClipboard
GetClipboardData
CloseClipboard
FillRect
CreateWindowExW
GetClassInfoExW
RegisterClassExW
GetAsyncKeyState
GetClientRect
GetCapture
GetLastActivePopup
ReleaseCapture
IsWindowEnabled
GetFocus
GetNextDlgTabItem
EnableWindow
SetWindowPos
SetWindowTextW
SetWindowLongW
MessageBoxW
DialogBoxIndirectParamW
DrawTextW
GetMenuItemCount
CreatePopupMenu
AppendMenuW
DeleteMenu
SetMenuItemInfoW
GetWindowLongW
AdjustWindowRectEx
CallWindowProcW
GetDlgItem
GetWindowRect
MapWindowPoints
IntersectRect
GetMonitorInfoW
SystemParametersInfoW
GetDC
ReleaseDC
SetWindowsHookExW
PeekMessageW
WaitMessage
SetMenu
RegisterClipboardFormatW
RedrawWindow
GetMessagePos
RegisterWindowMessageA
ReplyMessage
GetCursorPos
CreateMenu
SetMenuDefaultItem
TrackPopupMenu
DestroyMenu
KillTimer
GetDoubleClickTime
GetKeyState
RegisterHotKey
PostThreadMessageW
GetSysColor
EndDialog
PostMessageW
DestroyIcon
SetTimer
DestroyWindow
DefWindowProcW
SendMessageTimeoutW
GetWindowThreadProcessId
IsWindow
GetKeyNameTextW
MapVirtualKeyExW
GetKeyboardLayout
UnhookWindowsHookEx
CallNextHookEx
GetClassNameW
SendMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetSystemMetrics
LoadImageW
CreateDialogIndirectParamW
gdi32
GetDeviceCaps
GetDIBits
SelectClipRgn
TextOutW
SetStretchBltMode
SetTextAlign
CreateCompatibleBitmap
OffsetClipRgn
OffsetRgn
CombineRgn
GetDCOrgEx
GetRandomRgn
EnumFontFamiliesExW
GetTextAlign
CreateCompatibleDC
BitBlt
StretchDIBits
GetRegionData
ExtCreateRegion
GetObjectW
CreateFontIndirectW
GetStockObject
GetNearestColor
CreateSolidBrush
CreateRectRgn
CreateDIBSection
GetCurrentObject
ExcludeClipRect
RectVisible
GetTextExtentExPointW
GetTextExtentPoint32W
DeleteDC
SetBkMode
CreateBitmapIndirect
CreatePatternBrush
SetBrushOrgEx
SetBkColor
SetTextColor
PatBlt
SelectObject
GetTextMetricsW
StretchBlt
DeleteObject
comdlg32
GetOpenFileNameW
GetSaveFileNameW
ChooseColorW
CommDlgExtendedError
advapi32
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
DeleteService
CloseServiceHandle
RegOpenKeyA
RegQueryValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
QueryServiceConfigW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyW
RegCloseKey
RegDeleteKeyW
GetUserNameW
QueryServiceStatusEx
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CreateServiceW
StartServiceW
OpenSCManagerW
OpenServiceW
ControlService
SetServiceStatus
shell32
DragFinish
DragAcceptFiles
Shell_NotifyIconW
SHBrowseForFolderW
SHGetFileInfoW
DragQueryFileW
SHGetSpecialFolderLocation
ord16
SHFileOperationW
ShellExecuteExW
SHGetDesktopFolder
SHGetPathFromIDListW
SHChangeNotify
DragQueryPoint
ole32
CoTaskMemFree
OleUninitialize
OleInitialize
CoCreateInstance
CoInitializeEx
CoUninitialize
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemAlloc
RevokeDragDrop
DoDragDrop
RegisterDragDrop
ReleaseStgMedium
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 302KB - Virtual size: 302KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 71KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/Everything/License.txt
-
$PLUGINSDIR/InstallOptions.dll.dll windows:4 windows x86 arch:x86
Password: a
4b45b7e00344a87332fbd12653854d1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentDirectoryW
GlobalUnlock
GlobalLock
GetModuleHandleW
CloseHandle
SetEndOfFile
SetCurrentDirectoryW
GetPrivateProfileStringW
GetPrivateProfileIntW
MultiByteToWideChar
ReadFile
GetFileSize
CreateFileW
lstrcmpiW
lstrcatW
lstrcpynW
WritePrivateProfileStringW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc
WriteFile
SetFilePointer
user32
LoadCursorW
SetWindowRgn
GetDlgCtrlID
CloseClipboard
DrawFocusRect
OpenClipboard
DrawTextW
SetCursor
LoadIconW
LoadImageW
SetWindowLongW
CreateWindowExW
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamW
GetClientRect
ShowWindow
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
CallWindowProcW
PostMessageW
MessageBoxW
GetSysColor
CharNextW
wsprintfW
GetWindowTextW
SetWindowTextW
SendMessageW
GetWindowLongW
EnableMenuItem
PtInRect
MapWindowPoints
GetClipboardData
gdi32
SetTextColor
DeleteObject
CombineRgn
CreateRectRgn
GetDIBits
SelectObject
CreateCompatibleDC
GetObjectW
shell32
SHGetDesktopFolder
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
comdlg32
GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Exports
Exports
dialog
initDialog
make_unicode
show
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/InstallOptions.ini
-
$PLUGINSDIR/InstallOptions2.ini
-
$PLUGINSDIR/LangDLL.dll.dll windows:4 windows x86 arch:x86
Password: a
3e8d18bb71c7ebbda2ddc2a4bb03547b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrlenW
GlobalFree
lstrcpynW
lstrcmpW
GlobalAlloc
MulDiv
GetModuleHandleW
lstrcpyW
user32
DialogBoxParamW
SetDlgItemTextW
SendDlgItemMessageW
EndDialog
SetWindowTextW
LoadIconW
ShowWindow
SendMessageW
GetDC
gdi32
GetDeviceCaps
CreateFontIndirectW
DeleteObject
Exports
Exports
LangDialog
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 681B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/System.dll.dll windows:4 windows x86 arch:x86
Password: a
fc0224e99e736751432961db63a41b76
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Exports
Exports
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 867B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 662B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/ioSpecial.ini
-
$PLUGINSDIR/modern-wizard.bmp
-
Journal-Tool/JournalTrace.exe.exe windows:4 windows x86 arch:x86
Password: a
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\Users\Computador\Downloads\JournalTrace\JournalTrace\obj\Debug\JournalTrace.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Journal-Tool/journal-tool.exe.exe windows:6 windows x64 arch:x64
Password: a
Code Sign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29/04/2021, 00:00Not After28/04/2036, 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
01:8c:52:ec:df:d9:ae:65:be:45:96:45:8b:4c:31:afCertificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before02/12/2021, 00:00Not After16/12/2022, 23:59SubjectSERIALNUMBER=13017981,CN=Inspect Element Ltd,O=Inspect Element Ltd,L=POOLE,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6eExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before29/03/2022, 00:00Not After14/03/2033, 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ae:b0:d3:11:06:0f:81:c0:90:8a:80:09:1d:6e:b8:c9:fb:6c:f9:db:37:ef:b0:ed:2d:41:9f:18:3a:c3:0b:f6Signer
Actual PE Digestae:b0:d3:11:06:0f:81:c0:90:8a:80:09:1d:6e:b8:c9:fb:6c:f9:db:37:ef:b0:ed:2d:41:9f:18:3a:c3:0b:f6Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
_cgo_dummy_export
glowDebugCallback_glcore32
goCharCB
goCharModsCB
goCursorEnterCB
goCursorPosCB
goDropCB
goErrorCB
goFramebufferSizeCB
goJoystickCB
goKeyCB
goMarkdownImageCallback
goMonitorCB
goMouseButtonCB
goScrollCB
goWindowCloseCB
goWindowContentScaleCB
goWindowFocusCB
goWindowIconifyCB
goWindowMaximizeCB
goWindowPosCB
goWindowRefreshCB
goWindowSizeCB
iggAssert
iggInputTextCallback
iggIoGetClipboardText
iggIoSetClipboardText
Sections
.text Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 618KB - Virtual size: 617KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 8.6MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 1024B - Virtual size: 754B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.edata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
LastActivityView/LastActivityView.chm.chm
-
LastActivityView/LastActivityView.exe.exe windows:4 windows x86 arch:x86
3fbcb180ebbfb0ad62cf50d337af18c5
Code Sign
f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7Certificate
IssuerCN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before09/09/2019, 00:00Not After09/09/2023, 23:59SubjectCN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=ILExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/11/2018, 00:00Not After31/12/2030, 23:59SubjectCN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
86:d0:50:e9:bb:2f:ee:a9:26:74:b9:34:ef:82:25:c8:43:e0:7f:b7:d0:98:e5:f2:8e:e8:20:f8:95:33:8c:05Signer
Actual PE Digest86:d0:50:e9:bb:2f:ee:a9:26:74:b9:34:ef:82:25:c8:43:e0:7f:b7:d0:98:e5:f2:8e:e8:20:f8:95:33:8c:05Digest Algorithmsha256PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\Projects\VS2005\LastActivityView\Release\LastActivityView.pdb
Imports
msvcrt
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__p__fmode
exit
_cexit
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
_msize
__set_app_type
_controlfp
_except_handler3
_wcmdln
calloc
realloc
_purecall
_wcslwr
strlen
_itow
_wcsnicmp
qsort
free
modf
_memicmp
_wtoi
memcmp
wcstoul
wcsrchr
swscanf
malloc
_ultow
wcscmp
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
wcslen
wcscpy
memset
_wcsicmp
wcschr
_snwprintf
wcscat
wcsncat
comctl32
CreateToolbarEx
CreateStatusWindowW
ImageList_SetImageCount
ImageList_Create
ord17
ImageList_Add
ImageList_AddMasked
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
kernel32
GetCurrentProcessId
ExitProcess
GetLogicalDrives
GetLongPathNameW
QueryDosDeviceW
GetVolumeInformationW
OpenProcess
EnumResourceTypesW
GetModuleHandleA
GetStartupInfoW
GetModuleHandleW
ReadProcessMemory
SetErrorMode
DeleteFileW
CloseHandle
GetFileSize
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetDriveTypeW
CompareFileTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetTickCount
GetWindowsDirectoryW
ExpandEnvironmentStringsW
GetLastError
GetDateFormatW
FindNextFileW
SizeofResource
GetTempFileNameW
GlobalLock
FormatMessageW
FindFirstFileW
GetVersionExW
FindClose
GetTimeFormatW
GetFileAttributesW
FileTimeToLocalFileTime
ReadFile
FindResourceW
WriteFile
GetModuleFileNameW
LocalFree
LoadResource
CreateFileW
TzSpecificLocalTimeToSystemTime
LockResource
SystemTimeToTzSpecificLocalTime
lstrcpyW
MultiByteToWideChar
lstrlenW
LocalFileTimeToFileTime
LoadLibraryExW
GlobalAlloc
GetSystemDirectoryW
GlobalUnlock
WideCharToMultiByte
GetTempPathW
GetCurrentProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetStdHandle
user32
ChildWindowFromPoint
LoadCursorW
SetCursor
GetSysColorBrush
ShowWindow
GetDlgItemInt
SetDlgItemInt
DeferWindowPos
CreateWindowExW
BeginPaint
EndPaint
GetWindow
GetClientRect
SendDlgItemMessageW
DrawFrameControl
EndDialog
SetWindowLongW
GetDlgItem
SetWindowTextW
UpdateWindow
SendMessageW
SetDlgItemTextW
InvalidateRect
GetDlgItemTextW
GetWindowRect
GetSystemMetrics
RegisterClassW
PostMessageW
MessageBoxW
TranslateAcceleratorW
SetMenu
SetWindowPos
GetWindowPlacement
LoadAcceleratorsW
DefWindowProcW
LoadImageW
GetSysColor
GetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
KillTimer
SetTimer
GetParent
OpenClipboard
CheckMenuItem
GetMenuStringW
GetMenuItemCount
CloseClipboard
CheckMenuRadioItem
SetClipboardData
EnableWindow
GetCursorPos
MapWindowPoints
GetMenu
GetSubMenu
GetDC
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
MoveWindow
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
DestroyWindow
LoadStringW
GetDesktopWindow
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DestroyIcon
LoadIconW
GetKeyState
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
GetMessageW
DispatchMessageW
IsDialogMessageW
TranslateMessage
DrawTextExW
CreatePopupMenu
CallWindowProcW
gdi32
CreateFontIndirectW
SetTextColor
DeleteObject
DeleteDC
GetObjectW
SetBkMode
GetStockObject
GetTextExtentPoint32W
SetBkColor
GetDeviceCaps
GetPixel
SetPixel
SelectObject
CreateCompatibleDC
comdlg32
FindTextW
GetSaveFileNameW
advapi32
RegOpenKeyExW
RegConnectRegistryW
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
OpenSCManagerW
ControlService
StartServiceW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
RegCloseKey
shell32
SHGetFileInfoW
ShellExecuteW
SHGetMalloc
SHBindToParent
SHGetDesktopFolder
SHGetPathFromIDListW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
VariantTimeToSystemTime
SysFreeString
SysAllocString
Sections
.text Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Okuyun
-
Process Hacker 2/Process Hacker 2.exe.lnk
-
ShellBag/shellbag_analyzer_cleaner.exe.exe windows:4 windows x86 arch:x86
Code Sign
a3:fb:da:e5:43:2e:e4:4d:42:f2:6c:b2:68:e0:93:19Certificate
IssuerCN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before18/11/2020, 00:00Not After18/11/2023, 23:59SubjectCN=Goversoft LLC,O=Goversoft LLC,POSTALCODE=19958,STREET=16192 Coastal Hwy,L=Lewes,ST=Delaware,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate
IssuerCN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before12/03/2019, 00:00Not After31/12/2028, 23:59SubjectCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/11/2018, 00:00Not After31/12/2030, 23:59SubjectCN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23/10/2020, 00:00Not After22/01/2032, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
a3:fb:da:e5:43:2e:e4:4d:42:f2:6c:b2:68:e0:93:19Certificate
IssuerCN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before18/11/2020, 00:00Not After18/11/2023, 23:59SubjectCN=Goversoft LLC,O=Goversoft LLC,POSTALCODE=19958,STREET=16192 Coastal Hwy,L=Lewes,ST=Delaware,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate
IssuerCN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before12/03/2019, 00:00Not After31/12/2028, 23:59SubjectCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/11/2018, 00:00Not After31/12/2030, 23:59SubjectCN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23/10/2020, 00:00Not After22/01/2032, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
fe:19:d7:74:64:01:11:5e:de:91:87:12:ed:d3:18:7f:fa:33:2f:be:bd:2f:ea:bd:87:54:4f:35:f6:f9:7b:5dSigner
Actual PE Digestfe:19:d7:74:64:01:11:5e:de:91:87:12:ed:d3:18:7f:fa:33:2f:be:bd:2f:ea:bd:87:54:4f:35:f6:f9:7b:5dDigest Algorithmsha256PE Digest Matchestrueda:cb:dd:fd:85:21:95:53:6d:9e:b5:0d:2a:19:50:80:d9:0f:d1:c4Signer
Actual PE Digestda:cb:dd:fd:85:21:95:53:6d:9e:b5:0d:2a:19:50:80:d9:0f:d1:c4Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 970KB - Virtual size: 970KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 6KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 36B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 397KB - Virtual size: 397KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
ShellBag/shellbag_analyzer_cleaner.ini
-
USBDriveLog/USBDriveLog.chm.chm
-
USBDriveLog/USBDriveLog.exe.exe windows:4 windows x86 arch:x86
b055c74850f128e9631f82c582ada8ec
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\Projects\VS2005\USBDriveLog\Release\USBDriveLog.pdb
Imports
msvcrt
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_onexit
__p__commode
qsort
_itow
memmove
wcsrchr
wcstoul
towupper
wcscmp
wcsncmp
_wcslwr
strlen
malloc
__p__fmode
__set_app_type
_controlfp
_except_handler3
__dllonexit
swscanf
_wcsnicmp
_wcsicmp
free
modf
wcschr
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
wcslen
_purecall
_ultow
_wtoi
wcscpy
memset
_snwprintf
wcsncat
wcscat
comctl32
ImageList_ReplaceIcon
ImageList_Create
ord17
ImageList_Add
ImageList_AddMasked
ImageList_SetImageCount
CreateToolbarEx
CreateStatusWindowW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
OpenProcess
ReadProcessMemory
GetCurrentProcessId
ExitProcess
GetCurrentDirectoryW
SetErrorMode
EnumResourceTypesW
GetSystemTimeAsFileTime
GetModuleHandleA
GetStartupInfoW
GetSystemDirectoryW
ExpandEnvironmentStringsW
DeleteFileW
GetStdHandle
SystemTimeToFileTime
FileTimeToSystemTime
CompareFileTime
GetModuleHandleW
LoadLibraryW
GetProcAddress
LockResource
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
LocalFree
GetCurrentProcess
GlobalUnlock
GetDateFormatW
lstrcpyW
GetTempPathW
GetLocaleInfoW
LocalFileTimeToFileTime
GetFileSize
GlobalLock
GetLastError
FindFirstFileW
SizeofResource
FindNextFileW
FormatMessageW
GetVersionExW
FindClose
FindResourceW
GetTimeFormatW
LoadResource
GetFileAttributesW
WriteFile
SystemTimeToTzSpecificLocalTime
CloseHandle
GetWindowsDirectoryW
ReadFile
FileTimeToLocalFileTime
LoadLibraryExW
GetModuleFileNameW
CreateFileW
GetNumberFormatW
GlobalAlloc
WritePrivateProfileStringW
GetPrivateProfileIntW
FreeLibrary
GetPrivateProfileStringW
EnumResourceNamesW
GetTickCount
user32
GetMonitorInfoW
MonitorFromWindow
RemoveMenu
InsertMenuW
TranslateMessage
IsDialogMessageW
ReleaseDC
LoadCursorW
GetSysColorBrush
SetCursor
ShowWindow
GetMessageW
GetDC
SetDlgItemInt
GetDlgItemInt
GetWindow
CreateWindowExW
BeginPaint
GetClientRect
EndPaint
SetWindowPos
DrawFrameControl
SendDlgItemMessageW
EndDialog
SetWindowTextW
SetWindowLongW
GetDlgItem
UpdateWindow
SendMessageW
SetDlgItemTextW
GetDlgItemTextW
InvalidateRect
GetSystemMetrics
GetWindowPlacement
GetWindowRect
DeferWindowPos
GetForegroundWindow
LoadAcceleratorsW
DefWindowProcW
RegisterClassW
MessageBoxW
PostMessageW
TranslateAcceleratorW
SetMenu
LoadImageW
LoadIconW
GetSysColor
GetWindowLongW
SetFocus
BeginDeferWindowPos
EndDeferWindowPos
GetMenu
EmptyClipboard
MoveWindow
EnableMenuItem
GetSubMenu
GetClassNameW
OpenClipboard
InsertMenuItemW
CheckMenuItem
GetMenuItemCount
SetClipboardData
GetMenuStringW
EnableWindow
MapWindowPoints
GetCursorPos
CheckMenuRadioItem
CloseClipboard
GetParent
ModifyMenuW
GetDlgCtrlID
GetMenuItemInfoW
DestroyMenu
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
LoadStringW
GetDesktopWindow
DestroyWindow
GetWindowTextW
LoadMenuW
CreatePopupMenu
GetKeyState
SetMenuItemInfoW
DrawTextExW
DispatchMessageW
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
ChildWindowFromPoint
gdi32
GetStockObject
SetBkColor
GetTextExtentPoint32W
CreateCompatibleBitmap
StretchBlt
SetStretchBltMode
SetPixel
GetPixel
SelectObject
CreateCompatibleDC
GetObjectW
DeleteDC
DeleteObject
SetTextColor
CreateFontIndirectW
GetDeviceCaps
SetBkMode
comdlg32
ChooseFontW
FindTextW
GetSaveFileNameW
shell32
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
ShellExecuteW
SHBrowseForFolderW
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
WinPrefetchView/WinPrefetchView.chm.chm
-
WinPrefetchView/WinPrefetchView.exe.exe windows:4 windows x64 arch:x64
89421e1903928ddf253a9167e7b060ae
Code Sign
f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7Certificate
IssuerCN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before09/09/2019, 00:00Not After09/09/2023, 23:59SubjectCN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=ILExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/11/2018, 00:00Not After31/12/2030, 23:59SubjectCN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23/10/2020, 00:00Not After22/01/2032, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
3e:cd:71:53:7c:7a:f0:f6:c0:04:a5:23:78:6c:fe:79:4f:87:5a:63:96:46:51:60:0c:56:02:a3:0d:4a:25:99Signer
Actual PE Digest3e:cd:71:53:7c:7a:f0:f6:c0:04:a5:23:78:6c:fe:79:4f:87:5a:63:96:46:51:60:0c:56:02:a3:0d:4a:25:99Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
f:\Projects\VS2005\WinPrefetchView\x64\Release\WinPrefetchView.pdb
Imports
msvcrt
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__setusermatherr
_onexit
__dllonexit
strlen
qsort
_wcslwr
wcstoul
wcsrchr
wcscmp
_ultow
_memicmp
_commode
_fmode
__set_app_type
__C_specific_handler
malloc
_wcsicmp
free
modf
wcschr
memcmp
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
memcpy
wcslen
_itow
_wcsnicmp
_purecall
_wtoi
wcscpy
memset
_snwprintf
wcsncat
wcscat
comctl32
ord17
ImageList_AddMasked
ImageList_SetImageCount
ImageList_Create
CreateStatusWindowW
CreateToolbarEx
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
kernel32
GetDriveTypeW
GetVolumeInformationW
QueryDosDeviceW
GetLongPathNameW
GetLogicalDrives
GetCurrentProcessId
ExitProcess
OpenProcess
EnumResourceTypesW
GetStartupInfoW
GlobalAlloc
ReadProcessMemory
GetCurrentProcess
SetErrorMode
GlobalFree
CompareFileTime
SystemTimeToFileTime
LoadLibraryW
FileTimeToSystemTime
GetProcAddress
FreeLibrary
SystemTimeToTzSpecificLocalTime
CreateFileW
LoadLibraryExW
CloseHandle
GetSystemDirectoryW
GetWindowsDirectoryW
FileTimeToLocalFileTime
WideCharToMultiByte
lstrlenW
LocalFree
GetNumberFormatW
LockResource
lstrcpyW
GetDateFormatW
GlobalUnlock
GetTempFileNameW
GetLocaleInfoW
GetTempPathW
GlobalLock
GetFileSize
SizeofResource
FormatMessageW
FindFirstFileW
GetLastError
GetVersionExW
GetModuleHandleW
GetTimeFormatW
FindNextFileW
GetFileAttributesW
FindClose
WriteFile
FindResourceW
ReadFile
LoadResource
GetModuleFileNameW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetPrivateProfileStringW
DeleteFileW
user32
FillRect
SetCapture
ReleaseCapture
RegisterClipboardFormatW
DrawTextExW
ChildWindowFromPoint
SetCursor
LoadCursorW
GetSysColorBrush
ShowWindow
SetWindowTextW
DispatchMessageW
UpdateWindow
SetDlgItemTextW
BeginPaint
GetDlgItemTextW
GetClientRect
GetSystemMetrics
DeferWindowPos
CreateWindowExW
SendDlgItemMessageW
EndDialog
GetWindowRect
GetDlgItem
GetDlgItemInt
InvalidateRect
EndPaint
GetWindow
DrawFrameControl
GetWindowPlacement
LoadAcceleratorsW
DefWindowProcW
PostMessageW
SendMessageW
RegisterClassW
MessageBoxW
TranslateAcceleratorW
SetWindowPlacement
SetMenu
LoadImageW
SetWindowLongW
GetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
CloseClipboard
GetMenu
GetParent
EmptyClipboard
MoveWindow
EnableMenuItem
GetDC
OpenClipboard
ReleaseDC
GetClassNameW
GetSubMenu
CheckMenuItem
GetMenuItemCount
SetClipboardData
GetCursorPos
EnableWindow
MapWindowPoints
GetSysColor
GetMenuStringW
ScreenToClient
DestroyWindow
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
LoadStringW
SetWindowPos
LoadIconW
DestroyIcon
GetFocus
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
GetMessageW
IsDialogMessageW
TranslateMessage
SetDlgItemInt
gdi32
DeleteObject
GetStockObject
GetTextExtentPoint32W
SetBkColor
GetDeviceCaps
PatBlt
SelectObject
CreateSolidBrush
SetTextColor
CreateFontIndirectW
SetBkMode
comdlg32
FindTextW
GetSaveFileNameW
shell32
SHGetMalloc
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW
ole32
CoUninitialize
CoInitialize
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ