e5ae1be12de3d88715727fe8b6d157e7_JaffaCakes118
- SHA256 da07ea710e848805416f93369b7b6e90d0c1b66cbb80ead60c7d46d6d8efd3be
Overview
overview
10Static
static
3IMANG59293...02.exe
windows7-x64
10IMANG59293...02.exe
windows10-2004-x64
10$APPDATA/a...60.dll
windows7-x64
1$APPDATA/a...60.dll
windows10-2004-x64
1$APPDATA/a...60.dll
windows7-x64
1$APPDATA/a...60.dll
windows10-2004-x64
1$APPDATA/a...UI.dll
windows7-x64
1$APPDATA/a...UI.dll
windows10-2004-x64
1$APPDATA/a...op.dll
windows7-x64
1$APPDATA/a...op.dll
windows10-2004-x64
1$APPDATA/a...rs.exe
windows7-x64
3$APPDATA/a...rs.exe
windows10-2004-x64
3$APPDATA/a...im.dll
windows7-x64
3$APPDATA/a...im.dll
windows10-2004-x64
3$APPDATA/p...60.dll
windows7-x64
1$APPDATA/p...60.dll
windows10-2004-x64
1$APPDATA/p...ui.dll
windows7-x64
1$APPDATA/p...ui.dll
windows10-2004-x64
1$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$TEMP/Towb...ia.dll
windows7-x64
3$TEMP/Towb...ia.dll
windows10-2004-x64
3$TEMP/paperings.exe
windows7-x64
10$TEMP/paperings.exe
windows10-2004-x64
10Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$APPDATA/app_browser/25.opends60.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
$APPDATA/app_browser/25.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
$APPDATA/app_browser/40.opends60.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
$APPDATA/app_browser/40.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
$APPDATA/app_browser/MicrosoftVisualStudioWebUI.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
$APPDATA/app_browser/MicrosoftVisualStudioWebUI.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
$APPDATA/app_browser/VsWebSiteInterop.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
$APPDATA/app_browser/VsWebSiteInterop.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
$APPDATA/app_browser/aspnetregbrowsers.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
$APPDATA/app_browser/aspnetregbrowsers.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
$APPDATA/app_browser/mscortim.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
$APPDATA/app_browser/mscortim.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$APPDATA/postinfo/34.opends60.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
$APPDATA/postinfo/34.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
$APPDATA/postinfo/rcxditui.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
$APPDATA/postinfo/rcxditui.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/advsplash.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/advsplash.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
$TEMP/TowbarHamartia.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
$TEMP/TowbarHamartia.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
$TEMP/paperings.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
- Target e5ae1be12de3d88715727fe8b6d157e7_JaffaCakes118
- Size 760KB
- Sample240916-2ekelatapd
- SHA256 da07ea710e848805416f93369b7b6e90d0c1b66cbb80ead60c7d46d6d8efd3be
- MD5 e5ae1be12de3d88715727fe8b6d157e7
- SHA1 e9579d766ec5d1d17215ed4fc660f9ff84ec3f78
- SHA512 27cc3da2ff583405df1487adc9ca972739321ac6df19ad6dd262cc1d3fcbed316fbe765f7fa5c8439e2829cbe7c05b0ae711814555dd9095d7363d923fd41094
- SSDEEP 12288:MQfIJ8oZLgsh87kHKpFXXGFPAax7Kyw8yDjT8873fYdrT9L6DVUR9e16emXxWPw/:MW8dZLgOSkHOGelBDft3fYdrT9umo1/g
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe unpack002/$APPDATA/app_browser/MicrosoftVisualStudioWebUI.dll unpack002/$APPDATA/app_browser/VsWebSiteInterop.dll unpack002/$APPDATA/app_browser/aspnetregbrowsers.exe unpack002/$APPDATA/app_browser/mscortim.dll unpack002/$APPDATA/postinfo/rcxditui.dll unpack002/$PLUGINSDIR/advsplash.dll unpack002/$PLUGINSDIR/nsExec.dll unpack002/$TEMP/TowbarHamartia.dll unpack002/$TEMP/paperings.exe
File Explorer
-
e5ae1be12de3d88715727fe8b6d157e7_JaffaCakes118.rar 760KB
-
IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe.exe 778KB
-
$APPDATA/app_browser/25.opends60.dll44B
-
$APPDATA/app_browser/40.opends60.dll46B
-
$APPDATA/app_browser/MicrosoftVisualStudioWebUI.dll.dll 2KB
-
$APPDATA/app_browser/Prompt.xml275B
-
$APPDATA/app_browser/Smartphone2003Skin.xml3KB
-
$APPDATA/app_browser/VsWebSiteInterop.dll.dll 48KB
-
$APPDATA/app_browser/aspnetregbrowsers.exe.exe 13KB
-
$APPDATA/app_browser/fourteen.xml.xml 1KB
-
$APPDATA/app_browser/imtooltip.xml.js .xml 17KB
-
$APPDATA/app_browser/mscortim.dll.dll 10KB
-
$APPDATA/app_browser/system-config-printer.appdata.xml.xml 14KB
-
$APPDATA/app_browser/vsaenv.exe.xml 787B
-
$APPDATA/app_browser/win32-software.xml.xml 2KB
-
$APPDATA/app_browser/x-font-libgrx.xml.xml 2KB
-
$APPDATA/app_browser/x-xwindowdump.xml.xml 2KB
-
$APPDATA/postinfo/34.opends60.dll45B
-
$APPDATA/postinfo/rcxditui.dll.dll 5KB
-
$PLUGINSDIR/advsplash.dll.dll 6KB
-
$PLUGINSDIR/nsExec.dll.dll 7KB
-
$TEMP/Keystroke645KB
-
$TEMP/TowbarHamartia.dll.dll 54KB
-
$TEMP/paperings.exe.exe 39KB
IMANG59293021IMAGN2944592302VISTAVPREVIA023102.exe
- IMPHASH 24f4223e271413c25abad52fd456a9bc
- SHA256 e6b58687faf8165eb9f34872e6dd9df1a97e527a1c9765b698be615e72f368e0
- MD5 6ec62d2feca20ea0d9c8730aa3f660e3
- SHA1 5386d98ec0d08febf713058df774e9e6044c9080
- SHA512 6017f06cc445a45cf7f57e131e682fb2f5c56c35bbb1884e3759a44cadb559ea6ca51851808fb2012e3de1f28bdfbb52a35301706468f67ef0f85494fe474aeb
- SSDEEP 24576:LwuySQX1XbJzkbtccJ7tQB/9ksYwSQvf8os+q:L5QdbJzFAtKksnSQv+7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13618
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
SetCurrentDirectoryW
GetFileAttributesW
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
CopyFileW
MoveFileW
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
lstrcmpW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalUnlock
GetDiskFreeSpaceW
GlobalAlloc
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
SetFilePointer
ReadFile
MulDiv
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
WritePrivateProfileStringW
FreeLibrary
GetPrivateProfileStringW
GetModuleHandleW
LoadLibraryExW
user32
GetWindowRect
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
ScreenToClient
EnableMenuItem
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
SystemParametersInfoW
EndDialog
RegisterClassW
DialogBoxParamW
CreateWindowExW
GetClassInfoW
DestroyWindow
CharNextW
ExitWindowsEx
SetWindowTextW
LoadImageW
SetTimer
ShowWindow
PostQuitMessage
wsprintfW
SetWindowLongW
FindWindowExW
IsWindow
CreatePopupMenu
AppendMenuW
GetSystemMetrics
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow
gdi32
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
shell32
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFileInfoW
SHFileOperationW
SHBrowseForFolderW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ord17
ImageList_Destroy
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=164, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$APPDATA/app_browser/25.opends60.dll
- SHA256 b407fe7ddcc7303ef167873a6498e8ebd771e9b4b432ad0a458a029574ca6afd
- MD5 09537416318f379396bddbc18046de39
- SHA1 dc6111549ff49afa587425603cc0c545b034b988
- SHA512 20b9ab08d3e940d687404436e2d6c8b4c1a9121987382c6253d7d93fc2b556fb8780742af08d8b73e4d50ea9b23d2e62298669650df60ed38e6f23c5c0155619
- MD5 SHA1 SHA512
$APPDATA/app_browser/40.opends60.dll
- SHA256 c78b52098ab7a63f97cf55a134bceef6cb56412d5e6a6230cf0d666ba1f07cc6
- MD5 a800e1be610c1fc4412a4557e5654f6d
- SHA1 0d5760e3107c174d735e52c9c239e27164df6657
- SHA512 3bb1e3b36126396a19f5ba935deda62c3b2695bf3801eb7fd8d54e4bfee604aaa97fc348e94bac970e2c8d5b70cc132a05cedfd447b8558cc494a2557734c9d0
- MD5 SHA1 SHA512
$APPDATA/app_browser/MicrosoftVisualStudioWebUI.dll
- SHA256 dfce0c806a64327f03df9b4d55accb008f79ec255e6987d3f12f9791638a4935
- MD5 b1feacfce6eb230192b82d04fd82ad9a
- SHA1 930208d7d7a806ed3466150fc34709fb6223896a
- SHA512 9e5802c501cc3137fb13b3c2e63d1b33f2d82a8524616972ee1d6a45bad49049363f762fe0444fcd462b4a972d4e94851b4c149b9d697ec727b731971f21309c
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$APPDATA/app_browser/Prompt.xml
- SHA256 05a794cf1a71f3efcd8a07ecb774a3a92721595c76e8c440f46b8830365caafd
- MD5 8385c4f2c9320f609f0982d206c95bb2
- SHA1 d280a3f607c208b5e5dc25f0a686decf8e8c3243
- SHA512 155152dd004d1d31d0c377f8d3f4141345c98578a00b0fdd7c9e4c2aade97d565c3624349197d90b9813af43ba0151247442adbb276aa3d0d3537596ae68c6d9
- MD5 SHA1 SHA512
$APPDATA/app_browser/Smartphone2003Skin.xml
- SHA256 7f58472dfbdd5437af783a22746b5a7444660977bc3c4c91bc07f1c462dfdd75
- MD5 5192c00b807d3a685833c81e6f827a81
- SHA1 cbeff6ecf9cc92bd716d947ba07bfa4c58a0e692
- SHA512 a0453ed254c40eb4b6c75f482b7884edbc4480baf59c95235d8df3cb1085eed877b150fa9f34b735f6eb700eaad3e0a6be655a5e89e800d25b5cee93e76a51f8
- MD5 SHA1 SHA512
$APPDATA/app_browser/VsWebSiteInterop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a43778327d9052a0c55e33694c400d3ca7fa5bd40d6b0102918c120d2d5463
- MD5 4fb0672d5842ddb98898784461480e8b
- SHA1 6a927dd928c29ab1404b4d3c27a204880e0d12e6
- SHA512 54a1bd835eaf7785348531b84d5225997f6c4d475357d328d29001c2e4ecb584a7dc0bf0c55399e8e70cbe342dffc18d632d146398bd6231e612761c18f95e4c
- SSDEEP 768:MOZO5OU5ngPG1lkA2p60B57KFe27CB4bZt9lytWHPnEUHw73oCADNSxtFA:MOZO5OU5ngPG1lkA2gP02+B4bZt1vEEv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
f:\binaries.x86ret\.\bin\i386\VsWebSite.Interop.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
$APPDATA/app_browser/aspnetregbrowsers.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 59146d16e5a1b9c2e47eb1447e6ae2fa403c4182107e893a7cf33c81e8023a54
- MD5 a394c927a7ad7befdf7136144232a13a
- SHA1 cc95d2160686c7d95cfb5334fb83eac5fd176cb4
- SHA512 4938539bab4e257a57c9b336fae979ce91cf1f30dbfcaae2c164bb44c85a130c7a85ffe19f6007b1c75e6a77e5abb4948e1ca8c2a9817cf8fdafe2ae0bfbf3fc
- SSDEEP 192:jowEhZpVUjCZKb338cV/pqlFOxWFlhm4QSXoOx0x6EpWeNHJW/:jowEhdUjtNwEgFrSSXHirpWKHJW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
aspnet_regbrowsers.pdb
mscoree
_CorExeMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
$APPDATA/app_browser/fourteen.xml
- SHA256 8ff214ed3cb17375498ed7ab1a9ad272bd2b0dedcbeca41770489108d3844576
- MD5 f9c63af5b83f05eeb3ee51c95362e314
- SHA1 010b6c53fc46bbe72268359d03c9da8c18592611
- SHA512 04919acd51d049d1517d68ac4586acfa72458e021ed43c5729215f498e083acba3288cdb0268b69b3db65eaddd1f0ec996e9eb6e16bfcd696db6f006c2280226
- MD5 SHA1 SHA512
$APPDATA/app_browser/imtooltip.xml
- SHA256 28ade291b6fde49709ed85ad1feb981c90e6f654ac201d99e74a3efffde635e7
- MD5 b09bfd88402d3ebed442246934a02707
- SHA1 9c07454dc269fbeec1e0a0a9ec52258cf9305765
- SHA512 4e58db64262e32b052958b247e60208e3bee8e2ce4f2135fa8b7eee77508d15be8e9cdb759afa487b10cdca586a064ef0446c1a53850ed8e9b8ce802d5c527a3
- SSDEEP 384:cgN98KiMfKr3H8vj9cJbbpCtWndiEFDXJI846uN49JLj0:FNxyX8vj9ctb8EdJFJu4o
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/app_browser/mscortim.dll
- IMPHASH 925789d0a203f2ce093304baa5187a75
- SHA256 6e981ae3c91194fe4d524c8e3f75d34b9b8c980d2edbad2a6d05143e3b62646c
- MD5 59d2c93ae3c2c269fc26b3ecf9a0f3af
- SHA1 baab6861d2e432509f216878d79a5e58c3d46927
- SHA512 2faea31c0c68e94d1976b0e20342f16fa824303a890ce6a15375ea6c5cf26516107980ab8ede521c5bfad03f46422a714daf641aa171f754fe086af4487b3bd8
- SSDEEP 192:VmT/J28Hm+Ook7Vm1Nf30FeXXv5/q/5I3XW6Mbrk1UqWBNsoW/q:VmT3m+OokRm1aS5y/WG6MGtWrsoWC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6943
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscortim.pdb
msvcr80
__clean_type_info_names_internal
_unlock
__dllonexit
__CppXcptFilter
_onexit
_except_handler4_common
_crt_debugger_hook
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
memset
strncpy_s
_tempnam
strcpy_s
printf
remove
_lseek
_close
_write
_read
?_open@@YAHPBDHH@Z
_errno
free
malloc
_lock
strrchr
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
CreateFileA
GetFileInformationByHandle
CloseHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetFileAttributesA
LoadLibraryA
GetProcAddress
FreeLibrary
IsDebuggerPresent
CreateCab
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=54, id=1, productName=Unmarked objects,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=13, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=3, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$APPDATA/app_browser/system-config-printer.appdata.xml
- SHA256 acf9bb7dcbcb1721d648692452830589af4ae9f4f82615a6170429c78a4d959e
- MD5 6859a5deaf4c7334693faa3b3fb7fd58
- SHA1 a0c22d047c6fa1d3ed4f8e521ee323af25d99c35
- SHA512 80d7be77e5effb545c6f8a4055080e8364d8d6235315e55f74e0e2b35d1e8a9a61f46edbe14c85be06c84ae566eca52ca6b046ace19138adab8cf4504c7cbc14
- SSDEEP 192:PHodJHbdcEKy16bX9A4X4RAwfSIkJDnTR41gBGM9k2pdDW/OFedSOv/8:wfbd8yQXGdAUpkJHRsgIM9k2jtcdSOv0
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/app_browser/vsaenv.exe
- SHA256 bfcf385eb92d3c2b15fd1d8b600ef7700960c8d59126eaa0414dd656d5f1557b
- MD5 04bdfd2f995ecf9b8b0e5038aeee37c6
- SHA1 af6c0bf60b16528061286ed948cc5c768cac641e
- SHA512 fa528df69495c1d54d8c8ea280f772879ac750c7568ba734ea07addd667c54f42908d5c6c0199e7c67fa97e4171474ca1ebd55ebd27d77015faa14015cfbd547
- MD5 SHA1 SHA512
$APPDATA/app_browser/win32-software.xml
- SHA256 dd06200bae7da8ef112e9fd66dbd06623408366dc388efedfe863aaea99be5c4
- MD5 4efa2782e3dca2d5121a8392bd777b13
- SHA1 0e46f88cfbba039677426d6aa46fd9501a6b31aa
- SHA512 23adf0b46523a9a9ac84faf2da69faa2e2da7313d14f5b32174e698cb482015fc2c47a123cfaed7a1b5a66fd60cfa9ffaabac1bacc1ca9306b7feb2f0a9cdcaa
- MD5 SHA1 SHA512
$APPDATA/app_browser/x-font-libgrx.xml
- SHA256 1f8adb9d8885dda2e3b4cc3e75fc77e6d7f84a74b1c25709a19558bc43e6cd8b
- MD5 ca5b40ed392130b592adf158aebf68ea
- SHA1 a8c0dd7fdba8fbed5a5e8c819e6461bc598f2be2
- SHA512 d1bb927ef6e306fac2d060f398a5aae621f08fe4e8c4d1a464ba6369449d008c06acc07f24813a40dba112b1981b42cd576d6030a638450fd76937491a3e2cc9
- MD5 SHA1 SHA512
$APPDATA/app_browser/x-xwindowdump.xml
- SHA256 e32d295142ea55f752d0b8c3663996b7c7e9336ecbe8f0df69c33715a8b50792
- MD5 efb2a459f3e47cfb2391fb335f78eb6d
- SHA1 27e7ec1d10ed67c421f5c9da8d6491f7502c89c9
- SHA512 26f9ffa108199be2640147acda389424b46a9e5c3a5dc90633f836447fc4719a9924288f594e0b94d7b49d3323fc158134a28fc5c3910bcf54e1123ba532da0e
- MD5 SHA1 SHA512
$APPDATA/postinfo/34.opends60.dll
- SHA256 6f752eef54d5eb2a9dc50ee5d59d5d0493511a0f2ec6370d1b8bb53b0f604712
- MD5 661924ba77b48f57d874a09d9dc5de6c
- SHA1 06ad89e6c1827cc4b0017efb54cfd4b614e4d276
- SHA512 9f08a50255627b335d8983d782885b0f4ba832e24c8b2ffe9bf32052b2384467282e6be4a88bb920dab95c35a944186fb0fc81384dc8e78af6dfea804bdcfd87
- MD5 SHA1 SHA512
$APPDATA/postinfo/rcxditui.dll
- SHA256 420007c3e0a76ac880679f323653d3b9321832f578ca4dc1c2a1e5775a0f77dd
- MD5 cc869c04e8771d08397dc86374fe5a5e
- SHA1 d7cd17b9607538dcdd6fc267ee504b37740992ff
- SHA512 684114317ab54248d20727058f58e592cffee865e876b8155c4426ee71cf15bfacaee07e2c9ef49c8d3f99cf6f0e20ae8800d2df88f0550e5304ab39ba468ef4
- SSDEEP 48:KqiJ6OqhgmLwQpXMbqwcI65y7+OiaC+IZWo6zqhpm3F5WPWghnpgX:jOqhiZF6zSEWEOjWPVn0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
f:\binaries.x86ret\bin\i386\VC7\VCPackages\1033\rcxdtiui.pdb
Name
.text
Size
512B
Virtual Size
113B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$PLUGINSDIR/advsplash.dll
- IMPHASH 4d85954a016da6eba41af38db29369a8
- SHA256 528cab75eb926894bf7662819802888cde1e883c9b5d1b3af11ff6ab277381a5
- MD5 aefa9685c635b9568f0490815dac8af6
- SHA1 7862e61d8fe5c8a1bf32a8e8f433d5b7bd7928cf
- SHA512 928d8374b895b6d396afce0492def1510bab0551232a00d5dbd932d5f7cc25b8f66aa2fe83a446006c2a797879196ee6a9fc6fd27e14f84c10f4e9a83e5c915a
- SSDEEP 96:YIUNaXnnXyEIPtXvZhr5RwiULuxDtJD+wolpE:YIx3XyEwXvZh1RwnLUDtt+I
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4448
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpynW
LoadLibraryA
lstrcpyW
lstrcatW
GetProcAddress
GlobalAlloc
GlobalFree
user32
EnumDisplaySettingsW
LoadImageW
BeginPaint
SetWindowLongW
SystemParametersInfoW
EndPaint
GetClientRect
CreateWindowExW
DefWindowProcW
DestroyWindow
IsWindow
GetMessageW
DispatchMessageW
UnregisterClassW
wsprintfW
PostMessageW
SetWindowRgn
RegisterClassW
LoadCursorW
SetWindowPos
gdi32
BitBlt
DeleteDC
DeleteObject
CombineRgn
GetObjectW
GetDIBits
SelectObject
CreateCompatibleDC
CreateRectRgn
winmm
timeSetEvent
PlaySoundW
timeKillEvent
show
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
460B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=41, id=1, productName=Unmarked objects,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsExec.dll
- IMPHASH 488b9c61d28b8855f328d854ae7601be
- SHA256 1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
- MD5 f27689c513e7d12c7c974d5f8ef710d6
- SHA1 e305f2a2898d765a64c82c449dfb528665b4a892
- SHA512 734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc
- SSDEEP 96:JpmkmwmHDPVhklfSoRPB+YSvWvZckH69MSz00vQFHhAVvSGYuHnUNy2DCP:J+PVhYfSokvW2CsQFBAVaGdHnUNR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4231
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ReadFile
PeekNamedPipe
GetExitCodeProcess
WaitForSingleObject
GetTickCount
lstrcpyW
IsDBCSLeadByteEx
CreateProcessW
GetStartupInfoW
CreatePipe
GetVersion
DeleteFileW
lstrcmpiW
lstrlenW
lstrcatW
TerminateProcess
MultiByteToWideChar
MapViewOfFile
CreateFileMappingW
CreateFileW
Sleep
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
GetProcAddress
GetModuleHandleA
GetCurrentProcess
ExitProcess
lstrcpynW
GetCommandLineW
GlobalReAlloc
CloseHandle
UnmapViewOfFile
CopyFileW
user32
SendMessageW
CharNextW
CharPrevW
FindWindowExW
wsprintfW
CharNextExA
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
IsTextUnicode
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
418B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$TEMP/Keystroke
- SHA256 0376fa7850a8e22086b054e55a626633f5376e5a1639eb10799ae68a1f64493d
- MD5 5c9b2fdeda32f5e7c5dba14db7d405f1
- SHA1 0616c4b7aade47f8a7a110222cf21b40a9138540
- SHA512 42fa024108e621cfdeae5b888597d635ed6a60465a174e1d2c8145465bda8fdc45809cb231a651d182414d39a2e21402fa2c50e711efaa29c37cde9154c19f15
- SSDEEP 12288:GRsJHJ2D+OqJYad0bvccuZ077tfaXH/9asYkfPyCvtQoYl+VrU8:FJHnfJpqbvccX7tiX/9asYwaCvtQos+9
- MD5 SHA1 SHA512 SSDEEP
$TEMP/TowbarHamartia.dll
- IMPHASH dc950f2be3eeaad2223b785d69dd29a0
- SHA256 030bcfc5c4629fff97b77925e1650c9bb9b267c1018f2fc754f90afc143522e1
- MD5 d65c8ac05fd814a0327588b6b485c43e
- SHA1 5555dc0c343f857c4732683b4018a271b17a6ca0
- SHA512 a40aa752ba28afb4e4b40ebb551612a819876dde50414c9ff1c0bf6b46618ab9d7b459eca0262fc0b9a13a649123c37fede7b20db4b8f3344c81551041d86fa0
- SSDEEP 768:8wOOFDjuI5DU6JztEwaOKH2MBhQztYNUeLu0k1/ni6JULUOlZqSfZT:8wtFuIPJqwa2MBeeK5/ZJULUOPV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8780
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
AnimateWindow
advapi32
LookupPrivilegeValueW
RegQueryInfoKeyA
SetFileSecurityW
kernel32
GetTickCount
OpenMutexA
SetThreadPriorityBoost
GetCurrentThreadId
GetCommandLineA
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize
Dishonorableness
Ejection
Haywards
Herm
Multiprocessors
Smooch
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=149, productName=VS2008 build 21022, version=21022,
count=72, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=80, id=1, productName=Unmarked objects,
count=26, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
$TEMP/paperings.exe
- IMPHASH 564f8586aefb96432defb148a0b070ad
- SHA256 31ae1165f008db6195108f984d3fe495f10c6ac4a5f74bd365102f84b57d9aba
- MD5 f4392de13dfac4aa804152adbd93e793
- SHA1 ee90e001945afde21dcd12d542f0eabb9f94f4a6
- SHA512 40bf82d364c757576c3d7897d6d7413b64089056a8279433b5d5a35ada7a01607754c29678afd9bada5934d49c26f800132d400c864b38234fba4017bcf01de4
- SSDEEP 768:5d3r7gefzh645WMbXUcKHBx5BOST/FHPePzaUt8P61t1nVG+:5BrLQeOM2Pgjte+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6283
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
AnimateWindow
AdjustWindowRectEx
GetKeyboardLayoutNameW
SetWindowPos
advapi32
LookupPrivilegeValueW
RegQueryInfoKeyA
SetFileSecurityW
kernel32
GetModuleHandleA
GetProcAddress
LoadLibraryW
OpenMutexA
SetThreadPriorityBoost
GetCommandLineA
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=149, productName=VS2008 build 21022, version=21022,
count=72, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=84, id=1, productName=Unmarked objects,
count=27, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,