ef0f63e60b8ce393c5e48e1b01efad73_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ef0f63e60b8ce393c5e48e1b01efad73_JaffaCakes118
Size

16.2MB
MD5

ef0f63e60b8ce393c5e48e1b01efad73
SHA1

65a7c1c6e6d0e3d64d9534293d6357b7f3bbff87
SHA256

5c3bfff9a5609d5a4dc198a9d8311ac66c07e8cf0c096ef277fe29f8fbfcb48c
SHA512

c199cc04c2588cd188d7933cbcd238fffd8c44caa59a304d9e89588a3da634a8cab79d3a0b77ea26c02900cf35b53d161ef4ad90b53c28748d62078761aa1861
SSDEEP

393216:R7cDgVvG02LbbZNQp42BlMEMMC8X6fvXAorKaf:+DgV+xb7QDlMVMNX6HXAMf

Score

3^/10

Malware Config

Signatures

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/Linker.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/data/rta.bin
unpack001/data/satellite-win.bin
unpack001/mcsinstall.exe
unpack001/mcsuninstall.exe
unpack001/msserver.exe
unpack001/msserver1024.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/www/win_nqcsatellite.exe	nsis_installer_1
static1/unpack001/www/win_nqcsatellite.exe	nsis_installer_2

Files

ef0f63e60b8ce393c5e48e1b01efad73_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:0e:e5:19:44:11:da:52:37:25:91:6e
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

05/02/2020, 18:50

Not After

25/03/2023, 18:54

Subject

SERIALNUMBER=3332172,CN=Visualware Inc.,OU=Visualware\, Inc.,O=Visualware Inc.,STREET=937 Sierra Dr,L=Turlock,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

90:4e:4f:62:13:fb:b5:24:b0:e5:a2:d1:c2:bc:54:48:55:20:5e:93:89:b7:c4:c8:e2:76:63:e6:9b:3b:45:af
Signer

Actual PE Digest

90:4e:4f:62:13:fb:b5:24:b0:e5:a2:d1:c2:bc:54:48:55:20:5e:93:89:b7:c4:c8:e2:76:63:e6:9b:3b:45:af

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Linker.dll
.dll windows:5 windows x86 arch:x86

7be0a90f26d9bff402fabbfd9a7313c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

UnhandledExceptionFilter
TerminateProcess
SetUnhandledExceptionFilter
GlobalAlloc
GetModuleHandleA
lstrcpynA
lstrcpyA
GetCurrentProcess
GlobalFree
IsDebuggerPresent

user32

DestroyCursor
SetWindowLongA
GetMessagePos
DrawTextA
DrawFocusRect
SetCursor
FillRect
GetClientRect
SetWindowPos
ReleaseDC
GetDC
CallWindowProcA
IsWindow
GetDlgCtrlID
GetParent
BeginPaint
EndPaint
ReleaseCapture
ClientToScreen
GetWindowRect
PtInRect
SetFocus
SetCapture
CreateCursor
LoadCursorA
GetWindowLongA
SendMessageA
InvalidateRect
UpdateWindow
GetFocus

gdi32

CreateFontIndirectA
GetStockObject
DeleteObject
SelectObject
SetBkMode
SetTextColor
GetObjectA

shell32

ShellExecuteA

Exports

Exports

LVLink
Link
Unload

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 446B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

8773e19ae02f331332db1b00671fdecf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_mbschr
_adjust_fdiv
malloc
_initterm
free
_mbsrchr
strtoul
memset
_mbsstr
strtol

kernel32

CloseHandle
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrlenA
WriteFile
ReadFile
lstrcmpA
lstrcpynA
GetLastError
GlobalFree
lstrcmpiA
DeleteFileA
SleepEx
SetFilePointer
GetTickCount
lstrcatA
GetFileSize
CreateFileA

user32

MessageBoxA
GetParent
ShowWindow
SetWindowLongA
GetWindowLongA
SetWindowTextA
IsWindow
GetDlgItem
PostMessageA
GetWindowTextA
SendMessageA
SetDlgItemTextA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindowVisible
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
SendDlgItemMessageA

wininet

HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
boot.txt
data/actfirmware/1000094.bfx
data/actfirmware/2000052.bfx
data/actfirmware/3000052.bfx
data/example-https.ini
data/geo.vdb
data/ip2cc.db
data/iptonet.txt+
data/rta.bin
.exe windows:4 windows x86 arch:x86

5bc8b985c4b2d62c465f2a804d2b059d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
ReadFile
GetFileSize
CreateFileA
WriteFile
CloseHandle
SetEnvironmentVariableA
GetEnvironmentVariableA
CreateDirectoryA
GetCurrentProcessId
GetTempPathA
SetCurrentDirectoryA
GetModuleFileNameA
SetStdHandle
GetModuleHandleA
GetStartupInfoA
GetStdHandle
CreateProcessA
GetFileAttributesA
GetTickCount

user32

MessageBoxA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteA

msvcrt

_XcptFilter
fflush
_iob
printf
sprintf
memset
strstr
strcmp
calloc
memcpy
strlen
strcat
strtok
free
strcpy
_exit
_controlfp
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
data/satellite-linux.bin
.tar
sat.tar
.tar
PartTwo.sh
TestJVM.class
libmswin32v15-freebsd-32bit.so
.elf linux x86
libmswin32v15-freebsd-64bit.so
.elf linux x64
libmswin32v15-linux-32bit.so
.elf linux x86
libmswin32v15-linux-64bit.so
.elf linux x64
libmswin32v15-linux-arm.so
.elf linux arm
libmswin32v15-solaris-32bit.so
.elf linux sparc
libmswin32v15-solaris-64bit.so
.elf linux
libmswin32v15-solaris.so
.elf linux
libmswin32v15.jnilib
.bundle macos arch:x86
sat.jar
.jar
sat_configure.sh
.sh linux
data/satellite-win.bin
.exe windows:4 windows x86 arch:x86

5bc8b985c4b2d62c465f2a804d2b059d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
ReadFile
GetFileSize
CreateFileA
WriteFile
CloseHandle
SetEnvironmentVariableA
GetEnvironmentVariableA
CreateDirectoryA
GetCurrentProcessId
GetTempPathA
SetCurrentDirectoryA
GetModuleFileNameA
SetStdHandle
GetModuleHandleA
GetStartupInfoA
GetStdHandle
CreateProcessA
GetFileAttributesA
GetTickCount

user32

MessageBoxA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteA

msvcrt

_XcptFilter
fflush
_iob
printf
sprintf
memset
strstr
strcmp
calloc
memcpy
strlen
strcat
strtok
free
strcpy
_exit
_controlfp
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
data/vrdb.bin
data/whois.txt+
emails/default.txt
images/ebc.gif
.gif
images/edevelopment.gif
.gif
images/emobility.gif
.gif
images/enc.gif
.gif
images/enone.gif
images/epremium.gif
.gif
images/epro.gif
.gif
images/estandard.gif
.gif
images/logospin.gif
.gif
images/msglobe.gif
.gif
images/msslogo.gif
.gif
images/myspeedicon16.gif
.gif
images/noroute.gif
images/plug.gif
images/statusbad.gif
.gif
images/statusok.gif
.gif
license.html
.html
mcsinstall.exe
.exe windows:4 windows x86 arch:x86

5bc8b985c4b2d62c465f2a804d2b059d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
ReadFile
GetFileSize
CreateFileA
WriteFile
CloseHandle
SetEnvironmentVariableA
GetEnvironmentVariableA
CreateDirectoryA
GetCurrentProcessId
GetTempPathA
SetCurrentDirectoryA
GetModuleFileNameA
SetStdHandle
GetModuleHandleA
GetStartupInfoA
GetStdHandle
CreateProcessA
GetFileAttributesA
GetTickCount

user32

MessageBoxA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteA

msvcrt

_XcptFilter
fflush
_iob
printf
sprintf
memset
strstr
strcmp
calloc
memcpy
strlen
strcat
strtok
free
strcpy
_exit
_controlfp
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
mcsuninstall.exe
.exe windows:4 windows x86 arch:x86

5bc8b985c4b2d62c465f2a804d2b059d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
ReadFile
GetFileSize
CreateFileA
WriteFile
CloseHandle
SetEnvironmentVariableA
GetEnvironmentVariableA
CreateDirectoryA
GetCurrentProcessId
GetTempPathA
SetCurrentDirectoryA
GetModuleFileNameA
SetStdHandle
GetModuleHandleA
GetStartupInfoA
GetStdHandle
CreateProcessA
GetFileAttributesA
GetTickCount

user32

MessageBoxA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteA

msvcrt

_XcptFilter
fflush
_iob
printf
sprintf
memset
strstr
strcmp
calloc
memcpy
strlen
strcat
strtok
free
strcpy
_exit
_controlfp
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
msserver.exe
.exe windows:4 windows x86 arch:x86

5bc8b985c4b2d62c465f2a804d2b059d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
ReadFile
GetFileSize
CreateFileA
WriteFile
CloseHandle
SetEnvironmentVariableA
GetEnvironmentVariableA
CreateDirectoryA
GetCurrentProcessId
GetTempPathA
SetCurrentDirectoryA
GetModuleFileNameA
SetStdHandle
GetModuleHandleA
GetStartupInfoA
GetStdHandle
CreateProcessA
GetFileAttributesA
GetTickCount

user32

MessageBoxA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteA

msvcrt

_XcptFilter
fflush
_iob
printf
sprintf
memset
strstr
strcmp
calloc
memcpy
strlen
strcat
strtok
free
strcpy
_exit
_controlfp
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
msserver1024.exe
.exe windows:4 windows x86 arch:x86

5bc8b985c4b2d62c465f2a804d2b059d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
ReadFile
GetFileSize
CreateFileA
WriteFile
CloseHandle
SetEnvironmentVariableA
GetEnvironmentVariableA
CreateDirectoryA
GetCurrentProcessId
GetTempPathA
SetCurrentDirectoryA
GetModuleFileNameA
SetStdHandle
GetModuleHandleA
GetStartupInfoA
GetStdHandle
CreateProcessA
GetFileAttributesA
GetTickCount

user32

MessageBoxA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteA

msvcrt

_XcptFilter
fflush
_iob
printf
sprintf
memset
strstr
strcmp
calloc
memcpy
strlen
strcat
strtok
free
strcpy
_exit
_controlfp
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/act.mcsplugin
.zip
act.jar
.jar
data/actfields.txt
templates/admin_chooseplugins.act.htmlpart
templates/db_result.act.htmlpart
www/testact.gif
.gif
plugins/capacity.mcsplugin
.zip
capacity.jar
.jar
emails/MyCapacity.txt
plugin.xml
rta/capacityrtaplugin.jar
.jar
templates/admin.capacity.htmlpart
templates/admin_appletconfig.capacity.htmlpart
templates/admin_chooseplugins.capacity.htmlpart
templates/admin_modifysatellite.capacity.htmlpart
templates/admin_serversetup.capacity.htmlpart
templates/admin_testmodify.capacity.htmlpart
templates/db_result.capacity.htmlpart
templates/test_notlicensed.capacity.htmlpart
www/mycapacity_100mb.html
.html
www/mycapacity_10mb.html
.html
www/mycapacity_50mb.html
.html
www/mycapacity_5mb.html
.html
www/mycapacityh5_100mb.html
www/mycapacityh5_10mb.html
.html
www/mycapacityh5_50mb.html
.html
www/mycapacityh5_5mb.html
.html
www/test-capacity.png
.png
www/testcapacity.gif
.gif
www/testcapacitydisabled.gif
.gif
plugins/conference.mcsplugin
.zip
conference.jar
.jar
rta/conferencertaplugin.jar
.jar
templates/admin.conference.htmlpart
templates/admin_appletconfig.conference.htmlpart
templates/admin_chooseplugins.conference.htmlpart
templates/admin_serversetup.conference.htmlpart
templates/admin_testmodify.conference.htmlpart
.js
templates/db_result.conference.htmlpart
templates/test_notlicensed.conference.htmlpart
www/myconference_bluray.html
.html
www/myconference_dvd.html
.html
www/myconference_web.html
.html
www/testconference.gif
.gif
www/testconferencedisabled.gif
.gif
plugins/crt.mcsplugin
.zip
crt.jar
.jar
data/crtfields.txt
plugins/dhcp.mcsplugin
.zip
dhcp.jar
.jar
plugin.xml
rta/dhcprtaplugin.jar
.jar
templates/admin.dhcp.htmlpart
templates/admin_appletconfig.dhcp.htmlpart
templates/admin_chooseplugins.dhcp.htmlpart
templates/admin_testmodify.dhcp.htmlpart
.js
templates/db_result.dhcp.htmlpart
templates/test_notlicensed.dhcp.htmlpart
www/mydhcp_all.html
.html
www/test-dhcp.png
.png
www/testdhcp.gif
.png
www/testdhcpdisabled.gif
.gif
plugins/dnsns.mcsplugin
.zip
dnsns.jar
.jar
plugin.xml
rta/dnsnsrtaplugin.jar
.jar
templates/admin.dnsns.htmlpart
templates/admin_testmodify.dnsns.htmlpart
www/testdnsns.png
.png
www/testdnsnslg.png
.png
plugins/error.mcsplugin
.zip
plugins/firewall.mcsplugin
.zip
plugins/ftp.mcsplugin
.zip
plugins/hispeed.mcsplugin
.zip
plugins/iptv.mcsplugin
.zip
plugins/ping.mcsplugin
.zip
plugins/plc.mcsplugin
.zip
plugins/port.mcsplugin
.zip
plugins/route.mcsplugin
.zip
plugins/router.mcsplugin
.zip
plugins/sip.mcsplugin
.zip
plugins/snmp.mcsplugin
.zip
plugins/speed.mcsplugin
.zip
plugins/video.mcsplugin
.zip
plugins/voip.mcsplugin
.zip
plugins/web.mcsplugin
.zip
publishtemplates/autostart.template
.zip
publishtemplates/basic.template
.zip
publishtemplates/branded.template
.zip
publishtemplates/capacity10mb.template
.zip
publishtemplates/capacity1mb.template
.zip
publishtemplates/capacity2mb.template
.zip
publishtemplates/capacity50mb.template
.zip
publishtemplates/capacity5mb.template
.zip
publishtemplates/capacitybasic.template
.zip
publishtemplates/capacitylang.template
.zip
publishtemplates/conferencebasic.template
.zip
publishtemplates/customsize.template
.zip
publishtemplates/dhcpbasic.template
.zip
publishtemplates/firewallbasic.template
.zip
publishtemplates/firewallremoteaccess.template
.zip
publishtemplates/firewallvoip.template
.zip
publishtemplates/firewallweb.template
.zip
publishtemplates/hispeed16.template
.zip
publishtemplates/hispeed32.template
.zip
publishtemplates/hispeed64.template
.zip
publishtemplates/hispeed8.template
.zip
publishtemplates/hispeedbasic.template
.zip
publishtemplates/iptvbasic.template
.zip
publishtemplates/iptvbluray.template
.zip
publishtemplates/iptvdvd.template
.zip
publishtemplates/iptvlang.template
.zip
publishtemplates/iptvweb.template
.zip
publishtemplates/largeapplet.template
.zip
publishtemplates/routeclienttoserver.template
.zip
publishtemplates/routelang.template
.zip
publishtemplates/routeservertoclient.template
.zip
publishtemplates/routeuserdrive.template
.zip
publishtemplates/showresults.template
.zip
publishtemplates/sid.template
.zip
publishtemplates/speedbasic.template
.zip
publishtemplates/speedcap.template
.zip
publishtemplates/speedcolor.template
.zip
publishtemplates/speedgauge.template
.zip
publishtemplates/speedlang.template
.zip
publishtemplates/speedlength.template
.zip
publishtemplates/speedlogo.template
.zip
publishtemplates/speednotabs.template
.zip
publishtemplates/speedscale.template
.zip
publishtemplates/speedtesttype.template
.zip
publishtemplates/videobasic.template
.zip
publishtemplates/videobluray.template
.zip
publishtemplates/videodvd.template
.zip
publishtemplates/videolang.template
.zip
publishtemplates/videologo.template
.zip
publishtemplates/videoweb.template
.zip
publishtemplates/voipbasic.template
.zip
publishtemplates/voipg711.template
.zip
publishtemplates/voipg7231.template
.zip
publishtemplates/voipg726.template
.zip
publishtemplates/voipg728.template
.zip
publishtemplates/voipg729.template
.zip
publishtemplates/voiplang.template
.zip
publishtemplates/voiplines.template
.zip
publishtemplates/voiplogo.template
.zip
www/aarch64NQCSatellite
.elf linux aarch64
www/armNQCSatellite
.elf linux arm
www/branding.gif
www/example_templates/BoxGreen.png
.png
www/example_templates/BoxGrey.png
.png
www/example_templates/BoxRed.png
.png
www/example_templates/Red_A.gif
.gif
www/example_templates/admin.html
.html .js polyglot
www/example_templates/admin_actadvanced.html
.html .js polyglot
www/example_templates/admin_actdenied.html
.html .js polyglot
www/example_templates/admin_actgeneral.html
.html .js polyglot
www/example_templates/admin_actstatus.html
.html .js polyglot
www/example_templates/admin_actuserstatus.html
.html .js polyglot
www/example_templates/admin_alert.html
.html .js polyglot
www/example_templates/admin_alert_fileconfig.html
.html .js polyglot
www/example_templates/admin_alertselect.html
.html
www/example_templates/admin_appletconfig.html
.html .js polyglot
www/example_templates/admin_appletconfigpublish.html
.html
www/example_templates/admin_appletconfigselect.html
.html
www/example_templates/admin_cactstatus.html
.html .js polyglot
www/example_templates/admin_chooseplugins.html
.html .js polyglot
www/example_templates/admin_cloudip.html
.html .js polyglot
www/example_templates/admin_custpagewizard_0.html
.html .js polyglot
www/example_templates/admin_custpagewizard_1.html
.html
www/example_templates/admin_custpagewizard_2-err.html
.html
www/example_templates/admin_custpagewizard_2.html
.html
www/example_templates/admin_custpagewizard_3.html
.html
www/example_templates/admin_datadictionary.png
.png
www/example_templates/admin_deletealert.html
.html .js polyglot
www/example_templates/admin_deleteconfig.html
.html
www/example_templates/admin_deleteemailtemplate.html
.html
www/example_templates/admin_deletesnmptemplate.html
.html
www/example_templates/admin_deployrla.html
.html
www/example_templates/admin_deploysatellite.html
.html .js polyglot
www/example_templates/admin_emailtemplate.html
.html
www/example_templates/admin_emailtemplateselect.html
.html
www/example_templates/admin_ipalias.html
.html .js polyglot
www/example_templates/admin_ipaliasgroup.html
.html
www/example_templates/admin_ipaliasheadings.html
.html .js polyglot
www/example_templates/admin_ipaliasselect.html
.html .js polyglot
www/example_templates/admin_mirrorconfig.html
.html
www/example_templates/admin_mirrorcreate.html
.html .js polyglot
www/example_templates/admin_mirrorjoin.html
.html
www/example_templates/admin_mirrorjoin2.html
.html
www/example_templates/admin_mirrorjoincomplete.html
.html
www/example_templates/admin_mirrorjoinwait.html
.html
www/example_templates/admin_mirrorleave.html
.html
www/example_templates/admin_mirrorleavetojoin.html
.html
www/example_templates/admin_mirrornone.html
.html
www/example_templates/admin_modifyreporttemplate.html
.html .js polyglot
www/example_templates/admin_modifysatellite.html
.html .js polyglot
www/example_templates/admin_monitor_amend.html
.html
www/example_templates/admin_monitor_global_thresholds.html
.html .js polyglot
www/example_templates/admin_monitor_list.html
.html
www/example_templates/admin_monitor_order.html
.html .js polyglot
www/example_templates/admin_monitoraddlocaltest.html
.html .js polyglot
www/example_templates/admin_newuser.html
.html .js polyglot
www/example_templates/admin_notlicensed.html
.html
www/example_templates/admin_publishedpagelist.html
.html
www/example_templates/admin_publishedpages.html
.html .js polyglot
www/example_templates/admin_publishlist.html
.html
www/example_templates/admin_publishtoexisting.html
.html .js polyglot
www/example_templates/admin_publishwizard_1.html
.html
www/example_templates/admin_publishwizard_2.html
.html .js polyglot
www/example_templates/admin_publishwizard_3applet.html
.html .js polyglot
www/example_templates/admin_publishwizard_3ra.html
.html .js polyglot
www/example_templates/admin_publishwizard_4applet.html
.html .js polyglot
www/example_templates/admin_publishwizard_4ra.html
.html .js polyglot
www/example_templates/admin_publishwizard_5.html
.html
www/example_templates/admin_publishwizard_5error.html
.html
www/example_templates/admin_publishwizard_5overwrite.html
.html
www/example_templates/admin_publishwizardcomplete_error.html
.html
www/example_templates/admin_publishwizardcomplete_wait.html
.html
www/example_templates/admin_rtacats.html
.html
www/example_templates/admin_rtachangelocalworkload.html
.html
www/example_templates/admin_rtachangeworkload.html
.html .js polyglot
www/example_templates/admin_rtaconfig.html
.html .js polyglot
www/example_templates/admin_rtaconnectedclients.html
.html
www/example_templates/admin_rtacontrolondemand.html
.html .js polyglot
www/example_templates/admin_rtacreate.html
.html
www/example_templates/admin_rtacreatewizard.html
.html .js polyglot
www/example_templates/admin_rtadelete.html
.html
www/example_templates/admin_rtamodify.html
.html .js polyglot
www/example_templates/admin_rtatestmodify.html
.html .js polyglot
www/example_templates/admin_satellitestatus.html
.html
www/example_templates/admin_serverdbconfig.html
.html .js polyglot
www/example_templates/admin_serverlicensing.html
.html .js polyglot
www/example_templates/admin_serversecurity.html
.html .js polyglot
www/example_templates/admin_serversetup.html
.html .js polyglot
www/example_templates/admin_snmptemplate.html
.html
www/example_templates/admin_snmptemplateselect.html
.html
www/example_templates/admin_sql.html
.html .js polyglot
www/example_templates/admin_sql_eg3.gif
.gif
www/example_templates/admin_sqlselect.html
.html .js polyglot
www/example_templates/admin_testemail.html
.html .js polyglot
www/example_templates/admin_testmodify.html
.html .js polyglot
www/example_templates/admin_testsoverview.html
.html
www/example_templates/admin_user.html
.html .js polyglot
www/example_templates/admin_userselect.html
.html .js polyglot
www/example_templates/admin_visualpulse_amend.html
.html
www/example_templates/admin_visualpulse_list.html
.html
www/example_templates/admin_visualpulse_order.html
.html .js polyglot
www/example_templates/agentback.gif
www/example_templates/alertssm.png
.png
www/example_templates/applet.gif
.gif
www/example_templates/applet.html
.html .js polyglot
www/example_templates/bluesquare.gif
www/example_templates/c.png
.png
www/example_templates/capacity.png
.png
www/example_templates/check.png
.png
www/example_templates/checkmark.gif
.gif
www/example_templates/city_available.png
.png
www/example_templates/city_pending.png
.png
www/example_templates/city_ready.png
.png
www/example_templates/city_unavailable.png
.png
www/example_templates/cityicon.png
.png
www/example_templates/codebase.html
.html
www/example_templates/cog.png
.png
www/example_templates/comb.png
.png
www/example_templates/comingsoon.png
.png
www/example_templates/conference.png
.png
www/example_templates/connected.png
.png
www/example_templates/critical.gif
.gif
www/example_templates/custompage.html
.html
www/example_templates/customreports.png
.png
www/example_templates/darkgreenrow.png
.png
www/example_templates/darkgreenrow2.png
.png
www/example_templates/dashboard.png
.png
www/example_templates/db_alertlog.html
.html
www/example_templates/db_alertsummarylog.html
.html .js polyglot
www/example_templates/db_atk.html
.html .js polyglot
www/example_templates/db_canvas.html
.html .js polyglot
www/example_templates/db_datadictionary.html
.html
www/example_templates/db_historyitem.html
.html
www/example_templates/db_result.html
.html
www/example_templates/db_runtemplate.html
.html .js polyglot
www/example_templates/db_selectgrvtemplate.html
.html .js polyglot
www/example_templates/db_selecttemplate.html
.html .js polyglot
www/example_templates/db_systemstatus.html
.html
www/example_templates/deploysat.png
.png
www/example_templates/dns.png
.png
www/example_templates/down.png
.png
www/example_templates/downarrow.gif
.gif
www/example_templates/downbutton.png
.png
www/example_templates/eff.png
.png
www/example_templates/eg_nqcmetrics.gif
.gif
www/example_templates/eg_showextra.gif
.gif
www/example_templates/email.html
.html .js polyglot
www/example_templates/endsticker.png
.png
www/example_templates/error.html
.html
www/example_templates/errors.png
.png
www/example_templates/examples.css
www/example_templates/finishloop.png
.png
www/example_templates/firewall.png
.png
www/example_templates/fix.gif
www/example_templates/ftp.png
.png
www/example_templates/goblack.gif
.gif
www/example_templates/headerimage.png
.png
www/example_templates/headerimage2.png
.png
www/example_templates/help.gif
.gif
www/example_templates/hib.gif
.gif
www/example_templates/hispeed.png
.png
www/example_templates/iptv.png
.png
www/example_templates/java.png
.png
www/example_templates/jquery.js
.js
www/example_templates/left.png
.png
www/example_templates/lib.gif
.gif
www/example_templates/lightgreen.gif
www/example_templates/lightgreenrow.png
.png
www/example_templates/lightgreenrow2.png
.png
www/example_templates/lightorange.gif
www/example_templates/lightred.gif
www/example_templates/lightredrow.png
.png
www/example_templates/lightredrow2.png
.png
www/example_templates/lightwhite.gif
www/example_templates/linksfill.gif
.gif
www/example_templates/load.gif
.gif
www/example_templates/login.html
.html
www/example_templates/login_success.html
.html
www/example_templates/logo.png
.png
www/example_templates/mastback.gif
www/example_templates/mcs.js
.js
www/example_templates/minus.gif
.gif
www/example_templates/mirrorproblem.html
.html
www/example_templates/mirrorwait.html
.html
www/example_templates/msglobe.gif
.gif
www/example_templates/myspeedicon16.gif
.gif
www/example_templates/new.css
www/example_templates/new.js
.js
www/example_templates/newtest.gif
.gif
www/example_templates/newtestsm.gif
.gif
www/example_templates/ondemandrta.gif
.gif
www/example_templates/opts.png
.png
www/example_templates/orangebar.gif
.gif
www/example_templates/orangesquare.gif
www/example_templates/ping.png
.png
www/example_templates/plc.png
.png
www/example_templates/pleasewait.gif
.gif
www/example_templates/plus.gif
.gif
www/example_templates/popup_advsearchhelp.html
.html
www/example_templates/popup_companylogo.html
.html
www/example_templates/popup_mssqlconfig.html
.html
www/example_templates/popup_mysqlconfig.html
.html
www/example_templates/popup_raadminoneoff.html
.html
www/example_templates/popup_raappletoneoff.html
.html
www/example_templates/popup_sqlsslconfig.html
.html
www/example_templates/popup_unixrta.html
.html
www/example_templates/port.png
.png
www/example_templates/println.js
www/example_templates/publish.png
.png
www/example_templates/ra.gif
.gif
www/example_templates/redrow.png
.png
www/example_templates/redrow2.png
.png
www/example_templates/redsquare.gif
www/example_templates/reporticon.png
.png
www/example_templates/requestbanned.html
.html
www/example_templates/right.png
.png
www/example_templates/route.png
.png
www/example_templates/router.png
.png
www/example_templates/rtaconfig.gif
.gif
www/example_templates/sat.png
.png
www/example_templates/satellite.gif
.gif
www/example_templates/scripting.html
.html .js polyglot
www/example_templates/serverconfig.gif
.gif
www/example_templates/sessionid.html
.html .js polyglot
www/example_templates/sip.png
.png
www/example_templates/smlbutton.gif
.gif
www/example_templates/smrbutton.gif
.gif
www/example_templates/snmp.png
.png
www/example_templates/sorttable.js
.js
www/example_templates/speed.png
.png
www/example_templates/start_up.png
.png
www/example_templates/styles.css
www/example_templates/sumbad.gif
.gif
www/example_templates/sumgood.gif
.gif
www/example_templates/sumnone.gif
.gif
www/example_templates/sumwarning.gif
.gif
www/example_templates/tababackl.gif
.gif
www/example_templates/tababackm.gif
.gif
www/example_templates/tababackr.gif
.gif
www/example_templates/tabadvanced.gif
.gif
www/example_templates/tabcapacity.gif
.gif
www/example_templates/tabcapacitytcp.gif
.gif
www/example_templates/tabconference.gif
.gif
www/example_templates/tabconference.png
.png
www/example_templates/tabdeselected.gif
.gif
www/example_templates/tabdeselectedfill.gif
.gif
www/example_templates/tabdhcp.gif
.png
www/example_templates/tabefficiency.gif
.gif
www/example_templates/tabfirewall.gif
.gif
www/example_templates/tabgraph.gif
.gif
www/example_templates/tabhispeed.gif
.gif
www/example_templates/tabiptv.gif
.gif
www/example_templates/tabiptv.png
.png
www/example_templates/tablosses.gif
.gif
www/example_templates/tabroute.gif
.gif
www/example_templates/tabrtt.gif
.gif
www/example_templates/tabs-bg.gif
.gif
www/example_templates/tabselected.gif
.gif
www/example_templates/tabspeed.gif
.gif
www/example_templates/tabsummary.gif
.gif
www/example_templates/tabvideo.gif
.gif
www/example_templates/tabvideo.png
.png
www/example_templates/tabvoip.gif
.gif
www/example_templates/tabwbx.gif
.gif
www/example_templates/template_ra.html
.html .js polyglot
www/example_templates/test_notlicensed.html
.html
www/example_templates/test_select.html
.html .js polyglot
www/example_templates/test_setplugins.html
.html
www/example_templates/testcapacity.gif
.png
www/example_templates/testcrt.png
.png
www/example_templates/testdhcp.gif
.gif
www/example_templates/testfirewall.gif
.png
www/example_templates/testhispeed.gif
.png
www/example_templates/testiptv.gif
.png
www/example_templates/testplc.gif
.png
www/example_templates/testroute.gif
.png
www/example_templates/testspeed.gif
.png
www/example_templates/testvideo.gif
.png
www/example_templates/testvoip.gif
.png
www/example_templates/thresholds.png
.png
www/example_templates/up.png
.png
www/example_templates/uparrow.gif
.gif
www/example_templates/upbutton.png
.png
www/example_templates/video.png
.png
www/example_templates/viewsat.png
.png
www/example_templates/voip.png
.png
www/example_templates/voipcap.png
.png
www/example_templates/voipheadcp.gif
.gif
www/example_templates/warning.gif
.gif
www/example_templates/web.png
.png
www/example_templates/webtest.css
www/example_templates/wifi.png
.png
www/example_templates/xbutton.gif
.gif
www/example_templates/yellow_A.gif
.gif
www/hbss/default/default.bin
www/hbss/default/qualitytest.html
.html
www/hbss/default/speed.html
.html
www/hbss/default/voip.html
.html
www/hevif10/boot.lib
.js
www/hevif10/hevif.pds
.js
www/hevif10/initiate.js
.js
www/hevif10/j_simple.js
.js
www/hevif10/j_simple100.js
.js
www/hevif10/j_simple1000.js
.js
www/hevif10/j_worker.js
.js
www/hevif10/j_worker100.js
.js
www/hevif10/j_worker1000.js
.js
www/hevif10/j_wtg.js
.js
www/login/mastback.gif
www/login/orangebar.gif
.gif
www/login/styles.css
www/login/voipheadcp.gif
.gif
www/myspeed_s_8.jar
.jar
www/mysql-connector.jar
.jar
www/nqc/default/default.bin
www/nqc/default/index.html
.html
www/nqc/default/speed.html
.html
www/nqc/default/voip.html
.html
www/nqcs.exe
.exe windows:5 windows x86 arch:x86

2b332a2d672562b6a1bae9ab8341e70c

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:0e:e5:19:44:11:da:52:37:25:91:6e
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

05/02/2020, 18:50

Not After

25/03/2023, 18:54

Subject

SERIALNUMBER=3332172,CN=Visualware Inc.,OU=Visualware\, Inc.,O=Visualware Inc.,STREET=937 Sierra Dr,L=Turlock,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:98:51:97:d1:d5:80:e1:54:a5:ff:76:75:b0:b3:98:6e:24:60:d9:72:8c:15:cf:3a:8f:8c:13:4e:96:c0:7f
Signer

Actual PE Digest

63:98:51:97:d1:d5:80:e1:54:a5:ff:76:75:b0:b3:98:6e:24:60:d9:72:8c:15:cf:3a:8f:8c:13:4e:96:c0:7f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\nigel\OneDrive\Documents\Visualware\NetQCheck\WindowsDesktop\NQCSatellite\NQCSatellite\Release\NQCSatellite.pdb

Imports

kernel32

SetEndOfFile
HeapReAlloc
GetCurrentProcessId
GetCurrentThreadId
CreateMutexA
ReleaseMutex
CreateEventA
WaitForSingleObject
SetEvent
CloseHandle
Beep
GetComputerNameA
GetVolumeInformationA
HeapSize
CreateFileW
FlushFileBuffers
WriteConsoleW
FormatMessageA
GetProcessHeap
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
GetStringTypeW
GetFileType
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
GetWindowsDirectoryA
GetLastError
Sleep
SetFilePointerEx
GetModuleFileNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
CreateThread
ExitThread
FreeLibraryAndExitThread
QueryPerformanceFrequency
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetACP
RaiseException
ReadFile
GetConsoleMode
ReadConsoleW
GetConsoleCP
HeapFree
DecodePointer

user32

GetUserObjectInformationA
GetProcessWindowStation

advapi32

SetServiceStatus
ControlService
CreateServiceA
DeleteService
OpenSCManagerA
StartServiceA
StartServiceCtrlDispatcherA
CloseServiceHandle
RegisterServiceCtrlHandlerA
QueryServiceStatus
OpenServiceA

shell32

ShellExecuteA

winmm

timeGetTime
timeBeginPeriod
timeGetDevCaps

wsock32

setsockopt
sendto
send
select
recvfrom
htons
getsockopt
getsockname
shutdown
inet_ntoa
connect
closesocket
bind
gethostbyname
ntohl
inet_addr
ioctlsocket
htonl
socket
WSAStartup
accept
WSAGetLastError
listen
ntohs
__WSAFDIsSet
recv
getpeername

iphlpapi

GetIfEntry
GetBestRoute
IcmpCreateFile
IcmpSendEcho

Sections

.text
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
www/nqcsatellite.tar
.tar
www/nqcsatversion
www/osxNQCSatellite
.macho macos arch:x64
www/plugins_s_8.jar
.jar
www/upload.bin
www/win_nqcsatellite.exe
.exe windows:4 windows x86 arch:x86

b78ecf47c0a3e24a6f4af114e2d1f5de

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:0e:e5:19:44:11:da:52:37:25:91:6e
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

05/02/2020, 18:50

Not After

25/03/2023, 18:54

Subject

SERIALNUMBER=3332172,CN=Visualware Inc.,OU=Visualware\, Inc.,O=Visualware Inc.,STREET=937 Sierra Dr,L=Turlock,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c5:a3:e9:33:19:5c:ee:99:90:d8:e8:8c:bd:13:03:da:4d:12:b8:f5:08:b5:95:ab:9d:d9:bd:92:73:8f:24:d9
Signer

Actual PE Digest

c5:a3:e9:33:19:5c:ee:99:90:d8:e8:8c:bd:13:03:da:4d:12:b8:f5:08:b5:95:ab:9d:d9:bd:92:73:8f:24:d9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEnvironmentVariableA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
GetFileAttributesA
SetFileAttributesA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
GetFullPathNameA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
CloseHandle
SetCurrentDirectoryA
MoveFileA
CompareFileTime
GetShortPathNameA
SearchPathA
lstrcmpiA
SetFileTime
lstrcmpA
ExpandEnvironmentStringsA
GlobalUnlock
GetDiskFreeSpaceA
GlobalFree
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GlobalAlloc

user32

ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA

advapi32

RegDeleteKeyA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
www/winnqcsat.exe
.exe windows:6 windows x86 arch:x86

428a4f606702c3bcbb4dd4bde16bd3e0

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:0e:e5:19:44:11:da:52:37:25:91:6e
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

05/02/2020, 18:50

Not After

25/03/2023, 18:54

Subject

SERIALNUMBER=3332172,CN=Visualware Inc.,OU=Visualware\, Inc.,O=Visualware Inc.,STREET=937 Sierra Dr,L=Turlock,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7c:bd:5d:92:91:a1:bb:74:d1:2e:34:04:f9:0b:67:a5:ad:ef:71:f6:48:1f:b6:25:b3:e2:cb:9c:0a:f8:1c:fa
Signer

Actual PE Digest

7c:bd:5d:92:91:a1:bb:74:d1:2e:34:04:f9:0b:67:a5:ad:ef:71:f6:48:1f:b6:25:b3:e2:cb:9c:0a:f8:1c:fa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Visualware Products\NQCSatellites\WinRA - RingCentral\Release\WinRAPro.pdb

Imports

iphlpapi

IcmpSendEcho
IcmpCreateFile
GetBestRoute
GetIfEntry

kernel32

CompareStringA
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetFilePointerEx
GetTimeZoneInformation
GetStringTypeW
LCMapStringW
GetTimeFormatW
GetDateFormatW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetStdHandle
GetFileType
SetStdHandle
HeapQueryInformation
QueryPerformanceFrequency
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
VirtualQuery
VirtualAlloc
GetSystemInfo
GetCommandLineW
GetCommandLineA
RtlUnwind
OutputDebugStringW
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceW
CreateFileA
HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
HeapSize
GetLastError
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
DeleteCriticalSection
GetProcessHeap
GetModuleFileNameA
MultiByteToWideChar
ReleaseMutex
WaitForSingleObject
CreateMutexA
Sleep
GetCurrentThreadId
GetComputerNameA
Beep
CloseHandle
SetEvent
CreateEventA
GetWindowsDirectoryA
FormatMessageA
GetVolumeInformationA
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
SetLastError
FreeResource
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GlobalLock
GlobalUnlock
GlobalFree
LoadLibraryW
FindResourceA
GlobalAlloc
GlobalSize
LocalFree
MulDiv
CopyFileA
EncodePointer
GetSystemDirectoryW
FreeLibrary
LoadLibraryExW
GlobalDeleteAtom
lstrcmpW
LoadLibraryA
GlobalAddAtomA
GlobalFindAtomA
GlobalGetAtomNameA
CreateFileW
GetVersionExA
DeleteFileA
FindClose
FindFirstFileA
FlushFileBuffers
GetFileSize
GetFullPathNameA
LockFile
ReadFile
SetEndOfFile
SetFilePointer
UnlockFile
WriteFile
DuplicateHandle
GetCurrentProcess
lstrcmpiA
GetThreadLocale
GetCurrentThread
lstrcmpA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
VerSetConditionMask
lstrcpyA
VerifyVersionInfoA
SetThreadPriority
ResumeThread
GetACP
GlobalFlags
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
FileTimeToSystemTime
GetCurrentDirectoryA
CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
VirtualProtect
GetOEMCP
GetCPInfo
FileTimeToLocalFileTime
GetFileAttributesA
GetFileAttributesExA
GetFileSizeEx
GetFileTime
SystemTimeToTzSpecificLocalTime
SetErrorMode
GetTempPathA
GetTempFileNameA
SearchPathA
GetTickCount
GetProfileIntA
FindResourceExW
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead

user32

GetIconInfo
GetDoubleClickTime
LockWindowUpdate
BringWindowToTop
SetCursorPos
LoadImageW
LoadImageA
DestroyIcon
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetParent
GetNextDlgGroupItem
SetRect
InvalidateRgn
CopyAcceleratorTableA
CharNextA
WaitMessage
CopyImage
MonitorFromPoint
UnionRect
EnableScrollBar
UpdateLayeredWindow
SetMenuDefaultItem
GetMenuDefaultItem
CreatePopupMenu
NotifyWinEvent
WindowFromPoint
MessageBeep
DeleteMenu
LoadMenuW
KillTimer
ReleaseCapture
SetCapture
GetAsyncKeyState
IsZoomed
TrackMouseEvent
IntersectRect
RealChildWindowFromPoint
GetMenuItemInfoA
DestroyMenu
SetCursor
ShowOwnedPopups
TranslateMessage
GetMessageA
EnumDisplayMonitors
SystemParametersInfoA
LoadCursorW
LoadCursorA
SetRectEmpty
SetLayeredWindowAttributes
DrawIconEx
IsRectEmpty
OffsetRect
InflateRect
DrawFocusRect
GetSysColorBrush
SetWindowRgn
DrawFrameControl
DrawEdge
MapDialogRect
SetWindowContextHelpId
PostQuitMessage
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CopyIcon
CheckMenuItem
CharUpperA
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconA
GetTopWindow
GetClassLongA
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetSystemMenu
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
SetForegroundWindow
GetForegroundWindow
TrackPopupMenu
SetMenu
GetMenu
AppendMenuA
LoadBitmapW
SetTimer
IsWindowEnabled
SetActiveWindow
GetWindowLongA
GetDesktopWindow
GetParent
GetCapture
GetKeyState
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
IsChild
IsMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
PostMessageA
GetMessageTime
GetMessagePos
PeekMessageA
DispatchMessageA
RegisterWindowMessageA
IsDialogMessageA
GetWindow
SetWindowLongA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
ModifyMenuA
DestroyAcceleratorTable
SetClassLongA
GetUpdateRect
GetKeyboardLayout
GetKeyboardState
ToAsciiEx
MapVirtualKeyA
LoadAcceleratorsW
CreateAcceleratorTableA
RegisterClipboardFormatA
CharUpperBuffA
LoadAcceleratorsA
TranslateAcceleratorA
SetFocus
GetDlgCtrlID
LoadMenuA
InsertMenuItemA
SendMessageA
EnableWindow
UnregisterClassA
EnableMenuItem
LoadIconW
MessageBoxA
GetWindowThreadProcessId
GetLastActivePopup
GetMenuStringA
GetMenuState
GetSubMenu
GetMenuItemID
GetActiveWindow
GetMenuItemCount
InsertMenuA
RemoveMenu
DrawTextA
DrawTextExA
GrayStringA
TabbedTextOutA
GetDC
GetWindowDC
ReleaseDC
BeginPaint
EndPaint
ClientToScreen
ScreenToClient
GetSysColor
GetFocus
GetWindowRect
GetCursorPos
PtInRect
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
ShowWindow
MoveWindow
SetWindowPos
SetDlgItemTextA
CheckDlgButton
SendDlgItemMessageA
IsIconic
GetSystemMetrics
GetClientRect
InvalidateRect
IsWindowVisible
GetProcessWindowStation
GetUserObjectInformationA
DrawStateA
UpdateWindow
FillRect
GetClassNameA
IsWindow
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetDlgItem
GetNextDlgTabItem
GetWindowRgn
DestroyCursor
DrawIcon
InvertRect
HideCaret
CreateMenu
GetComboBoxInfo
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
DrawMenuBar
MapVirtualKeyExA
IsCharLowerA
IsClipboardFormatAvailable
SubtractRect
GetKeyNameTextA
PostThreadMessageA
FrameRect
ReuseDDElParam
GetScrollRange
UnpackDDElParam

gdi32

BitBlt
CreateDIBSection
GetObjectA
CreateCompatibleDC
SetDIBColorTable
SelectObject
DeleteObject
GetStockObject
GetTextFaceA
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
SetPaletteEntries
ExtFloodFill
LPtoDP
GetSystemPaletteEntries
GetNearestPaletteIndex
EnumFontFamiliesExA
GetPaletteEntries
CreatePalette
RoundRect
OffsetRgn
Rectangle
StretchBlt
SetPixel
RealizePalette
GetRgnBox
CreateRoundRectRgn
DPtoLP
SetRectRgn
GetMapMode
GetTextCharsetInfo
EnumFontFamiliesA
CreateFontIndirectA
CreateDIBitmap
CreateCompatibleBitmap
GetTextMetricsA
Polyline
Polygon
CreatePolygonRgn
PatBlt
GetTextExtentPoint32A
GetTextColor
GetBkColor
Ellipse
CreateRectRgnIndirect
CreateEllipticRgn
CombineRgn
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutA
TextOutA
MoveToEx
SetTextAlign
SetTextColor
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SetBkColor
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
CreateSolidBrush
GetClipBox
ExcludeClipRect
Escape
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateBitmap
GetDeviceCaps
CreateDCA
CopyMetaFileA
DeleteDC

msimg32

AlphaBlend
TransparentBlt

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegDeleteValueA
CreateServiceA
ChangeServiceConfig2A
CloseServiceHandle
ControlService
DeleteService
OpenServiceA
QueryServiceStatus
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
RegEnumKeyExA
RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegSetValueExA
OpenSCManagerA
RegDeleteKeyA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

DragQueryFileA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetDesktopFolder
DragFinish
SHGetFileInfoA
ShellExecuteA
SHAppBarMessage

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameA
PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA
PathFindExtensionA
StrFormatKBSizeA

uxtheme

DrawThemeText
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetWindowTheme
IsAppThemed
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
DrawThemeParentBackground

ole32

CoFreeUnusedLibraries
OleInitialize
OleUninitialize
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleLockRunning
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoRevokeClassObject
CoRegisterMessageFilter
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CoInitialize
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoUninitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc

oleaut32

LoadTypeLi
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SysStringLen
VariantCopy
VarBstrFromDate
OleCreateFontIndirect
SysAllocString
VariantChangeType
VariantClear
SysAllocStringLen
VariantInit
SysAllocStringByteLen
SysFreeString

oledlg

ord8

gdiplus

GdipFree
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromFile
GdiplusStartup
GdipCreateBitmapFromStream
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdiplusShutdown

ws2_32

recv
__WSAFDIsSet
ntohs
listen
accept
WSAGetLastError
WSAStartup
socket
shutdown
setsockopt
sendto
send
select
recvfrom
htons
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
gethostbyname
ntohl
inet_ntoa
inet_addr
htonl

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

timeGetDevCaps
timeBeginPeriod
PlaySoundA
timeGetTime

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 376KB - Virtual size: 375KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
www/x86_64NQCSatellite
.elf linux x64

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

71:0e:e5:19:44:11:da:52:37:25:91:6eCertificate

Extended Key Usages

Key Usages

33:90:20:77:61:c4:26:dd:94:50:03:0dCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

90:4e:4f:62:13:fb:b5:24:b0:e5:a2:d1:c2:bc:54:48:55:20:5e:93:89:b7:c4:c8:e2:76:63:e6:9b:3b:45:afSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 151KB

.ndata Size: - Virtual size: 96KB

.rsrc Size: 19KB - Virtual size: 18KB

7be0a90f26d9bff402fabbfd9a7313c5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 512B - Virtual size: 446B

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

8773e19ae02f331332db1b00671fdecf

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

wininet

comctl32

Exports

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

71:0e:e5:19:44:11:da:52:37:25:91:6e
Certificate

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

90:4e:4f:62:13:fb:b5:24:b0:e5:a2:d1:c2:bc:54:48:55:20:5e:93:89:b7:c4:c8:e2:76:63:e6:9b:3b:45:af
Signer

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 151KB

.ndata
Size: - Virtual size: 96KB

.rsrc
Size: 19KB - Virtual size: 18KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 512B - Virtual size: 446B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 572B

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 1KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 632B

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 636B