298937b10b113d6f4872c9a67f85a4b9_JaffaCakes118

resource
298937b10b113d6f4872c9a67f85a4b9_JaffaCakes118
unpack001/$PLUGINSDIR/NSISpcre.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$TEMP/AlawarGameBoxSetup.exe
unpack002/$PLUGINSDIR/AccessControl.dll
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/StartMenu.dll

resource	yara_rule
static1/unpack001/$TEMP/AlawarGameBoxSetup.exe	nsis_installer_1

.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime

CompareFileTime

SearchPathW

GetShortPathNameW

GetFullPathNameW

MoveFileW

SetCurrentDirectoryW

GetFileAttributesW

GetLastError

CreateDirectoryW

SetFileAttributesW

Sleep

GetTickCount

CreateFileW

GetFileSize

GetModuleFileNameW

GetCurrentProcess

CopyFileW

ExitProcess

GetWindowsDirectoryW

GetTempPathW

GetCommandLineW

SetErrorMode

CloseHandle

lstrlenW

lstrcpynW

GetDiskFreeSpaceW

GlobalUnlock

GlobalLock

CreateThread

LoadLibraryW

CreateProcessW

lstrcmpiA

GetTempFileNameW

lstrcatW

GetProcAddress

LoadLibraryA

GetModuleHandleA

OpenProcess

lstrcpyW

GetVersionExW

GetSystemDirectoryW

GetVersion

lstrcpyA

RemoveDirectoryW

lstrcmpiW

lstrcmpW

ExpandEnvironmentStringsW

GlobalAlloc

WaitForSingleObject

GetExitCodeProcess

GlobalFree

GetModuleHandleW

LoadLibraryExW

FreeLibrary

WritePrivateProfileStringW

GetPrivateProfileStringW

WideCharToMultiByte

MulDiv

lstrlenA

WriteFile

ReadFile

MultiByteToWideChar

SetFilePointer

FindClose

FindNextFileW

FindFirstFileW

DeleteFileW

lstrcpynA

user32

ScreenToClient

GetMessagePos

CallWindowProcW

IsWindowVisible

LoadBitmapW

CloseClipboard

SetClipboardData

EmptyClipboard

OpenClipboard

TrackPopupMenu

GetWindowRect

AppendMenuW

CreatePopupMenu

GetSystemMetrics

EndDialog

EnableMenuItem

GetSystemMenu

SetClassLongW

IsWindowEnabled

SetWindowPos

DialogBoxParamW

CheckDlgButton

CreateWindowExW

SystemParametersInfoW

RegisterClassW

SetDlgItemTextW

GetDlgItemTextW

MessageBoxIndirectW

CharNextA

CharUpperW

CharPrevW

DispatchMessageW

PeekMessageW

wsprintfA

DestroyWindow

CreateDialogParamW

SetTimer

SetWindowTextW

PostQuitMessage

SetForegroundWindow

ShowWindow

wsprintfW

SendMessageTimeoutW

LoadCursorW

SetCursor

GetWindowLongW

GetSysColor

CharNextW

GetClassInfoW

ExitWindowsEx

FindWindowExW

GetDlgItem

SetWindowLongW

LoadImageW

GetDC

EnableWindow

InvalidateRect

SendMessageW

DefWindowProcW

BeginPaint

GetClientRect

FillRect

DrawTextW

EndPaint

IsWindow

gdi32

SetBkColor

GetDeviceCaps

DeleteObject

CreateBrushIndirect

CreateFontIndirectW

SetBkMode

SetTextColor

SelectObject

shell32

SHBrowseForFolderW

SHGetPathFromIDListW

SHGetFileInfoW

ShellExecuteW

SHFileOperationW

SHGetSpecialFolderLocation

advapi32

RegEnumKeyW

RegOpenKeyExW

RegCloseKey

RegDeleteKeyW

RegDeleteValueW

RegCreateKeyExW

RegSetValueExW

RegQueryValueExW

RegEnumValueW

comctl32

ImageList_AddMasked

ImageList_Destroy

ord17

ImageList_Create

ole32

CoTaskMemFree

OleInitialize

OleUninitialize

CoCreateInstance

version

GetFileVersionInfoSizeW

GetFileVersionInfoW

VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 293KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

$PLUGINSDIR/NSISpcre.dll

.dll windows:5 windows x86 arch:x86

836f4951fb4175e54bfc7d7dac9c4c85

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\projects\NSISpcre\Release\NSISpcre.pdb

Imports

kernel32

GlobalAlloc

WideCharToMultiByte

lstrcpynW

MultiByteToWideChar

GlobalFree

lstrcpyW

EncodePointer

DecodePointer

GetCurrentThreadId

GetCommandLineA

GetLastError

HeapFree

HeapAlloc

RaiseException

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

IsProcessorFeaturePresent

Sleep

HeapSize

GetProcAddress

GetModuleHandleW

ExitProcess

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

InterlockedIncrement

SetLastError

InterlockedDecrement

SetHandleCount

GetStdHandle

InitializeCriticalSectionAndSpinCount

GetFileType

GetStartupInfoW

DeleteCriticalSection

GetModuleFileNameA

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapCreate

HeapDestroy

QueryPerformanceCounter

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

WriteFile

GetModuleFileNameW

RtlUnwind

HeapReAlloc

LeaveCriticalSection

EnterCriticalSection

LoadLibraryW

LCMapStringW

GetStringTypeW

user32

wsprintfW

Exports

RECheckPattern

REClearAllOptions

REClearOption

REFind

REFindClose

REFindNext

REGetOption

REMatches

REQuoteMeta

REReplace

RESetOption

Sections

.text
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc

GlobalFree

GlobalSize

GetLastError

lstrcpyW

lstrcpynW

GetProcAddress

WideCharToMultiByte

lstrcatW

lstrlenW

lstrcmpiW

LoadLibraryW

GetModuleHandleW

MultiByteToWideChar

VirtualAlloc

VirtualProtect

FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString

StringFromGUID2

Exports

Alloc

Call

Copy

Free

Get

Int64Op

Store

StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/asktoolbar.bmp

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc

MulDiv

lstrlenW

HeapFree

GetProcessHeap

lstrcmpiW

HeapReAlloc

lstrcpynW

GetFileAttributesW

lstrcpyW

GetCurrentDirectoryW

SetCurrentDirectoryW

HeapAlloc

GlobalFree

user32

LoadCursorW

RemovePropW

DrawFocusRect

GetPropW

DrawTextW

GetWindowTextW

GetDlgItem

SetWindowLongW

SetWindowPos

CreateDialogParamW

MapWindowPoints

GetWindowRect

SetCursor

CreateWindowExW

IsWindow

SetTimer

KillTimer

DispatchMessageW

TranslateMessage

GetMessageW

IsDialogMessageW

ShowWindow

wsprintfW

GetClientRect

CharPrevW

CallWindowProcW

SetPropW

DestroyWindow

MapDialogRect

CharNextW

SendMessageW

GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW

SHBrowseForFolderW

comdlg32

GetSaveFileNameW

CommDlgExtendedError

GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Create

CreateControl

CreateItem

CreateTimer

GetUserData

KillTimer

OnBack

OnChange

OnClick

OnNotify

SelectFileDialog

SelectFolderDialog

SetRTL

SetUserData

Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$TEMP/AlawarGameBoxSetup.exe

.exe windows:4 windows x86 arch:x86

97318da386948415d08cef4a9006d669

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime

SearchPathA

GetShortPathNameA

GetFullPathNameA

MoveFileA

SetCurrentDirectoryA

GetFileAttributesA

GetLastError

CreateDirectoryA

SetFileAttributesA

Sleep

CreateFileA

GetFileSize

GetModuleFileNameA

GetTickCount

GetCurrentProcess

CopyFileA

ExitProcess

SetFileTime

GetTempPathA

GetCommandLineA

SetErrorMode

LoadLibraryA

lstrcpynA

GetDiskFreeSpaceA

GlobalUnlock

GlobalLock

CreateThread

CreateProcessA

RemoveDirectoryA

GetTempFileNameA

lstrlenA

lstrcatA

GetSystemDirectoryA

GetVersion

CloseHandle

lstrcmpiA

lstrcmpA

ExpandEnvironmentStringsA

GlobalFree

GlobalAlloc

WaitForSingleObject

GetExitCodeProcess

GetModuleHandleA

LoadLibraryExA

GetProcAddress

FreeLibrary

MultiByteToWideChar

WritePrivateProfileStringA

GetPrivateProfileStringA

WriteFile

ReadFile

MulDiv

SetFilePointer

FindClose

FindNextFileA

FindFirstFileA

DeleteFileA

GetWindowsDirectoryA

user32

EndDialog

ScreenToClient

GetWindowRect

EnableMenuItem

GetSystemMenu

SetClassLongA

IsWindowEnabled

SetWindowPos

GetSysColor

GetWindowLongA

SetCursor

LoadCursorA

CheckDlgButton

GetMessagePos

LoadBitmapA

CallWindowProcA

IsWindowVisible

CloseClipboard

SetClipboardData

EmptyClipboard

RegisterClassA

TrackPopupMenu

AppendMenuA

CreatePopupMenu

GetSystemMetrics

SetDlgItemTextA

GetDlgItemTextA

MessageBoxIndirectA

CharPrevA

DispatchMessageA

PeekMessageA

CreateDialogParamA

DestroyWindow

SetTimer

SetWindowTextA

PostQuitMessage

SetForegroundWindow

wsprintfA

SendMessageTimeoutA

FindWindowExA

SystemParametersInfoA

CreateWindowExA

GetClassInfoA

DialogBoxParamA

CharNextA

OpenClipboard

ExitWindowsEx

IsWindow

GetDlgItem

SetWindowLongA

LoadImageA

GetDC

EnableWindow

InvalidateRect

SendMessageA

DefWindowProcA

BeginPaint

GetClientRect

FillRect

DrawTextA

EndPaint

ShowWindow

gdi32

SetBkColor

GetDeviceCaps

DeleteObject

CreateBrushIndirect

CreateFontIndirectA

SetBkMode

SetTextColor

SelectObject

shell32

SHGetPathFromIDListA

SHBrowseForFolderA

SHGetFileInfoA

ShellExecuteA

SHFileOperationA

SHGetSpecialFolderLocation

advapi32

RegQueryValueExA

RegSetValueExA

RegEnumKeyA

RegEnumValueA

RegOpenKeyExA

RegDeleteKeyA

RegDeleteValueA

RegCloseKey

RegCreateKeyExA

comctl32

ImageList_AddMasked

ImageList_Destroy

ord17

ImageList_Create

ole32

CoTaskMemFree

OleInitialize

OleUninitialize

CoCreateInstance

version

GetFileVersionInfoSizeA

GetFileVersionInfoA

VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

$PLUGINSDIR/AccessControl.dll

.dll windows:4 windows x86 arch:x86

d424185394c507e5a7ca428de07aeda0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

d:\Program Files\Nsis\Contrib\AccessControl\Release\AccessControl.pdb

Imports

advapi32

LookupAccountNameA

SetNamedSecurityInfoA

SetEntriesInAclA

BuildExplicitAccessWithNameA

GetNamedSecurityInfoA

ConvertStringSidToSidA

shlwapi

StrDupA

wvnsprintfA

kernel32

GetFileAttributesA

GetLastError

GlobalFree

lstrcpyA

lstrcpynA

GlobalAlloc

LocalFree

LocalAlloc

lstrcmpiA

user32

GetDlgItem

FindWindowExA

SetWindowTextA

Exports

DenyOnFile

DenyOnRegKey

GrantOnFile

GrantOnRegKey

RevokeOnFile

RevokeOnRegKey

SetFileGroup

SetFileOwner

SetOnFile

SetOnRegKey

SetRegKeyGroup

SetRegKeyOwner

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/InstallOptions.dll

.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA

GetCurrentDirectoryA

MultiByteToWideChar

GetPrivateProfileIntA

GlobalLock

GetModuleHandleA

lstrcmpiA

GetPrivateProfileStringA

lstrcatA

lstrcpynA

WritePrivateProfileStringA

lstrlenA

lstrcpyA

GlobalFree

GlobalUnlock

GlobalAlloc

user32

MapWindowPoints

GetDlgCtrlID

CloseClipboard

GetClipboardData

OpenClipboard

PtInRect

SetWindowRgn

LoadIconA

LoadImageA

SetWindowLongA

CreateWindowExA

MapDialogRect

SetWindowPos

GetWindowRect

CreateDialogParamA

ShowWindow

EnableMenuItem

GetSystemMenu

EnableWindow

GetDlgItem

DestroyIcon

DestroyWindow

DispatchMessageA

TranslateMessage

GetMessageA

IsDialogMessageA

LoadCursorA

SetCursor

DrawTextA

GetWindowLongA

DrawFocusRect

CallWindowProcA

PostMessageA

MessageBoxA

CharNextA

wsprintfA

GetWindowTextA

SetWindowTextA

SendMessageA

GetClientRect

gdi32

SetTextColor

CreateCompatibleDC

GetObjectA

GetDIBits

CreateRectRgn

CombineRgn

DeleteObject

SelectObject

shell32

SHBrowseForFolderA

SHGetDesktopFolder

SHGetPathFromIDListA

ShellExecuteA

comdlg32

GetOpenFileNameA

GetSaveFileNameA

CommDlgExtendedError

ole32

CoTaskMemFree

Exports

dialog

initDialog

show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/StartMenu.dll

.dll windows:4 windows x86 arch:x86

7868cd55f358bfb360f9eb8ce1512ca0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA

GlobalAlloc

MulDiv

GetModuleHandleA

GlobalFree

FindClose

FindNextFileA

FindFirstFileA

lstrcmpiA

lstrcatA

lstrcpyA

user32

TranslateMessage

GetMessageA

IsDialogMessageA

PostMessageA

DispatchMessageA

GetWindowLongA

CheckDlgButton

ShowWindow

LoadIconA

GetClientRect

MoveWindow

ScreenToClient

GetWindowRect

ReleaseDC

GetDC

EnableWindow

SetWindowTextA

SendMessageA

IsDlgButtonChecked

GetWindowTextA

DestroyWindow

GetDlgItem

CreateDialogParamA

SetWindowLongA

wsprintfA

CallWindowProcA

gdi32

GetTextMetricsA

SelectObject

shell32

SHGetSpecialFolderLocation

SHGetPathFromIDListA

ole32

CoTaskMemFree

Exports

Init

Select

Show

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/insttype_page.ini

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/shortcut_page.ini

$_7_/temp/template.zip

$TEMP/AwrAskToolbar/ApnIC.dll

.dll windows:5 windows x86 arch:x86

0a90a95f9366c4237127aaf88551ac12

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

Extended Key Usages

ExtKeyUsageServerAuth

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:65:f2:ac:72:36:c7:e1:bd:ca:44:ed:13:9b:27:3a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/06/2011, 00:00

Not After

18/06/2014, 23:59

Subject

CN=Ask.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Distribution,O=Ask.com,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

e7:c6:51:67:c6:fb:d0:24:c2:89:0f:86:e1:cd:7b:ea:68:c8:3c:3f
Signer

Actual PE Digest

e7:c6:51:67:c6:fb:d0:24:c2:89:0f:86:e1:cd:7b:ea:68:c8:3c:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

c:\hudson\jobs\APN_Stub1.0\workspace\AskStub\Release\APNIC.pdb

Imports

kernel32

lstrcmpW

lstrcatW

GetLastError

CloseHandle

GetCurrentProcess

GetProcAddress

LoadLibraryW

GetVersionExW

CreateDirectoryW

GetTempPathW

DeleteFileW

GetLocalTime

GetFileTime

CreateFileW

lstrlenA

FormatMessageW

InterlockedDecrement

GetModuleHandleW

FreeLibrary

WideCharToMultiByte

MultiByteToWideChar

GetSystemDefaultLangID

HeapSize

GetLocaleInfoA

GetCurrentProcessId

lstrlenW

LocalFree

lstrcmpiW

lstrcpyW

WriteConsoleW

SetStdHandle

LoadLibraryA

CreateFileA

SetEndOfFile

TlsFree

SetLastError

GetPrivateProfileStringW

GetTickCount

QueryPerformanceCounter

GetEnvironmentStringsW

GetConsoleOutputCP

WriteConsoleA

GetLocaleInfoW

InitializeCriticalSectionAndSpinCount

IsValidLocale

EnumSystemLocalesA

GetUserDefaultLCID

TlsSetValue

TlsAlloc

TlsGetValue

HeapAlloc

GetStringTypeW

FreeEnvironmentStringsW

GetEnvironmentStrings

FreeEnvironmentStringsA

GetModuleFileNameA

ExitProcess

SetFilePointer

ReadFile

FlushFileBuffers

GetConsoleMode

GetConsoleCP

WriteFile

GetStartupInfoA

GetFileType

GetStdHandle

SetHandleCount

GetStringTypeA

IsValidCodePage

GetOEMCP

GetACP

GetModuleHandleA

HeapReAlloc

VirtualAlloc

VirtualFree

HeapDestroy

InterlockedIncrement

InterlockedCompareExchange

InterlockedExchange

Sleep

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

HeapFree

GetProcessHeap

RtlUnwind

TerminateProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RaiseException

GetCPInfo

GetSystemTimeAsFileTime

GetCurrentThreadId

GetCommandLineA

LCMapStringA

LCMapStringW

HeapCreate

advapi32

RegDeleteKeyW

RegCreateKeyExW

RegSetValueExW

RegQueryValueExW

RegQueryInfoKeyW

RegEnumValueW

RegDeleteValueW

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

shell32

SHGetFolderPathW

ole32

CoCreateInstance

CoUninitialize

CoInitialize

oleaut32

SysAllocString

SysFreeString

shlwapi

SHDeleteKeyW

PathFileExistsW

StrStrIW

wininet

HttpEndRequestW

InternetReadFile

HttpSendRequestW

HttpOpenRequestW

InternetSetOptionW

InternetCloseHandle

InternetConnectW

InternetCrackUrlW

InternetOpenW

HttpSendRequestExW

HttpQueryInfoW

version

GetFileVersionInfoW

GetFileVersionInfoSizeW

VerQueryValueW

rpcrt4

UuidCreate

UuidToStringW

RpcStringFreeW

Exports

DoCheckInstall

DoCheckOverInstall

DoPostInstall

DoPreCheck

DoPreInstall

GetPayloadPath

VolatileStoreClearMacroData

Sections

.text
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$TEMP/AwrAskToolbar/ApnStub.exe

.exe windows:5 windows x86 arch:x86

86fb79068ef3ff29722239f60c6b67f4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

28:6f:8a:30:e2:ea:c6:96:5b:93:6f:82:6a:05:30:5d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/06/2008, 00:00

Not After

17/06/2011, 23:59

Subject

CN=Ask.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Distribution,O=Ask.com,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f0:94:ef:8e:10:5c:c7:23:d5:68:01:fb:14:da:13:e3:cb:ed:ab:64
Signer

Actual PE Digest

f0:94:ef:8e:10:5c:c7:23:d5:68:01:fb:14:da:13:e3:cb:ed:ab:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\hudson\jobs\AskStub\workspace\AskStub\Release\APNStub.pdb

Imports

msi

ord224

crypt32

CertFreeCertificateContext

CertGetNameStringW

urlmon

IsValidURL

URLDownloadToFileW

kernel32

SetEnvironmentVariableA

GetStartupInfoW

CompareStringW

CompareStringA

CreateFileA

lstrlenW

GetTempPathW

lstrcatW

DeleteFileW

lstrcpyW

GetTickCount

Sleep

GetModuleFileNameW

GetTempFileNameW

FindFirstFileW

GetNativeSystemInfo

SetFilePointer

GetCurrentProcess

CompareFileTime

CreateDirectoryW

WriteFile

WideCharToMultiByte

GetVersionExW

ReadFile

CreateFileW

MultiByteToWideChar

FlushFileBuffers

GetLastError

FindClose

IsWow64Process

GetSystemInfo

FindNextFileW

CloseHandle

GetSystemTime

FreeLibrary

WaitForSingleObject

LoadLibraryW

FormatMessageW

GetExitCodeProcess

SetLastError

GetProcAddress

LocalFree

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

GetLocaleInfoA

GetStringTypeW

GetStringTypeA

LCMapStringA

LoadLibraryA

InitializeCriticalSectionAndSpinCount

RtlUnwind

GetConsoleMode

GetConsoleCP

HeapSize

LCMapStringW

IsValidCodePage

FileTimeToSystemTime

FileTimeToLocalFileTime

GetDriveTypeW

GetFullPathNameW

GetModuleHandleA

TerminateProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

HeapFree

GetCurrentDirectoryA

HeapAlloc

RaiseException

GetDriveTypeA

DeleteCriticalSection

LeaveCriticalSection

EnterCriticalSection

GetModuleHandleW

ExitProcess

GetStdHandle

GetModuleFileNameA

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetCommandLineW

SetHandleCount

GetFileType

GetStartupInfoA

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

InterlockedIncrement

GetCurrentThreadId

InterlockedDecrement

HeapCreate

VirtualFree

QueryPerformanceCounter

GetCurrentProcessId

GetSystemTimeAsFileTime

GetTimeZoneInformation

VirtualAlloc

HeapReAlloc

GetCPInfo

GetACP

GetOEMCP

user32

wsprintfW

MessageBoxW

GetForegroundWindow

shell32

ShellExecuteExW

ole32

IIDFromString

CoInitializeEx

CoCreateInstance

rpcrt4

UuidToStringW

RpcStringFreeW

UuidCreate

wininet

InternetOpenW

InternetCrackUrlW

InternetConnectW

InternetCloseHandle

HttpSendRequestA

HttpQueryInfoW

HttpOpenRequestW

HttpAddRequestHeadersA

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$TEMP/AwrAskToolbar/ApnToolbarInstaller.exe

.exe windows:5 windows x86 arch:x86

710deed9ec637659e39599bbee51e458

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

Extended Key Usages

ExtKeyUsageServerAuth

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

09:65:f2:ac:72:36:c7:e1:bd:ca:44:ed:13:9b:27:3a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/06/2011, 00:00

Not After

18/06/2014, 23:59

Subject

CN=Ask.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Distribution,O=Ask.com,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

70:51:5b:71:01:50:c8:81:d0:b3:36:02:11:a9:f7:b8:4c:2f:e5:ba
Signer

Actual PE Digest

70:51:5b:71:01:50:c8:81:d0:b3:36:02:11:a9:f7:b8:4c:2f:e5:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\hudson\jobs\ToolbarCore_Staging\workspace\build\ToolbarCore\toolbar\ie\src\toolbar\wrapper\Release\externalwrapper.pdb

Imports

shlwapi

PathFileExistsW

StrStrIW

StrCmpNIW

SHDeleteValueW

msi

ord92

ord113

ord163

ord160

ord20

ord125

ord159

ord8

ord70

ord205

ord32

ord118

kernel32

GetLocaleInfoW

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

GetCommandLineW

FileTimeToDosDateTime

GetTempFileNameW

lstrlenA

FindResourceW

LoadResource

WaitForSingleObject

GetTickCount

WriteFile

WideCharToMultiByte

SizeofResource

GetExitCodeProcess

CreateFileW

MultiByteToWideChar

lstrlenW

GetTempPathW

FindFirstFileA

GetLastError

FindClose

GetLocalTime

lstrcmpiW

CloseHandle

SetEndOfFile

DeleteFileW

LocalFree

CreateFileA

SetFilePointer

ReadFile

GetVersionExW

CreateDirectoryW

GetPrivateProfileStringW

GetFileTime

InterlockedDecrement

GetSystemDefaultLangID

FreeLibrary

GetCurrentProcess

GetModuleHandleW

LoadLibraryW

GetProcAddress

GetSystemInfo

LoadLibraryA

InitializeCriticalSectionAndSpinCount

GetModuleHandleA

GetSystemTimeAsFileTime

GetCPInfo

TlsSetValue

TlsFree

SetLastError

GetCurrentThreadId

FileTimeToLocalFileTime

TlsAlloc

TlsGetValue

IsValidCodePage

GetOEMCP

GetACP

IsValidLocale

EnumSystemLocalesA

GetLocaleInfoA

GetUserDefaultLCID

HeapSize

GetCurrentProcessId

IsDebuggerPresent

SetUnhandledExceptionFilter

UnhandledExceptionFilter

TerminateProcess

HeapAlloc

QueryPerformanceCounter

GetEnvironmentStringsW

FreeEnvironmentStringsW

GetStringTypeW

GetModuleFileNameW

GetStringTypeA

FlushFileBuffers

GetConsoleMode

GetConsoleCP

GetStartupInfoA

GetFileType

SetHandleCount

GetModuleFileNameA

GetStdHandle

ExitProcess

HeapReAlloc

VirtualAlloc

VirtualFree

LCMapStringA

LCMapStringW

RtlUnwind

RaiseException

HeapCreate

InterlockedIncrement

InterlockedCompareExchange

InterlockedExchange

Sleep

InitializeCriticalSection

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

HeapFree

GetProcessHeap

GetStartupInfoW

user32

GetSystemMetrics

advapi32

RegCloseKey

RegEnumKeyExW

RegDeleteKeyW

RegDeleteValueW

RegSetValueExW

RegOpenKeyExW

RegEnumValueW

RegQueryInfoKeyW

RegQueryValueExW

shell32

ShellExecuteExW

SHGetFolderPathW

CommandLineToArgvW

SHGetSpecialFolderPathW

SHCreateDirectoryExW

ole32

CoCreateInstance

OleInitialize

OleUninitialize

CoUninitialize

CoInitialize

oleaut32

SysFreeString

VariantInit

SysAllocString

wininet

InternetCanonicalizeUrlW

InternetSetOptionW

HttpEndRequestW

HttpSendRequestExW

InternetCloseHandle

HttpSendRequestA

HttpAddRequestHeadersA

HttpOpenRequestW

HttpQueryInfoW

InternetReadFile

InternetCrackUrlW

InternetOpenW

HttpSendRequestW

InternetConnectW

version

VerQueryValueW

GetFileVersionInfoW

GetFileVersionInfoSizeW

rpcrt4

UuidToStringW

RpcStringFreeW

UuidCreate

urlmon

URLDownloadToFileW

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$TEMP/gamebox_eula.rtf

.rtf

$TEMP/installdataen_$HWNDPARENT/10833/wdata/cert_activation.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/email_activation.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/frame.html

.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/games.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/ieframe_tab0.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/ieframe_tab0nofooter.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/ieframe_tab1.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/ieframe_tab2.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/ieframe_tab3.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/ieframe_tab4.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/no_connect.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_alipay.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_avangate.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_aw_online_activation.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_aw_subscription.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_aw_subscription_info.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_aw_subscription_v2.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_boacompra.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_boacompra_positivo.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_boacompra_sms.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_boleto.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_cards.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_cards_info.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_direct_debet.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_djuice.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_enter_key.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_igame.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_ipko.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_kwedit.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_lotus.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_more.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_more_info.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_mtransfer.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_novotelecom.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_paynet.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_paypal.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_rewardspay.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_safe_cart.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_seven_eleven.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_sms.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_sms_djuice.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_sms_ppc.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_sms_ptterms.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_terminal.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_trialpay.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_uol.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_vcards.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_vio.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_virgopass.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_wavepoint.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_wm.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_wmyandex.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_yandex.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/payments_yetipay.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/register.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/register_ie.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/register_wr.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/rentsoft_error.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/start_registered.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/start_unregistered.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/support_form.html

$TEMP/installdataen_$HWNDPARENT/10833/wdata/support_form_ok.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/cert_activation.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/email_activation.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/frame.html

.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/games.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/ieframe_tab0.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/ieframe_tab0nofooter.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/ieframe_tab1.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/ieframe_tab2.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/ieframe_tab3.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/ieframe_tab4.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/no_connect.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_alipay.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_avangate.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_aw_online_activation.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_aw_subscription.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_aw_subscription_info.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_aw_subscription_v2.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_boacompra.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_boacompra_positivo.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_boacompra_sms.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_boleto.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_cards.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_cards_info.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_direct_debet.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_djuice.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_enter_key.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_igame.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_ipko.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_kwedit.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_lotus.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_more.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_more_info.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_mtransfer.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_novotelecom.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_paynet.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_paypal.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_rewardspay.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_safe_cart.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_seven_eleven.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_sms.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_sms_djuice.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_sms_ppc.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_sms_ptterms.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_terminal.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_trialpay.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_uol.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_vcards.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_vio.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_virgopass.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_wavepoint.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_wm.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_wmyandex.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_yandex.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/payments_yetipay.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/register.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/register_ie.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/register_wr.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/rentsoft_error.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/start_registered.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/start_unregistered.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/support_form.html

$TEMP/installdataen_$HWNDPARENT/10998/wdata/support_form_ok.html

$TEMP/installdataen_$HWNDPARENT/13233/installdata.zip

.zip

config.ini

partner.ini

$TEMP/installdataen_$HWNDPARENT/13236/installdata.zip

.zip

config.ini

partner.ini

$TEMP/installdataen_$HWNDPARENT/1660/wdata/cert_activation.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/email_activation.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/frame.html

.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/games.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/ieframe_tab0.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/ieframe_tab0nofooter.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/ieframe_tab1.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/ieframe_tab2.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/ieframe_tab3.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/ieframe_tab4.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/no_connect.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_alipay.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_avangate.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_aw_online_activation.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_aw_subscription.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_aw_subscription_info.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_aw_subscription_v2.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_boacompra.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_boacompra_positivo.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_boacompra_sms.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_boleto.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_cards.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_cards_info.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_direct_debet.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_djuice.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_enter_key.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_igame.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_ipko.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_kwedit.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_lotus.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_more.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_more_info.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_mtransfer.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_novotelecom.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_paynet.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_paypal.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_rewardspay.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_safe_cart.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_seven_eleven.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_sms.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_sms_djuice.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_sms_ppc.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_sms_ptterms.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_terminal.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_trialpay.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_uol.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_vcards.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_vio.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_virgopass.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_wavepoint.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_wm.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_wmyandex.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_yandex.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/payments_yetipay.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/register.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/register_ie.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/register_wr.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/rentsoft_error.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/start_registered.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/start_unregistered.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/support_form.html

$TEMP/installdataen_$HWNDPARENT/1660/wdata/support_form_ok.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/cert_activation.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/email_activation.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/frame.html

.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/games.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/ieframe_tab0.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/ieframe_tab0nofooter.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/ieframe_tab1.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/ieframe_tab2.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/ieframe_tab3.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/ieframe_tab4.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/no_connect.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_alipay.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_avangate.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_aw_online_activation.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_aw_subscription.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_aw_subscription_info.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_aw_subscription_v2.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_boacompra.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_boacompra_positivo.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_boacompra_sms.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_boleto.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_cards.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_cards_info.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_direct_debet.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_djuice.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_enter_key.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_igame.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_ipko.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_kwedit.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_lotus.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_more.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_more_info.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_mtransfer.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_novotelecom.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_paynet.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_paypal.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_rewardspay.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_safe_cart.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_seven_eleven.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_sms.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_sms_djuice.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_sms_ppc.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_sms_ptterms.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_terminal.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_trialpay.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_uol.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_vcards.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_vio.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_virgopass.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_wavepoint.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_wm.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_wmyandex.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_yandex.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/payments_yetipay.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/register.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/register_ie.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/register_wr.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/rentsoft_error.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/start_registered.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/start_unregistered.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/support_form.html

$TEMP/installdataen_$HWNDPARENT/17154/wdata/support_form_ok.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/cert_activation.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/email_activation.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/frame.html

.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/games.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/ieframe_tab0.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/ieframe_tab0nofooter.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/ieframe_tab1.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/ieframe_tab2.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/ieframe_tab3.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/ieframe_tab4.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/no_connect.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_alipay.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_avangate.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_aw_online_activation.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_aw_subscription.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_aw_subscription_info.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_aw_subscription_v2.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_boacompra.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_boacompra_positivo.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_boacompra_sms.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_boleto.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_cards.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_cards_info.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_direct_debet.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_djuice.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_enter_key.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_igame.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_ipko.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_kwedit.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_lotus.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_more.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_more_info.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_mtransfer.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_novotelecom.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_paynet.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_paypal.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_rewardspay.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_safe_cart.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_seven_eleven.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_sms.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_sms_djuice.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_sms_ppc.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_sms_ptterms.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_terminal.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_trialpay.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_uol.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_vcards.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_vio.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_virgopass.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_wavepoint.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_wm.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_wmyandex.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_yandex.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/payments_yetipay.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/register.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/register_ie.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/register_wr.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/rentsoft_error.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/start_registered.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/start_unregistered.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/support_form.html

$TEMP/installdataen_$HWNDPARENT/19740/wdata/support_form_ok.html

$TEMP/installdataen_$HWNDPARENT/201/installdata.zip

.zip

config.ini

icon1.ico

logo/frame.gif

.gif

logo/logo2.png

.png

sm_config.xml

.xml

url1.url

wdata/new_images/logo_all.gif

.gif

$TEMP/installdataen_$HWNDPARENT/24435/wdata/cert_activation.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/email_activation.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/frame.html

.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/games.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/ieframe_tab0.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/ieframe_tab0nofooter.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/ieframe_tab1.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/ieframe_tab2.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/ieframe_tab3.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/ieframe_tab4.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/no_connect.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_alipay.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_avangate.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_aw_online_activation.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_aw_subscription.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_aw_subscription_info.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_aw_subscription_v2.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_boacompra.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_boacompra_positivo.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_boacompra_sms.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_boleto.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_cards.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_cards_info.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_direct_debet.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_djuice.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_enter_key.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_igame.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_ipko.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_kwedit.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_lotus.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_more.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_more_info.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_mtransfer.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_novotelecom.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_paynet.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_paypal.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_rewardspay.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_safe_cart.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_seven_eleven.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_sms.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_sms_djuice.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_sms_ppc.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_sms_ptterms.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_terminal.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_trialpay.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_uol.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_vcards.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_vio.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_virgopass.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_wavepoint.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_wm.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_wmyandex.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_yandex.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/payments_yetipay.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/register.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/register_ie.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/register_wr.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/rentsoft_error.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/start_registered.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/start_unregistered.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/support_form.html

$TEMP/installdataen_$HWNDPARENT/24435/wdata/support_form_ok.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/cert_activation.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/email_activation.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/frame.html

.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/games.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/ieframe_tab0.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/ieframe_tab0nofooter.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/ieframe_tab1.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/ieframe_tab2.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/ieframe_tab3.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/ieframe_tab4.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/no_connect.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_alipay.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_avangate.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_aw_online_activation.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_aw_subscription.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_aw_subscription_info.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_aw_subscription_v2.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_boacompra.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_boacompra_positivo.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_boacompra_sms.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_boleto.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_cards.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_cards_info.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_direct_debet.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_djuice.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_enter_key.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_igame.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_ipko.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_kwedit.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_lotus.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_more.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_more_info.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_mtransfer.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_novotelecom.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_paynet.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_paypal.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_rewardspay.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_safe_cart.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_seven_eleven.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_sms.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_sms_djuice.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_sms_ppc.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_sms_ptterms.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_terminal.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_trialpay.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_uol.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_vcards.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_vio.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_virgopass.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_wavepoint.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_wm.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_wmyandex.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_yandex.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/payments_yetipay.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/register.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/register_ie.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/register_wr.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/rentsoft_error.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/start_registered.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/start_unregistered.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/support_form.html

$TEMP/installdataen_$HWNDPARENT/24436/wdata/support_form_ok.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/cert_activation.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/email_activation.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/frame.html

.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/games.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/ieframe_tab0.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/ieframe_tab0nofooter.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/ieframe_tab1.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/ieframe_tab2.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/ieframe_tab3.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/ieframe_tab4.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/no_connect.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_alipay.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_avangate.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_aw_online_activation.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_aw_subscription.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_aw_subscription_info.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_aw_subscription_v2.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_boacompra.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_boacompra_positivo.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_boacompra_sms.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_boleto.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_cards.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_cards_info.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_direct_debet.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_djuice.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_enter_key.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_igame.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_ipko.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_kwedit.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_lotus.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_more.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_more_info.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_mtransfer.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_novotelecom.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_paynet.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_paypal.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_rewardspay.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_safe_cart.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_seven_eleven.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_sms.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_sms_djuice.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_sms_ppc.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_sms_ptterms.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_terminal.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_trialpay.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_uol.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_vcards.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_vio.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_virgopass.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_wavepoint.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_wm.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_wmyandex.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_yandex.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/payments_yetipay.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/register.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/register_ie.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/register_wr.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/rentsoft_error.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/start_registered.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/start_unregistered.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/support_form.html

$TEMP/installdataen_$HWNDPARENT/25898/wdata/support_form_ok.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/cert_activation.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/email_activation.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/frame.html

.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/games.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/ieframe_tab0.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/ieframe_tab0nofooter.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/ieframe_tab1.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/ieframe_tab2.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/ieframe_tab3.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/ieframe_tab4.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/no_connect.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_alipay.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_avangate.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_aw_online_activation.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_aw_subscription.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_aw_subscription_info.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_aw_subscription_v2.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_boacompra.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_boacompra_positivo.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_boacompra_sms.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_boleto.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_cards.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_cards_info.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_direct_debet.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_djuice.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_enter_key.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_igame.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_ipko.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_kwedit.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_lotus.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_more.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_more_info.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_mtransfer.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_novotelecom.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_paynet.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_paypal.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_rewardspay.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_safe_cart.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_seven_eleven.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_sms.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_sms_djuice.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_sms_ppc.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_sms_ptterms.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_terminal.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_trialpay.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_uol.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_vcards.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_vio.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_virgopass.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_wavepoint.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_wm.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_wmyandex.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_yandex.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/payments_yetipay.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/register.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/register_ie.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/register_wr.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/rentsoft_error.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/start_registered.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/start_unregistered.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/support_form.html

$TEMP/installdataen_$HWNDPARENT/26170/wdata/support_form_ok.html

$TEMP/installdataen_$HWNDPARENT/26683/installdata.zip

.zip

config.ini

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 1.9MB

.rsrc Size: 293KB - Virtual size: 293KB

836f4951fb4175e54bfc7d7dac9c4c85

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 103KB - Virtual size: 102KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 7KB - Virtual size: 6KB

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 963B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 588B

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: - Virtual size: 48B

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 590B

97318da386948415d08cef4a9006d669

Headers

File Characteristics

Imports

kernel32

user32

gdi32

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 1.9MB

.rsrc
Size: 293KB - Virtual size: 293KB

.text
Size: 103KB - Virtual size: 102KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 7KB - Virtual size: 6KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 590B

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 108KB

.ndata
Size: - Virtual size: 48KB

.rsrc
Size: 25KB - Virtual size: 24KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 292B

.reloc
Size: 1024B - Virtual size: 714B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 1012B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 296B

.reloc
Size: 512B - Virtual size: 472B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate