tmpanfn5x1c[.]exe | Triage™

resource
tmpanfn5x1c.exe
unpack001/ADVPACK.DLL
unpack001/W95INF32.DLL
unpack001/fngrprnt.dll
unpack001/msnphoto.scr
unpack001/msvcr71.dll
unpack001/pibase.dll
unpack001/pidav.dll
unpack001/piorg.dll
unpack001/piorgres.dll
unpack001/pisync.dll
unpack001/pisynctw.exe
unpack001/piview.dll

resource
unpack001/unicows.dll

tmpanfn5x1c.exe

IMPHASH 6013d0b9fb6901d1d5e58a9ae7072103
SHA256 e5cc4a232bd7bfcc2a57174554c284527bce0e2f494f1e9190c9c4c469985eca
MD5 a00f59737d82c8df1c974b50e80e03f8
SHA1 470a71a8d4645e9aa96b36f5b99a609f90faf142
SHA512 de9ae03b9a20bf262cfe34af0f759ada873eb004a51a9f6d8ae88e325a9a34e4530b68daa699e255f05bb379fdedad6506c4edb6aa264219b3293b96b0163bc7
SSDEEP 24576:+VYbWzOqXT4XFrhe1v/xRZJQnxBrabsM8KGH7Co0OLeGrIocE5lArjPPW:XWzORX1he1HxRqr08KGbNLeGMb4unW
TLSH
T12DB57C10A3DAF491F67E1F3498B157520E757D268A32C57ABAEC398DF83C2137924722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

90473

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

psapi

GetModuleBaseNameA GetModuleFileNameExA EnumProcessModules EnumProcesses

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

kernel32

GetTempFileNameA CreateFileA lstrcpyA InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetVolumeInformationA GetDriveTypeA lstrcpynA WaitForSingleObject CreateMutexA Thread32Next SuspendThread ResumeThread OpenThread Thread32First CreateToolhelp32Snapshot OpenProcess TerminateProcess CreateDirectoryA GetTempPathA DeleteFileA FreeResource UpdateResourceA LockResource LoadResource SizeofResource FindResourceExA EnumResourceLanguagesA EnumResourceNamesA SetFileTime GetFileTime FreeLibrary FindResourceA LoadLibraryExA GetCurrentProcess SetEvent OpenEventA Process32Next Process32First FindClose FindNextFileA FindFirstFileA EndUpdateResourceA EnumResourceTypesA BeginUpdateResourceA GetTickCount CopyFileA ReleaseMutex lstrlenA lstrcatA WriteFile GetModuleFileNameA CreateProcessA CloseHandle Sleep GetLastError HeapSize GetLocaleInfoA GetUserDefaultLCID CreateThread FlushFileBuffers SetStdHandle GetConsoleMode WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount GetLocaleInfoW LoadLibraryA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetFullPathNameA GetCurrentThread WideCharToMultiByte GetModuleHandleA GetVersionExA lstrcmpA SetFilePointer GetSystemTimeAsFileTime GetLocalTime GetCurrentThreadId GetCurrentProcessId HeapAlloc HeapFree GetProcessHeap InterlockedIncrement InterlockedDecrement UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind GetCommandLineA GetStartupInfoA MultiByteToWideChar LCMapStringA LCMapStringW GetCPInfo GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetACP GetOEMCP IsValidCodePage GetStdHandle ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter VirtualAlloc HeapReAlloc ReadFile GetConsoleCP

user32

wsprintfA wvsprintfA

advapi32

RegQueryValueExA RegCreateKeyA RegEnumKeyExA FreeSid AllocateAndInitializeSid EqualSid RegEnumValueA RegOpenKeyExA RegSetValueExA RegCloseKey OpenProcessToken OpenThreadToken GetTokenInformation

shell32

ShellExecuteA SHGetSpecialFolderPathA

shlwapi

SHRegCreateUSKeyA SHRegCloseUSKey

wininet

InternetCloseHandle HttpOpenRequestA InternetOpenA InternetConnectA InternetQueryOptionA HttpQueryInfoA InternetOpenUrlA InternetSetFilePointer HttpSendRequestA InternetReadFile

ws2_32

WSAStartup gethostbyname

ADVPACK.DLL

IMPHASH c654a5cf569ffb2b7d4ea4076125d5c7
SHA256 06eed244d89f6e15205d5beb8085ac33c0de486dfe30eec9fb73b91de07e5f62
MD5 0ac28de5e930e8a52ad6b163c5473412
SHA1 25371c9d876959cb58b50c25ad709cf98dde45bb
SHA512 c2c82449927cac953668142a3f597c06626b0b3a26e8036de34e4ca1042a572fa3befa799d43fb24a1d23c821b5ed7994e3d211b6aaced15ba31d4639e96d877
SSDEEP 1536:Yoyomo1DLSaGi2aoIwPlL53Qtc1qpRBvgQbiSrvxekZCg0BUwTS9wpKSnZ0jJScy:z9J0I43QtcSRNgQnLx9ZCjGw8mZ0jJST
TLSH
T1EB9329137BE0407AE5FA66306975677893FA6F353835E24DCB405A4A2D70AD7EA38303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

19123

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

ntdll

RtlUnwind

user32

DestroyWindow GetWindowRect CharToOemA DispatchMessageA OemToCharA CharUpperA MsgWaitForMultipleObjects UpdateWindow CreateDialogParamA ShowWindow GetSystemMetrics PeekMessageA GetDC ReleaseDC SetWindowPos SendMessageA SetDlgItemTextA GetDlgItemTextA GetDesktopWindow SetWindowTextA SendDlgItemMessageA GetDlgItem EnableWindow EndDialog DialogBoxParamA MessageBeep MessageBoxA wsprintfA CharPrevA ExitWindowsEx IsWindow LoadStringA CharNextA

gdi32

GetStockObject GetObjectA CreateFontIndirectA GetDeviceCaps DeleteObject

kernel32

SearchPathA GetVolumeInformationA GetCurrentProcess GetDiskFreeSpaceA EnumResourceLanguagesA SetFileTime MulDiv ReadFile WritePrivateProfileSectionA GetFileTime GetLocalTime GetSystemInfo GetProfileStringA GetProcAddress GetLastError lstrcpyA lstrlenA GetDriveTypeA lstrcpynA GetEnvironmentVariableA CloseHandle WriteFile CreateFileA WritePrivateProfileStringA LockResource LoadResource SizeofResource FindResourceA GetTempFileNameA GetWindowsDirectoryA GetTempPathA SetFilePointer LocalFree LocalAlloc lstrcatA GetModuleFileNameA IsBadReadPtr DeleteFileA LocalReAlloc GetFileAttributesA GetFullPathNameA lstrcmpiA FormatMessageA GetPrivateProfileIntA GetFileSize FindNextFileA lstrcmpA GetPrivateProfileStringA FreeLibrary GetVersionExA LoadLibraryA IsDBCSLeadByte GetShortPathNameA ExpandEnvironmentStringsA GetSystemDirectoryA MultiByteToWideChar LoadLibraryExA _lclose _llseek _lopen FindClose FindFirstFileA OpenFile SetFileAttributesA CreateDirectoryA CreateProcessA GetPrivateProfileSectionA CopyFileA UnmapViewOfFile SetLastError MapViewOfFileEx CreateFileMappingA MoveFileExA MoveFileA RemoveDirectoryA

advapi32

RegSetValueA RegEnumKeyA RegDeleteKeyA GetTokenInformation EqualSid AllocateAndInitializeSid FreeSid RegUnLoadKeyA RegLoadKeyA RegSaveKeyA RegFlushKey RegDeleteValueA RegQueryInfoKeyA RegCreateKeyExA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegSetValueExA RegQueryValueExA RegCloseKey

ole32

CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

PI.txt

SHA256 c0a317f60910eed08bbfc7b3ac6e6de1b2029bf4922d0b0d7d3759313a24b16c
MD5 dadafe066983ab646e8550013fb7da13
SHA1 4ec54d6c550e64a7837989cc437bc57803966b50
SHA512 44a4488492db1da61e8146f25a12c66ced0d1eaaa5d53d7ccf00bfcf3572e4b6606caf38fc561e961e7c37a25936ddb36a8ca1be74adbfca6df1327e9aecfa2e
MD5 SHA1 SHA512

W95INF16.DLL

SHA256 337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af
MD5 7210d5407a2d2f52e851604666403024
SHA1 242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9
SHA512 1755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68
TLSH
T12041A3630638E8C6C01C03328A57CBC631B4D310538F4F0B0A69A57B3A92BCD877912A
MD5 SHA1 SHA512 TLSH

W95INF32.DLL

IMPHASH 5f75d18fe563266a560ac1f72bd4cae2
SHA256 f5ce611c27d97b64730c7ff737eb5c669d6896455c5c915215b1d958a9a3260f
MD5 1d432dd6fdcdef26181b74099b364d87
SHA1 b7ca40fcae22368c54b599351a23a8e26989efdc
SHA512 c49383388179638f9bc5ffc94918376b2fd3d42e8f226352181544af7c05ef16fd85dbff284aa38d8040f678dc45afd38388b33328330def5b30c35d75a7d43b
SSDEEP 48:6V3Ms+BNU4M5hyaZbb4an1WbvgFfSBZW3IezfXNFk5WgF:nwyaxMaYv+aPWJXNyWg
TLSH
T1D091CF0367E42A76F0EB4F3005571B2AA23BB970D7758ADB0E94012A2C3A5D56A70B66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

512B

Virtual Size

400B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

247B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

173B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

320B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

908B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

active~1.htm

SHA256 ce0ebcd75f77ef71b4b3cdd5b5b30c4bc218053980e48f72fa03e793087ba695
MD5 eb567b646af843f620897b6d6052213c
SHA1 12c2624caaa138a394f3c4699936384abee86765
SHA512 430ab18720bfbfeac9d58aa72ddb738395ed0a942f1d48617c607d19762640276d0f7e632e5cc947630883b136f30d58bcde4255412a0c7a818b15abc85db920
TLSH
T11011000475E3EA6C429190F4883D95A4CC7E96007352D572B8F8F6537158F24B1719F9
MD5 SHA1 SHA512 TLSH

polyglot

config.xml

SHA256 d5d35ccf45b39d60f0b24a11bbb74c9106491daf1f78282d77996deccbc85e1a
MD5 3713b5a27a4f3ba2f92909cb06860b59
SHA1 c4fa51fd0e0695399bbe0cf8a7572f5603657982
SHA512 4237a3dbd7c2c5edb3f216f3c54fc18b41a588a2f6a8f3a7bf2ad985981ce16ef5abce83702e272a24a9fe8f0eab7e6c5ab20c2f5e59a11f28c0cb41cc17496d
TLSH
T1E9F059087840F677035800AB7BBBC0190A4F6C57237386092083B43716D93ECADA6477
MD5 SHA1 SHA512 TLSH

data.xml

SHA256 cde78665284b4805b4df790ea7b52397cb9c5edb49e6082f2e24c3b1f0293d5d
MD5 06b00ba6c22ffb816174aef7ce85b15a
SHA1 b550295cc386901b91977d9d578d07c2fa2f7455
SHA512 66d0ebb2cf471f120c30dc6474c3699c38482790528355eb520edec3e4ad348906db99cc05558b15814af74abe2126c5e0f001bd350ab3f4a571e2565f6211a0
TLSH
T18BD01200D444D4574F060B894677C2A916753832A7621313F44179777E9D4C53B6E7A7
MD5 SHA1 SHA512 TLSH

fngrprnt.dll

IMPHASH 95d5d555032868a55dfb71899f3429a4
SHA256 c28feffe76ba4ae036779bf2c04d5e0a8a6a9e5db6cf60d7de861be982f96145
MD5 470123d0d53d2a260719025893400928
SHA1 748b42dff8d8d789ee314758d17abaeace364244
SHA512 80502190a71566f9093284538a1c4d1a9ac24f4bd09746e9041b1b448c44c97d672705edc188516d21374bbd7bea55ab5a19ac134959aa3a0065e9d58b06676f
SSDEEP 96:log3VxVW+PXEOwngwGpMcm2GdE9OerQE9iJwIWUlZG0FkWErBWB:lt3V98Owgw9e9vrQE9iJwRFWE1WB
TLSH
T1DE02E947EB6875B6F0E3437108032B5D72BE78305F395B69C628974C267A5A2DAB4B03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

5431

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\photos-v9\target\retail\i386\FngrPrnt.pdb

mega.gif

SHA256 996b90cc452995b5f72108dd1925c9883552c6d6de00d79f43f2fc3268a3b017
MD5 1f0214c1b824e220659ab47daad70a01
SHA1 d8bee9601beecb95d10b695f9c74870c7efe15ec
SHA512 f36fb95e83cac126a9527c6394fe03cb65efeb8a9232ddfad64d3af13b753f45d8571849c42f0e446f8fa22aad3218b9fe51dad7b3602356f2befa1752d30e8f
SSDEEP 384:DrAi7UWczJldh5Jfkvyy7apF8+Aodmp1QySM0WnGLmiWCC+:DrdUWczJln5Jf5OaP8+AoQXQnRWGLe+
TLSH
T1CD52C13F8C1089BD020EDF5E3963D7A85702E963DD457518E26AA3F04D8319D3128EEE
MD5 SHA1 SHA512 SSDEEP TLSH

messen~1.xml

SHA256 583bf347c2665ba1a80a6189d59606eeac2e09fe54b6428357059011839aeeca
MD5 e5ee60c6913bc24f8003a2a266bd1b8c
SHA1 add44935a19613b43bd729d7c694d8381794a0e3
SHA512 eeee04d280c68bccb30d50795b5ef5c036ce6d323de84750621c12d151109eb95d6a385076f3de8c58a232449d192e499cc29c57e302acf2224dff1d9e7ab93d
TLSH
T13AD02E10A000D8074B0207840A73C25E2636383B6A622213F482B8B72A8A0CA3FAE263
MD5 SHA1 SHA512 TLSH

msnphoto.scr

IMPHASH 27c0cb43ce1328947820bbb6d57a276f
SHA256 acf4cfa275cc7edec34ae2e85ee47d6df85ffbdd9f7da1aecc30064235fd6d00
MD5 ed04ed8dadb0743d75056e2ea55184ee
SHA1 9e1ad3c857f22453197fd9daec6c03592cdb9d8e
SHA512 45441346d64630dab07d46cc0b836071647f34462f78cbaa7defe40af631d1f3abf0d9bbb7d6799f27de3beae06b9a2d08464035900a78f2a70c5552023bdee2
SSDEEP 768:MKlYg78o8f4NCqz/JL9pMBh6vQz29LJOtJNAWO9laBqMPphjlyziBBZU9QZU9F:Jnb8fw1znpMBT29LJOlPflygzi
TLSH
T11293D51262008474F35D0B714A15FAD04AAA9D3C19E4F24FF67CBD7AA9322D75A3724F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

12393

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\photos-v9\target\retail\i386\msnphoto.pdb

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

kernel32

TerminateProcess GetCurrentProcess WriteFile GetStdHandle GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsAlloc SetLastError GetCurrentThreadId TlsFree TlsSetValue TlsGetValue HeapDestroy HeapCreate VirtualFree HeapFree LeaveCriticalSection EnterCriticalSection LoadLibraryA GetACP GetModuleHandleA ExitProcess HeapAlloc InitializeCriticalSection VirtualAlloc HeapReAlloc RtlUnwind InterlockedExchange VirtualQuery HeapSize QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA VirtualProtect GetSystemInfo GetCommandLineA GetStartupInfoA FreeLibrary LoadLibraryExA lstrcpynA GetCPInfo GetProcAddress GetVersionExA GetOEMCP GetSystemPowerStatus Sleep

gdi32

SetBkColor SelectObject GetStockObject GetClipBox SetTextColor

user32

EnumDisplaySettingsA LoadStringA MessageBoxA EndDialog GetClientRect MapWindowPoints SetTimer KillTimer BeginPaint FillRect InflateRect DrawTextExA EndPaint PostQuitMessage GetSystemMetrics CharNextA GetCursorPos SetCursor DefWindowProcA PostMessageA IsWindow GetParent DialogBoxParamA SendMessageA PeekMessageA GetForegroundWindow DispatchMessageA TranslateMessage GetMessageA CreateWindowExA RegisterClassA RegisterWindowMessageA SetForegroundWindow FindWindowA ReleaseDC GetDC LoadIconA SystemParametersInfoA

ole32

CoInitialize CoUninitialize

comctl32

InitCommonControlsEx

msvcr71.dll

IMPHASH 7acc8c379c768a1ecd81ec502ff5f33e
SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
MD5 86f1895ae8c5e8b17d99ece768a70732
SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
TLSH
T10374C012B1A3CCB3D0B6007449596B599BBFE43046798A73BFE80E4E4F746D1D726A23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr71.pdb

kernel32

GetModuleFileNameA GetModuleFileNameW ExitProcess GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess WriteFile GetStdHandle GetCurrentThreadId GetCommandLineA GetVersionExA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ExitThread CloseHandle GetLastError ResumeThread CreateThread TlsAlloc SetLastError GetCurrentThread TlsFree TlsSetValue TlsGetValue FindNextFileA FindFirstFileA FindClose FindNextFileW FindFirstFileW HeapAlloc HeapFree GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr SetHandleCount GetFileType GetStartupInfoA GetACP GetOEMCP GetCPInfo LoadLibraryA MultiByteToWideChar GetCommandLineW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW InitializeCriticalSection RtlUnwind UnhandledExceptionFilter LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetConsoleCtrlHandler InterlockedExchange VirtualQuery QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetEnvironmentVariableA SetEnvironmentVariableW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage GetLocaleInfoW GetTimeFormatA GetDateFormatA GetTimeZoneInformation HeapSize VirtualProtect GetSystemInfo FlushFileBuffers SetFilePointer SetStdHandle CompareStringA CompareStringW Sleep Beep FileTimeToSystemTime FileTimeToLocalFileTime GetDiskFreeSpaceA GetLogicalDrives SetErrorMode GetFileAttributesA GetCurrentDirectoryA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetDriveTypeA CreateDirectoryA RemoveDirectoryA DeleteFileA GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW SetFileAttributesW GetFullPathNameW CreateDirectoryW DeleteFileW MoveFileW RemoveDirectoryW GetDriveTypeW MoveFileA RaiseException IsBadReadPtr SetUnhandledExceptionFilter IsBadCodePtr GetExitCodeProcess WaitForSingleObject FreeLibrary CreateProcessA CreateProcessW HeapValidate HeapCompact HeapWalk ReadConsoleA SetConsoleMode GetConsoleMode IsDBCSLeadByteEx GetConsoleCP ReadConsoleW SetEndOfFile WriteConsoleA GetConsoleOutputCP WriteConsoleW DuplicateHandle GetFileInformationByHandle PeekNamedPipe ReadConsoleInputA PeekConsoleInputA GetNumberOfConsoleInputEvents ReadConsoleInputW LockFile UnlockFile CreateFileA CreatePipe ReadFile CreateFileW SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetLocalTime SetLocalTime

$I10_OUTPUT ??0__non_rtti_object@@QAE@ABV0@@Z ??0__non_rtti_object@@QAE@PBD@Z ??0bad_cast@@AAE@PBQBD@Z ??0bad_cast@@QAE@ABQBD@Z ??0bad_cast@@QAE@ABV0@@Z ??0bad_cast@@QAE@PBD@Z ??0bad_typeid@@QAE@ABV0@@Z ??0bad_typeid@@QAE@PBD@Z ??0exception@@QAE@ABQBD@Z ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@XZ ??1__non_rtti_object@@UAE@XZ ??1bad_cast@@UAE@XZ ??1bad_typeid@@UAE@XZ ??1exception@@UAE@XZ ??1type_info@@UAE@XZ ??2@YAPAXI@Z ??3@YAXPAX@Z ??4__non_rtti_object@@QAEAAV0@ABV0@@Z ??4bad_cast@@QAEAAV0@ABV0@@Z ??4bad_typeid@@QAEAAV0@ABV0@@Z ??4exception@@QAEAAV0@ABV0@@Z ??8type_info@@QBEHABV0@@Z ??9type_info@@QBEHABV0@@Z ??_7__non_rtti_object@@6B@ ??_7bad_cast@@6B@ ??_7bad_typeid@@6B@ ??_7exception@@6B@ ??_Fbad_cast@@QAEXXZ ??_Fbad_typeid@@QAEXXZ ??_U@YAPAXI@Z ??_V@YAXPAX@Z ?_query_new_handler@@YAP6AHI@ZXZ ?_query_new_mode@@YAHXZ ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z ?_set_new_mode@@YAHH@Z ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z ?before@type_info@@QBEHABV1@@Z ?name@type_info@@QBEPBDXZ ?raw_name@type_info@@QBEPBDXZ ?set_new_handler@@YAP6AXXZP6AXXZ@Z ?set_terminate@@YAP6AXXZP6AXXZ@Z ?set_unexpected@@YAP6AXXZP6AXXZ@Z ?swprintf@@YAHPAGIPBGZZ ?swprintf@@YAHPA_WIPB_WZZ ?terminate@@YAXXZ ?unexpected@@YAXXZ ?vswprintf@@YAHPAGIPBGPAD@Z ?vswprintf@@YAHPA_WIPB_WPAD@Z ?what@exception@@UBEPBDXZ _CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh _CIexp _CIfmod _CIlog _CIlog10 _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _CRT_RTC_INIT _CxxThrowException _EH_prolog _Getdays _Getmonths _Gettnames _HUGE _Strftime _XcptFilter __CppXcptFilter __CxxCallUnwindDtor __CxxCallUnwindVecDtor __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __RTCastToVoid __RTDynamicCast __RTtypeid __STRINGTOLD ___lc_codepage_func ___lc_collate_cp_func ___lc_handle_func ___mb_cur_max_func ___setlc_active_func ___unguarded_readlc_active_add_func __argc __argv __badioinfo __buffer_overrun __crtCompareStringA __crtCompareStringW __crtGetLocaleInfoW __crtGetStringTypeW __crtLCMapStringA __crtLCMapStringW __dllonexit __doserrno __fpecode __getmainargs __initenv __iob_func __isascii __iscsym __iscsymf __lc_clike __lc_codepage __lc_collate_cp __lc_handle __lconv_init __mb_cur_max __p___argc __p___argv __p___initenv __p___mb_cur_max __p___wargv __p___winitenv __p__acmdln __p__amblksiz __p__commode __p__daylight __p__dstbias __p__environ __p__fileinfo __p__fmode __p__iob __p__mbcasemap __p__mbctype __p__osver __p__pctype __p__pgmptr __p__pwctype __p__timezone __p__tzname __p__wcmdln __p__wenviron __p__winmajor __p__winminor __p__winver __p__wpgmptr __pctype_func __pioinfo __pwctype_func __pxcptinfoptrs __security_error_handler __set_app_type __set_buffer_overrun_handler __setlc_active __setusermatherr __threadhandle __threadid __toascii __unDName __unDNameEx __uncaught_exception __unguarded_readlc_active __wargv __wcserror __wgetmainargs __winitenv _abnormal_termination _access _acmdln _adj_fdiv_m16i _adj_fdiv_m32 _adj_fdiv_m32i _adj_fdiv_m64 _adj_fdiv_r _adj_fdivr_m16i _adj_fdivr_m32 _adj_fdivr_m32i _adj_fdivr_m64 _adj_fpatan _adj_fprem _adj_fprem1 _adj_fptan _adjust_fdiv _aexit_rtn _aligned_free _aligned_malloc _aligned_offset_malloc _aligned_offset_realloc _aligned_realloc _amsg_exit _assert _atodbl _atoi64 _atoldbl _beep _beginthread _beginthreadex _c_exit _cabs _callnewh _cexit _cgets _cgetws _chdir _chdrive _chgsign _chkesp _chmod _chsize _clearfp _close _commit _commode _control87 _controlfp _copysign _cprintf _cputs _cputws _creat _cscanf _ctime64 _cwait _cwprintf _cwscanf _daylight _dstbias _dup _dup2 _ecvt _endthread _endthreadex _environ _eof _errno _except_handler2 _except_handler3 _execl _execle _execlp _execlpe _execv _execve _execvp _execvpe _exit _expand _fcloseall _fcvt _fdopen _fgetchar _fgetwchar _filbuf _fileinfo _filelength _filelengthi64 _fileno _findclose _findfirst _findfirst64 _findfirsti64 _findnext _findnext64 _findnexti64 _finite _flsbuf _flushall _fmode _fpclass _fpieee_flt _fpreset _fputchar _fputwchar _fsopen _fstat _fstat64 _fstati64 _ftime _ftime64 _ftol _fullpath _futime _futime64 _gcvt _get_heap_handle _get_osfhandle _get_sbh_threshold _getch _getche _getcwd _getdcwd _getdiskfree _getdllprocaddr _getdrive _getdrives _getmaxstdio _getmbcp _getpid _getsystime _getw _getwch _getwche _getws _global_unwind2 _gmtime64 _heapadd _heapchk _heapmin _heapset _heapused _heapwalk _hypot _i64toa _i64tow _initterm _inp _inpd _inpw _iob _isatty _isctype _ismbbalnum _ismbbalpha _ismbbgraph _ismbbkalnum _ismbbkana _ismbbkprint _ismbbkpunct _ismbblead _ismbbprint _ismbbpunct _ismbbtrail _ismbcalnum _ismbcalpha _ismbcdigit _ismbcgraph _ismbchira _ismbckata _ismbcl0 _ismbcl1 _ismbcl2 _ismbclegal _ismbclower _ismbcprint _ismbcpunct _ismbcspace _ismbcsymbol _ismbcupper _ismbslead _ismbstrail _isnan _itoa _itow _j0 _j1 _jn _kbhit _lfind _loaddll _local_unwind2 _localtime64 _lock _locking _logb _longjmpex _lrotl _lrotr _lsearch _lseek _lseeki64 _ltoa _ltow _makepath _mbbtombc _mbbtype _mbcasemap _mbccpy _mbcjistojms _mbcjmstojis _mbclen _mbctohira _mbctokata _mbctolower _mbctombb _mbctoupper _mbctype _mbsbtype _mbscat _mbschr _mbscmp _mbscoll _mbscpy _mbscspn _mbsdec _mbsdup _mbsicmp _mbsicoll _mbsinc _mbslen _mbslwr _mbsnbcat _mbsnbcmp _mbsnbcnt _mbsnbcoll _mbsnbcpy _mbsnbicmp _mbsnbicoll _mbsnbset _mbsncat _mbsnccnt _mbsncmp _mbsncoll _mbsncpy _mbsnextc _mbsnicmp _mbsnicoll _mbsninc _mbsnset _mbspbrk _mbsrchr _mbsrev _mbsset _mbsspn _mbsspnp _mbsstr _mbstok _mbstrlen _mbsupr _memccpy _memicmp _mkdir _mktemp _mktime64 _msize _nextafter _onexit _open _open_osfhandle _osplatform _osver _outp _outpd _outpw _pclose _pctype _pgmptr _pipe _popen _purecall _putch _putenv _putw _putwch _putws _pwctype _read _resetstkoflw _rmdir _rmtmp _rotl _rotr _safe_fdiv _safe_fdivr _safe_fprem _safe_fprem1 _scalb _scprintf _scwprintf _searchenv _seh_longjmp_unwind _set_SSE2_enable _set_error_mode _set_purecall_handler _set_sbh_threshold _set_security_error_handler _seterrormode _setjmp _setjmp3 _setmaxstdio _setmbcp _setmode _setsystime _sleep _snprintf _snscanf _snwprintf _snwscanf _sopen _spawnl _spawnle _spawnlp _spawnlpe _spawnv _spawnve _spawnvp _spawnvpe _splitpath _stat _stat64 _stati64 _statusfp _strcmpi _strdate _strdup _strerror _stricmp _stricoll _strlwr _strncoll _strnicmp _strnicoll _strnset _strrev _strset _strtime _strtoi64 _strtoui64 _strupr _swab _sys_errlist _sys_nerr _tell _telli64 _tempnam _time64 _timezone _tolower _toupper _tzname _tzset _ui64toa _ui64tow _ultoa _ultow _umask _ungetch _ungetwch _unlink _unloaddll _unlock _utime _utime64 _vscprintf _vscwprintf _vsnprintf _vsnwprintf _waccess _wasctime _wchdir _wchmod _wcmdln _wcreat _wcsdup _wcserror _wcsicmp _wcsicoll _wcslwr _wcsncoll _wcsnicmp _wcsnicoll _wcsnset _wcsrev _wcsset _wcstoi64 _wcstoui64 _wcsupr _wctime _wctime64 _wctype _wenviron _wexecl _wexecle _wexeclp _wexeclpe _wexecv _wexecve _wexecvp _wexecvpe _wfdopen _wfindfirst _wfindfirst64 _wfindfirsti64 _wfindnext _wfindnext64 _wfindnexti64 _wfopen _wfreopen _wfsopen _wfullpath _wgetcwd _wgetdcwd _wgetenv _winmajor _winminor _winver _wmakepath _wmkdir _wmktemp _wopen _wperror _wpgmptr _wpopen _wputenv _wremove _wrename _write _wrmdir _wsearchenv _wsetlocale _wsopen _wspawnl _wspawnle _wspawnlp _wspawnlpe _wspawnv _wspawnve _wspawnvp _wspawnvpe _wsplitpath _wstat _wstat64 _wstati64 _wstrdate _wstrtime _wsystem _wtempnam _wtmpnam _wtof _wtoi _wtoi64 _wtol _wunlink _wutime _wutime64 _y0 _y1 _yn abort abs acos asctime asin atan atan2 atexit atof atoi atol bsearch calloc ceil clearerr clock cos cosh ctime difftime div exit exp fabs fclose feof ferror fflush fgetc fgetpos fgets fgetwc fgetws floor fmod fopen fprintf fputc fputs fputwc fputws fread free freopen frexp fscanf fseek fsetpos ftell fwprintf fwrite fwscanf getc getchar getenv gets getwc getwchar gmtime is_wctype isalnum isalpha iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswcntrl iswctype iswdigit iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit labs ldexp ldiv localeconv localtime log log10 longjmp malloc mblen mbstowcs mbtowc memchr memcmp memcpy memmove memset mktime modf perror pow printf putc putchar puts putwc putwchar qsort raise rand realloc remove rename rewind scanf setbuf setlocale setvbuf signal sin sinh sprintf sqrt srand sscanf strcat strchr strcmp strcoll strcpy strcspn strerror strftime strlen strncat strncmp strncpy strpbrk strrchr strspn strstr strtod strtok strtol strtoul strxfrm swprintf swscanf system tan tanh time tmpfile tmpnam tolower toupper towlower towupper ungetc ungetwc vfprintf vfwprintf vprintf vsprintf vswprintf vwprintf wcscat wcschr wcscmp wcscoll wcscpy wcscspn wcsftime wcslen wcsncat wcsncmp wcsncpy wcspbrk wcsrchr wcsspn wcsstr wcstod wcstok wcstol wcstombs wcstoul wcsxfrm wctomb wprintf wscanf

pi.inf

SHA256 5083d6c30a3f6310585044f8508de439d984935887edabd315c5976b03015e99
MD5 50cd60b8d92cc119d29fd3402379c54f
SHA1 fcef127b6710192322d81fec135266ae1510cf48
SHA512 c14113ebad396bd8771970cbd635367919dbc358b8be0cbfb1df66e4c620fae3ce7f866e0c4c719b441ee0e446868e19347281e8cbf7f02b6e118a901b9e815d
SSDEEP 96:A8t18kKQiQLQ/n2J9pi/n2J99S5phehbuOXuB2odmRwFM2e1QQztXtlM:Aw1ZKQiQLi5aSGTuB2odmRwFM2e1BdS
TLSH
T160B1DE98411391F57EE93FA0C423C9C7BB159A921042B646A9EDD0A13A3E64D30FA1FF
MD5 SHA1 SHA512 SSDEEP TLSH

pibase.dll

IMPHASH 43d41b64a35570823063ac5e40244bd9
SHA256 8e8cb8ac1f26a3dd31ef22aeb50f89336944be16be61b0fd01b6b04438dc8ede
MD5 98bd7d3d8acc06b4c0c7390889ef0656
SHA1 d02b2657185307698b67cfb22eb8c1bb28856964
SHA512 d2c618007783b3c4c30b692ae4e17c32c6098f2b83d7912f97e8c92f21be9ffd8802f74b3caf4fdc9aac606f0c42f860ef9c2dee766d8ccbb91a551944c1c2b7
SSDEEP 768:3bEmmT0ZuoPTKaiiB+cMXm6dGqrIkxzf+ssgKzbWnDHCwzv5MrdRU0:3b9mT0ZuoPOau/Xm6gkx7+sVKzAHCwzG
TLSH
T150235B0173C80D72E4E38631481296AEA2FFFAA10D39470B7398164E2DB16ADF57775B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

27014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\photos-v9\target\retail\i386\pibase.pdb

msvcr71

?terminate@@YAXXZ ??1type_info@@UAE@XZ free _onexit __dllonexit _except_handler3 __CppXcptFilter _adjust_fdiv _initterm _msize wcscmp malloc swprintf vsprintf _vscprintf isspace __CxxFrameHandler wcscpy wcsftime _localtime64 _time64 vswprintf _vscwprintf wcsstr wcslen realloc memmove __security_error_handler ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z _stricmp memset iswspace _CxxThrowException

kernel32

GetVersionExA HeapDestroy HeapReAlloc HeapSize LocalAlloc ExitProcess GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetSystemDirectoryA GetWindowsDirectoryA CompareStringA LoadLibraryA GetModuleFileNameA GetModuleHandleA FreeLibrary SetLastError GetProcessHeap OutputDebugStringA TerminateProcess WinExec GlobalUnlock GlobalLock GetCurrentProcess GetLocaleInfoA InitializeCriticalSection GetACP RaiseException InterlockedExchange GetLastError GetThreadLocale DeleteCriticalSection InterlockedIncrement InterlockedDecrement QueryPerformanceCounter QueryPerformanceFrequency GetSystemInfo SizeofResource LockResource LoadResource HeapAlloc HeapFree LocalFree GlobalAlloc GlobalFree EnterCriticalSection LeaveCriticalSection CloseHandle FlushFileBuffers WriteFile FlushInstructionCache MulDiv GetCurrentThreadId

user32

EndDialog GetWindowRect GetClientRect MapWindowPoints CharNextExA SetWindowPos DestroyWindow GetActiveWindow CloseClipboard SetClipboardData EmptyClipboard IsWindow OpenClipboard GetDlgItem RedrawWindow ShowWindow InvalidateRect

advapi32

RegCloseKey

ole32

CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoGetMalloc

??0DisableProgressSteps@Base@@QAE@XZ ??0EnableProgressSteps@Base@@QAE@XZ ??0Exception@Base@@QAE@ABV01@@Z ??0Exception@Base@@QAE@J@Z ??0Exception@Base@@QAE@XZ ??0NoStructuredExceptionAssert@Base@@QAE@XZ ??1DisableProgressSteps@Base@@QAE@XZ ??1EnableProgressSteps@Base@@QAE@XZ ??1Exception@Base@@QAE@XZ ??1NoStructuredExceptionAssert@Base@@QAE@XZ ??1ProgressSteps@Base@@UAE@XZ ??4CPU@Base@@QAEAAV01@ABV01@@Z ??4Debug@Base@@QAEAAV01@ABV01@@Z ??4Exception@Base@@QAEAAV01@ABV01@@Z ??4Log@Base@@QAEAAV01@ABV01@@Z ??4NoStructuredExceptionAssert@Base@@QAEAAV01@ABV01@@Z ??4OS@Base@@QAEAAV01@ABV01@@Z ??4UI@Base@@QAEAAV01@ABV01@@Z ??BException@Base@@QBEJXZ ??_7Exception@Base@@6B@ ?Abort@ProgressSteps@Base@@QAEHXZ ?AtlThrow@ATL@@YAXJ@Z ?CloseLogFile@Debug@Base@@SAXXZ ?Delete@BasePrivate@@YAXPAX@Z ?DoesProcessorMeetRequirements@CPU@Base@@SA_NABTCPUCaps@2@K@Z ?GdiplusStatusToHresult@Base@@YAJH@Z ?GetAssertCallback@Base@@YAAAP6A_NPBDH0@ZXZ ?GetBaseStringComManager@StringCom@Base@@SAAAVCAtlStringMgr@ATL@@XZ ?GetBaseStringManager@String@Base@@SAAAVCAtlStringMgr@ATL@@XZ ?GetDllVersion@OS@Base@@SAKPB_W@Z ?GetLogFile@Debug@Base@@SAPB_WXZ ?GetOSDescription@OS@Base@@SAXAAVString@2@@Z ?GetPercentComplete@ProgressSteps@Base@@QAEJPAK@Z ?GetProcessorCaps@CPU@Base@@SAXAATCPUCaps@2@@Z ?GetProcessorCount@CPU@Base@@SAHXZ ?GetProcessorManufacturer@CPU@Base@@SAXAAVString@2@@Z ?GetProcessorName@CPU@Base@@SAXAAVString@2@@Z ?GetProcessorSpeedEstimate@CPU@Base@@SAKXZ ?GetShowLogFile@Debug@Base@@SA_NXZ ?GetTop@ProgressSteps@Base@@SAPAV12@XZ ?Increment@ProgressSteps@Base@@QAEJK@Z ?Init@Exception@Base@@AAEXJ@Z ?Init@ProgressSteps@Base@@QAEJKPAURenderAbort@2@@Z ?Initialize@Base@@YGXXZ ?IsEnabled@ProgressSteps@Base@@QAEHXZ ?IsOpen@Log@Base@@SA_NXZ ?IsThemeActive@UI@Base@@SA_NXZ ?IsThemingSupported@UI@Base@@SA_NXZ ?IsWin32@OS@Base@@SA_NXZ ?IsWinNT@OS@Base@@SA_NXZ ?LoadUnicowsProc@BasePrivate@@YAPAUHINSTANCE__@@PBD@Z ?LogFileIsOpen@Debug@Base@@SA_NXZ ?LogOutputA@Debug@Base@@SAXPBD@Z ?LogOutputW@Debug@Base@@SAXPB_W@Z ?New@BasePrivate@@YAPAXI_N@Z ?NoAssert@NoStructuredExceptionAssert@Base@@SA_NXZ ?OnThreadEvent@ProgressSteps@Base@@QAEXXZ ?OutputDebugInfo@Exception@Base@@UBEXXZ ?ReportError@BasePrivate@@YA_NPBDHPB_W0PAD0JH0@Z ?Reset@ProgressSteps@Base@@QAEJKK@Z ?SetLogFile@Debug@Base@@SAXPB_W_N@Z ?SetShowLogFile@Debug@Base@@SAX_N@Z ?Show@Log@Base@@SAXXZ ?ShowLogFile@Debug@Base@@SAXXZ ?StackTrace@Exception@Base@@QBEPB_WXZ ?StructuredExceptionHandler@BasePrivate@@YGJPAU_EXCEPTION_POINTERS@@@Z ?ThreadID@Exception@Base@@QBEKXZ ?VerifyPtr@BasePrivate@@YA_NPBX@Z ?Write@Log@Base@@SAXPB_W@Z ?s_criticalSection@TempFile@Base@@0VCriticalSection@2@A ?s_iNoAssertCount@NoStructuredExceptionAssert@Base@@0HA ?s_nAssertsInhibited@AssertInhibitor@BasePrivate@@2HA ?s_previousPath@TempFile@Base@@0VPath@2@A _BaseOutputDebugStringA@4 _BaseOutputDebugStringW@4 _BaseReportErrorA@12 _BaseReportErrorW@12

pidav.dll

IMPHASH 847b4c077fe610bfa5e095226c5e934a
SHA256 e218e7b8508a4b2b7e0900afd9e11813863982e235343410aa6d0e8f570acdbc
MD5 96e0dcb4a51891c41cca6219fa5cbe0a
SHA1 7dad4c1d71ae6435e9a4a4ad574e68fd150b07f0
SHA512 37185949f2f6ec437fee1ab73ddbb86a5073c753cdfd7b0ddd1b98eab33573f800588cbc18ae9519a1ba8dd479a44694b31010aa47ea91d9277b4023d73ced67
SSDEEP 1536:evAZHYgUUHc/zzslWyC8rIC1jc3HYNEu/MAjDsE68:eeHYg5c3N8sC5c3HRu/MAr
TLSH
T1DC834A13B7D0C0B1D5A300305E76BFE491BAE7A19EAA9A077724670C7DF16425B2E34E
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

44558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\photos-v9\target\retail\i386\PIDav.pdb

msvcr71

??1type_info@@UAE@XZ _onexit __dllonexit ?terminate@@YAXXZ _except_handler3 __CppXcptFilter _adjust_fdiv _initterm wcstol _wtol wcscmp _wcsicmp vswprintf _vscwprintf wcsstr __CxxFrameHandler wcsncpy _purecall realloc memmove wcslen malloc free __security_error_handler memset

kernel32

GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime QueryPerformanceCounter ExitProcess DeleteCriticalSection SetLastError LoadLibraryA GetSystemDirectoryA GetWindowsDirectoryA GetModuleFileNameA GetModuleHandleA CompareStringA Sleep InterlockedDecrement InterlockedIncrement LeaveCriticalSection EnterCriticalSection LoadResource GetLocaleInfoA InitializeCriticalSection GetACP RaiseException InterlockedExchange GetThreadLocale GetVersionExA FreeLibrary GetLastError SizeofResource LockResource

advapi32

RegCloseKey

ole32

CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CoTaskMemFree

oleaut32

VarBstrCmp RegisterTypeLi UnRegisterTypeLi LoadTypeLi VariantInit VariantClear VariantCopy VarDateFromStr SysAllocStringLen SysAllocString VarUI4FromStr SysFreeString SysStringLen

pibase

?AtlThrow@ATL@@YAXJ@Z ?New@BasePrivate@@YAPAXI_N@Z ?Delete@BasePrivate@@YAXPAX@Z ?GetBaseStringManager@String@Base@@SAAAVCAtlStringMgr@ATL@@XZ

wininet

InternetConnectW HttpOpenRequestW InternetSetOptionW HttpEndRequestW HttpSendRequestW HttpQueryInfoW InternetReadFile InternetCloseHandle InternetOpenW HttpAddRequestHeadersW

shlwapi

PathFindExtensionW

piorg.dll

IMPHASH 594b2ae8719a9f9a1dda6ab409827501
SHA256 81b9f877f9198a761f820a0ea2b02eb3db85750011e50997560391dc2f160c64
MD5 d433efe19fd0d9b896945f34ba839698
SHA1 ade6c8c2732fd18308b512986a485dff40a70774
SHA512 97d2d2ceba05339a830ee5ad2a1dd9667dbf7dc17b5bf4509eb72c8c6a45214756539bab2a4e7d6a663ba67a9de73878e82e7582240e3a5f76bdb1ab8bc0324f
SSDEEP 12288:ZcqDvHI2ibCwvkqzcHKd6D/Galxp+814:aqDvHIfbCwZ4HKdQ/Gee81
TLSH
T1EA947D22B7E1C231C2A340308F1AEFE9A6BAF6A44D24990733550B5E5F7556CE63D70B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

318550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\photos-v9\target\retail\i386\piorg.pdb

msvcr71

_CxxThrowException __CxxFrameHandler ??1type_info@@UAE@XZ _onexit __dllonexit ?terminate@@YAXXZ _except_handler3 __CppXcptFilter _adjust_fdiv _initterm _wmakepath wcstok iswalpha _snwprintf __security_error_handler _makepath towlower wcstol isalpha _wtof ceil _ltow _itoa _wcsnicmp memset qsort _vsnwprintf _itow wcspbrk wcsstr wcscspn wcsspn _wtoi _beginthreadex _mbscmp _mbsstr _wtol atoi strstr sprintf sscanf _wsplitpath wcschr ??0exception@@QAE@ABV0@@Z vswprintf _vscwprintf _wcsicmp ??0exception@@QAE@XZ ??1exception@@UAE@XZ _purecall malloc realloc wcsncmp wcscmp wcscpy swprintf wcsncat wcscat wcsncpy wcsrchr memmove wcslen free

kernel32

DeleteCriticalSection GetVersion CreateFileA MulDiv GetTempPathA lstrlenA GetFileAttributesA GetFileSize ReadFile CloseHandle IsBadReadPtr SizeofResource LockResource GetThreadLocale FreeLibrary GetLastError EnterCriticalSection LeaveCriticalSection InterlockedIncrement InterlockedDecrement DeleteFileA WriteFile LoadLibraryA HeapFree GetCurrentProcess InterlockedExchange GetProcessHeap HeapAlloc GetCurrentThreadId GlobalFree GlobalLock GlobalUnlock SystemTimeToFileTime GlobalAlloc CreateThread WaitForSingleObject GetExitCodeThread ResetEvent SetEvent GetCommandLineW Sleep FlushFileBuffers GlobalHandle SetLastError GetCurrentProcessId FileTimeToSystemTime FileTimeToLocalFileTime WaitForMultipleObjects FindCloseChangeNotification FindNextChangeNotification CompareFileTime CreateEventA SetThreadPriority GetFileAttributesExA CompareStringA GetModuleHandleA GetModuleFileNameA GetWindowsDirectoryA GetSystemDirectoryA SetFilePointer RaiseException GetACP InitializeCriticalSection GetLocaleInfoA GetTickCount GlobalMemoryStatus GetUserDefaultLCID GetSystemDefaultLCID GetShortPathNameA LocalFree LocalAlloc ReleaseMutex GetSystemTimeAsFileTime HeapSize HeapReAlloc HeapDestroy GetVersionExA FlushInstructionCache LoadResource QueryPerformanceCounter ExitProcess lstrcatA lstrcpyA

user32

CreatePopupMenu UpdateWindow SetWindowPos ClientToScreen SetTimer KillTimer TrackPopupMenuEx SetMenuDefaultItem DestroyMenu ReleaseDC BeginPaint EndPaint SetRect IsWindowVisible NotifyWinEvent TrackMouseEvent ChildWindowFromPointEx IsDlgButtonChecked CheckDlgButton GetSystemMetrics ShowWindow SetRectEmpty GetClientRect GetMessagePos GetCapture SetCapture ReleaseCapture SetFocus PtInRect GetWindowDC FillRect GetDesktopWindow InvalidateRgn RedrawWindow GetDlgItem GetWindow GetFocus IsChild GetDC GetSysColor DestroyAcceleratorTable EndDialog GetCursor SetCursor ScreenToClient InvalidateRect DestroyWindow IsWindow GetParent DestroyIcon DrawEdge GetSysColorBrush OffsetRect CheckMenuRadioItem GetKeyState ChangeClipboardChain SetClipboardViewer IsWindowEnabled GetActiveWindow InflateRect IntersectRect SetWindowContextHelpId MapDialogRect BeginDeferWindowPos DeferWindowPos EndDeferWindowPos GetWindowRect EnumChildWindows CopyRect MapWindowPoints TranslateMessage PostQuitMessage

advapi32

CryptCreateHash CryptHashData CryptDeriveKey CryptSetKeyParam CryptDestroyKey CryptDestroyHash CryptAcquireContextA CryptEncrypt CryptReleaseContext CryptDecrypt RegQueryValueExA RegOpenKeyExA RegCloseKey

gdi32

SelectObject CreatePatternBrush CreateBitmap PatBlt GetStockObject GetDeviceCaps BitBlt CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap SetBkColor DeleteDC StretchDIBits SetStretchBltMode SetDIBitsToDevice Rectangle CreatePen GetObjectA SetBrushOrgEx UnrealizeObject SetTextColor SelectPalette RealizePalette DeleteObject StretchBlt CreateDIBPatternBrushPt SetBkMode

ole32

CoTaskMemAlloc OleLockRunning CreateStreamOnHGlobal OleIsCurrentClipboard ReleaseStgMedium CoGetClassObject CLSIDFromProgID CLSIDFromString OleSetClipboard OleGetClipboard DoDragDrop CoTaskMemRealloc CoTaskMemFree OleInitialize OleUninitialize StgOpenStorage StgIsStorageFile RevokeDragDrop RegisterDragDrop CoUninitialize CoCreateInstance CoInitialize CoCreateGuid StgCreateDocfile StringFromGUID2

oleaut32

SysFreeString LoadRegTypeLi OleCreateFontIndirect VariantClear VarBstrCat VarUI4FromStr VarBstrCmp SysAllocStringLen SysAllocStringByteLen SysStringByteLen SysStringLen SysAllocString VariantCopy VariantInit RegisterTypeLi UnRegisterTypeLi VarFormatDateTime SystemTimeToVariantTime LoadTypeLi

gdiplus

GdipSetLineBlend GdipDrawString GdipSetStringFormatHotkeyPrefix GdipFillPolygonI GdipDrawLineI GdipCreateLineBrush GdipSetStringFormatLineAlign GdipSetSmoothingMode GdipSetStringFormatAlign GdipDeleteStringFormat GdipCloneStringFormat GdipSetPageUnit GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipDrawImageRectRectI GdipGetImageEncoders GdipGetImageEncodersSize GdipFillRectangleI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCloneBitmapAreaI GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipCreateFromHDC GdipCreateBitmapFromResource GdipCreateHBITMAPFromBitmap GdipGetPropertyItem GdipGetPropertyItemSize GdipBitmapUnlockBits GdipBitmapLockBits GdipImageRotateFlip GdipGetImageRawFormat GdipFree GdipCloneImage GdipAlloc GdipDisposeImage GdipLoadImageFromFileICM GdipLoadImageFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipSaveImageToStream GdipDrawImageRectI GdipGraphicsClear GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateBitmapFromGdiDib GdipDeleteGraphics GdiplusShutdown GdiplusStartup GdipGetImageHeight GdipGetImageWidth GdipSaveImageToFile GdipGetPageUnit GdipReleaseDC GdipGetDC GdipDrawLinesI GdipCreateFromHWND GdipDrawPath GdipCreatePen1 GdipGetSmoothingMode GdipFillPath GdipSetRenderingOrigin GdipStringFormatGetGenericTypographic GdipCreatePath GdipDeletePath GdipAddPathArcI GdipAddPathLineI GdipClosePathFigure GdipMeasureString GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFont GdipCreateHalftonePalette GdipCreateBitmapFromGraphics GdipTranslateWorldTransform GdipDrawImageI GdipCreateHatchBrush GdipCreatePen2 GdipDeletePen GdipSetPenMode GdipDrawRectangleI GdipSetLineSigmaBlend

shlwapi

PathRemoveBackslashW PathRemoveFileSpecW StrCmpW StrCmpIW UrlCanonicalizeW StrCmpNW PathAppendW PathFileExistsW PathFindExtensionW PathRenameExtensionW PathIsRelativeW PathAddBackslashW StrRetToStrW

comctl32

ImageList_SetIconSize ImageList_Destroy ImageList_AddMasked ImageList_Create ImageList_DrawEx ImageList_GetIconSize ImageList_LoadImageW

pibase

?Delete@BasePrivate@@YAXPAX@Z ?New@BasePrivate@@YAPAXI_N@Z ?GetBaseStringManager@String@Base@@SAAAVCAtlStringMgr@ATL@@XZ ?AtlThrow@ATL@@YAXJ@Z ??1Exception@Base@@QAE@XZ ??0Exception@Base@@QAE@ABV01@@Z ??0Exception@Base@@QAE@XZ ?DoesProcessorMeetRequirements@CPU@Base@@SA_NABTCPUCaps@2@K@Z ??0Exception@Base@@QAE@J@Z ?Initialize@Base@@YGXXZ ?OutputDebugInfo@Exception@Base@@UBEXXZ ?s_previousPath@TempFile@Base@@0VPath@2@A ?s_criticalSection@TempFile@Base@@0VCriticalSection@2@A ?LoadUnicowsProc@BasePrivate@@YAPAUHINSTANCE__@@PBD@Z ?GdiplusStatusToHresult@Base@@YAJH@Z

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

crypt32

CryptProtectData CryptUnprotectData

generic

count=15, productName=Unmarked objects (old),

count=6, id=25, version=9210,

count=1, id=29, version=9178,

count=2, id=93, version=2067,

count=14, id=93, version=2179,

count=2, id=28, version=9178,

count=97, id=105, version=2067,

count=99, id=95, version=2179,

count=503, id=1, productName=Unmarked objects,

count=5, id=93, productName=VS2003 (.NET) build 3077, version=3077,

count=7, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=5, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=3, id=64, version=9210,

count=10, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,

count=62, id=100, version=3077,

count=1, id=69, version=9111,

count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,

piorgres.dll

SHA256 80b63a6d100879f040ccc4e409bca0698a176cbd2cfa843087b0d3668c18451e
MD5 b294757974b9d75185ed39b1b6a2fd89
SHA1 8abb26a5bfaeb1765aa114d8f2cc3b4b01ed4e57
SHA512 6b2654222bc7b25784b17ef9b3d7667add7525e5d5b0fabfed7eaf2317466db2eaaea11a32580b9aac2d268e3a1c5b2e6b6afc1a8b8a760c44902a94a0b29dec
SSDEEP 3072:sEaDYiwB1CEaEt9unZA4WNfDjE7AxEhGyT0pzwyWhXWdWzWAWTWsWRW8W4WdZ63L:8b9d1vakwj
TLSH
T17F34FC0447078ACCC53455F158799AC99AD4FFE2AE3FEE0EBD04706B9A33A6B7044E58
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

pisync.dll

IMPHASH 9575b7b13a57bcca6b2f2aadb75d273b
SHA256 b024947095d3af84f47a45a35bf2647bb8a0f871c2742266b369f0ac5f735ec1
MD5 7a53619ab1d41dba3a1093dce1358428
SHA1 4ab318c3b9e337ecf065ceda96b10041c0febc1c
SHA512 d34c632fcf9819fd14dbef16ee70fa2adc6cf99ed540c4e3939107c6db5b94d1cf396f4f50473fb901ee1062ac98b86e82a8e50326ee6ea3c3a8597d0c0001f8
SSDEEP 3072:YiTikrj+WJkQoUH9Ak6i2E/ekk82pvq21V3MzBXiaUqRAp9ARbGA:YAPaUHIi2p5vqQNMzZ1NNbGA
TLSH
T1B7142A2233E5D136DAE34231FD3757FA627ABE21CB22451773003F6D2A305AE945AB16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

121893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\photos-v9\target\retail\i386\pisync.pdb

msvcr71

isalpha _wmakepath strstr iswalpha wcstol __CxxFrameHandler ??1type_info@@UAE@XZ _onexit __dllonexit ?terminate@@YAXXZ _except_handler3 __CppXcptFilter _adjust_fdiv _initterm rand srand wcscpy vswprintf _vscwprintf wcsstr _wcsicmp _wtol wcsrchr wcschr wcscmp _wtoi realloc malloc _CxxThrowException memmove wcslen __security_error_handler _ltow _purecall memset strncpy wcsncpy free

kernel32

CreateMutexA GetLastError CloseHandle GetSystemTime SystemTimeToFileTime DisableThreadLibraryCalls LockResource GetCurrentProcess FlushInstructionCache GetProcessHeap HeapAlloc GetCurrentThreadId LeaveCriticalSection InterlockedIncrement LocalFree FreeLibrary SizeofResource LoadResource EnterCriticalSection HeapFree GlobalAlloc GlobalLock DeleteCriticalSection GlobalFree ReadFile WriteFile SetFilePointer SetEndOfFile GetFileSize GetLocalTime GetTickCount CompareFileTime FindClose CompareStringA GetModuleHandleA GetModuleFileNameA GetWindowsDirectoryA GetSystemDirectoryA LoadLibraryA SetLastError LocalAlloc GetUserDefaultLCID GetSystemDefaultLCID ReleaseMutex SetEvent GetSystemTimeAsFileTime WaitForSingleObject GlobalHandle GetThreadLocale InterlockedExchange RaiseException GetACP InitializeCriticalSection GetLocaleInfoA ExitProcess QueryPerformanceCounter GetCurrentProcessId GlobalUnlock lstrlenA MulDiv HeapSize HeapReAlloc HeapDestroy GetVersionExA InterlockedDecrement

user32

MapWindowPoints GetClientRect GetWindow SetTimer ShowWindow SetFocus UpdateWindow IsWindow GetActiveWindow EndDialog GetWindowRect SetWindowPos GetDlgItem GetFocus SetCursor DestroyWindow DrawFocusRect InvalidateRect GetParent IsWindowEnabled GetSysColor InflateRect GetMessageTime GetMessagePos GetCursorPos GetMenu ScreenToClient BeginPaint EndPaint GetDC ReleaseDC InvalidateRgn RedrawWindow SetCapture CheckDlgButton IsDlgButtonChecked IsChild SetWindowContextHelpId DestroyAcceleratorTable FillRect GetDesktopWindow ReleaseCapture GetCursor MapDialogRect IsWindowVisible

advapi32

CryptSetKeyParam StartServiceW RegQueryValueExA CryptDestroyKey CryptDestroyHash CryptAcquireContextA CryptEncrypt CryptReleaseContext CryptDecrypt CryptDeriveKey CryptHashData CryptCreateHash RegOpenKeyExA RegCloseKey OpenSCManagerW QueryServiceStatus OpenServiceW CloseServiceHandle

gdi32

SetBkColor DeleteObject SelectObject CreateCompatibleBitmap CreateCompatibleDC BitBlt DeleteDC GetStockObject CreateSolidBrush SetTextColor GetDeviceCaps

ole32

StringFromGUID2 OleLockRunning OleInitialize OleUninitialize CoCreateInstance CLSIDFromProgID CLSIDFromString CoFreeLibrary CoRevokeClassObject CoRegisterClassObject CoLoadLibrary CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoGetClassObject

oleaut32

VariantTimeToSystemTime SysAllocString SysAllocStringLen VarUI4FromStr VariantInit OleCreateFontIndirect VariantClear SysStringByteLen SysAllocStringByteLen SysStringLen LoadRegTypeLi LoadTypeLi VarBstrCat SysFreeString

gdiplus

GdipGetImageWidth GdipFree GdipCloneImage GdipFillRectangleI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipDeleteFont GdipReleaseDC GdipGetDC GdiplusStartup GdiplusShutdown GdipCreateFromHDC GdipDeleteGraphics GdipCreateBitmapFromResource GdipDisposeImage GdipDrawImageRectI GdipGetImageHeight GdipAlloc

shlwapi

PathIsDirectoryW PathCanonicalizeW PathIsRelativeW StrCmpIW StrCmpNW UrlCanonicalizeW PathFindExtensionW StrCmpW PathRemoveBackslashW PathFileExistsW PathAddBackslashW

comctl32

PropertySheetW InitCommonControlsEx

pibase

?Delete@BasePrivate@@YAXPAX@Z ?New@BasePrivate@@YAPAXI_N@Z ?LoadUnicowsProc@BasePrivate@@YAPAUHINSTANCE__@@PBD@Z ?Initialize@Base@@YGXXZ ??0Exception@Base@@QAE@ABV01@@Z ??1Exception@Base@@QAE@XZ ??0Exception@Base@@QAE@J@Z ?GetBaseStringManager@String@Base@@SAAAVCAtlStringMgr@ATL@@XZ ?AtlThrow@ATL@@YAXJ@Z ??0Exception@Base@@QAE@XZ

crypt32

CryptProtectData CryptUnprotectData

pisynctw.exe

IMPHASH c7dd1a2ec7eaf06dd125cf1aa1fceed0
SHA256 bb4a4cd4f0808bfe62b4c3024d099a78dc322ee579756a35fcbe3f8160dbbc0f
MD5 5c6080d433f02d8f173ec738af8b451f
SHA1 137bb1172b6faeeaafb7b09026182a4fc0e030ad
SHA512 8b091d09b19df1f9ebcc97a39b4c9e2dab840ecd7448aea53c33d3809185b07be8b58c7c56e058596d591348529cb8b29508f6769b30568d149a64ec0ec22c0e
SSDEEP 192:AROGjHNLN8G0KRdZMFu2tx+8dE3UzSYUrGuuvVKRdZMFu2tx+8dE3UzSYUrGuu30:+ty1xq3UZU9a1xq3UZU91WS6eW
TLSH
T171330B1267008858F71C0B316A16F9E4099A9E3C58E8F64FF57CBE3A6D721935AB314F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

4597

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\photos-v9\target\retail\i386\pisynctw.pdb

piview.dll

IMPHASH 9c319a3ef57a2d25ef6cd2046a069440
SHA256 b1b03e634c085aab68e3f2c78fdcdcc745e8341c0dff6c494e88911b81a61dbc
MD5 4e47d1d28edd06317f7f831e2f8075f2
SHA1 831ac6c58973e0aa5db943194e89424603be0e78
SHA512 9baa53338e159ae1ada33b0cf2ad07e039a18604e957d022d66fa4b5bf192eb2b4be9dd0120f4a6edc012f211ff831cc2d59c2fb3a40c8580874ff6ce0c57e6a
SSDEEP 6144:5VhcVqFFpODc/Mwa1ynTNanTz+STVWmOnPo+eHr5:raVqFeDcEwiiTUHr5
TLSH
T181648C16B3D1C271C4AB1831CE269BEDA2B5EDD19F6046033B653F8D6FF10515A2B28B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

145813

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\photos-v9\target\retail\i386\piview.pdb

msvcr71

_CIpow _CxxThrowException ??1type_info@@UAE@XZ __CxxFrameHandler _itow towlower wcschr memset __security_error_handler ceil _onexit __dllonexit ?terminate@@YAXXZ _except_handler3 __CppXcptFilter _adjust_fdiv _initterm floor _wtoi rand srand wcscmp _wcsicmp wcsstr wcscpy _beginthreadex vswprintf _vscwprintf memmove wcslen _purecall realloc wcsncpy malloc free

kernel32

GetACP RaiseException InterlockedExchange GetThreadLocale DeleteCriticalSection GetCurrentProcess FlushInstructionCache HeapAlloc FreeLibrary SizeofResource LoadResource MulDiv InterlockedIncrement InterlockedDecrement DisableThreadLibraryCalls GetLastError HeapReAlloc GetCurrentThreadId EnterCriticalSection LeaveCriticalSection GetVersionExA LockResource HeapFree GetTickCount GetExitCodeThread TerminateThread Sleep CloseHandle WaitForSingleObject InitializeCriticalSection QueryPerformanceCounter lstrcpynA FindClose GetSystemTime SystemTimeToFileTime SetFileTime GetFileSize LocalFree GetCurrentProcessId ReadFile WriteFile SetFilePointer SetEndOfFile CompareStringA GetModuleHandleA GetModuleFileNameA GetWindowsDirectoryA GetSystemDirectoryA LoadLibraryA SetLastError HeapSize GlobalMemoryStatus ExitProcess HeapDestroy QueryPerformanceFrequency GetSystemTimeAsFileTime GetLocaleInfoA GetProcessHeap

user32

EnumDisplayDevicesA SetTimer MoveWindow SetWindowPos GetSysColor GetDesktopWindow MapWindowPoints GetMessagePos DestroyWindow IsChild GetFocus GetParent SetFocus ShowWindow PostQuitMessage LoadStringA MessageBeep IsWindow ReleaseDC RedrawWindow InflateRect EnumDisplaySettingsA GetMessageTime SetMenuDefaultItem ClientToScreen KillTimer IsZoomed BeginDeferWindowPos DeferWindowPos EndDeferWindowPos GetAncestor SetMenu GetCursorPos PtInRect SetRect IsWindowEnabled NotifyWinEvent TrackMouseEvent FillRect GetSysColorBrush GetDC InvalidateRect BeginPaint GetClientRect EndPaint GetKeyState GetSystemMetrics GetWindowPlacement GetWindowRect SystemParametersInfoA OffsetRect TranslateMessage GetDoubleClickTime TrackPopupMenuEx CreatePopupMenu DestroyMenu UpdateWindow SetCapture ReleaseCapture SetCursor GetMenuItemCount RemoveMenu DestroyCursor ShowScrollBar SetScrollInfo GetCapture GetScrollInfo IsWindowVisible

advapi32

RegCloseKey

gdi32

GetDeviceCaps LPtoDP SetMapMode SetViewportOrgEx DeleteDC RestoreDC CreateCompatibleDC SelectObject DeleteObject GetStockObject SetBkColor SetTextColor SetWindowOrgEx SaveDC SetTextAlign GetObjectA SelectPalette RealizePalette

ole32

CreateOleAdviseHolder CoCreateInstance OleRegEnumVerbs OleRegGetUserType OleRegGetMiscStatus CoInitialize CoUninitialize CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CoTaskMemFree

oleaut32

SysStringByteLen SysAllocStringByteLen VariantCopy VarUI4FromStr VariantInit VariantClear OleCreatePropertyFrame RegisterTypeLi UnRegisterTypeLi SysAllocString SysFreeString SysStringLen SysAllocStringLen LoadTypeLi LoadRegTypeLi

gdiplus

GdipSetStringFormatLineAlign GdipDrawImageI GdipGetImageEncodersSize GdipGetImageEncoders GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdipSaveImageToFile GdipDrawImagePointRectI GdipCreateFromHWND GdipCreateHBITMAPFromBitmap GdiplusShutdown GdiplusStartup GdipDrawImageRectRectI GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipDrawLineI GdipDrawString GdipDeleteStringFormat GdipCreateStringFormat GdipMeasureString GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipCreateTexture GdipCreatePen2 GdipCreateHatchBrush GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromGraphics GdipCreateHalftonePalette GdipCloneImage GdipDisposeImage GdipCreateBitmapFromResource GdipCreateFromHDC GdipDrawRectangleI GdipGetImageHeight GdipDrawImageRectI GdipSetWorldTransform GdipTranslateWorldTransform GdipGetWorldTransform GdipDeleteMatrix GdipCreateMatrix GdipFillRectangleI GdipSetInterpolationMode GdipDeleteGraphics GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipGetImageWidth GdipSetPenDashStyle GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFont GdipAlloc GdipDeleteFont GdipFree GdipDeletePen GdipClosePathFigure GdipAddPathLineI GdipAddPathArcI GdipCreatePath GdipSetRenderingOrigin GdipGetDC GdipReleaseDC GdipGetPageUnit GdipSetPageUnit GdipGetSmoothingMode GdipSetSmoothingMode GdipCloneStringFormat GdipStringFormatGetGenericTypographic GdipSetStringFormatHotkeyPrefix GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipCreateLineBrush GdipSetLineSigmaBlend GdipFillPath GdipSetPenMode GdipDrawPath GdipDeletePath GdipSetLineBlend GdipFillPolygonI GdipDrawLinesI GdipSetStringFormatAlign

shlwapi

PathCanonicalizeW PathIsRelativeW PathRemoveFileSpecW PathFileExistsW PathIsDirectoryW PathAddBackslashW PathFindExtensionW

comctl32

ImageList_LoadImageW ImageList_Destroy InitCommonControlsEx

oleacc

AccessibleObjectFromWindow LresultFromObject

imm32

ImmAssociateContext

msimg32

AlphaBlend

pibase

??1Exception@Base@@QAE@XZ ??0Exception@Base@@QAE@ABV01@@Z ?Initialize@Base@@YGXXZ ?GetBaseStringManager@String@Base@@SAAAVCAtlStringMgr@ATL@@XZ ?AtlThrow@ATL@@YAXJ@Z ?LoadUnicowsProc@BasePrivate@@YAPAUHINSTANCE__@@PBD@Z ?New@BasePrivate@@YAPAXI_N@Z ?Delete@BasePrivate@@YAXPAX@Z ??0Exception@Base@@QAE@XZ ?DoesProcessorMeetRequirements@CPU@Base@@SA_NABTCPUCaps@2@K@Z ??0Exception@Base@@QAE@J@Z

prgemp.gif

SHA256 f35aee0df2db9e5a9574d250f89be23a69c088b346a7612c34494284d6077df1
MD5 9986d91856ced30b8e9449274754821e
SHA1 6f54311a5de6b2da60172e885e606330481ff5f4
SHA512 80d942d30d73a74f8b94e8229229e6154b0abab4c69c561f26c19795ab4d56b31cdbec626a4640ed78c9bedd6db7409029822229a16a13a4755ebfb7430724b9
TLSH
T1E2A0220EFF8C0020C8238C33080280C023ACC2A883033B0E838C0888CC3B20008E000F
MD5 SHA1 SHA512 TLSH

prggrn.gif

SHA256 11f68508bcd118f13a1a31bf783706850be5e80364d21a73a896449324b8eed4
MD5 eaa956be72f66d9d2169adc197073390
SHA1 b3fb217bab4419afb26f2899ced7aa33cab41e67
SHA512 2f26c4584fca65dc8c87e311af6ed539de0b5f322fcb79fb5c03a7c529fd5c110dbdafc05d7ce686d39ff283514e7446b3d44f7df42af4fa6c03915839853fac
TLSH
T1CAA0020CB5C40164D556453D38D9459B230C46097B341F12600E009F7C5E3904561699
MD5 SHA1 SHA512 TLSH

slides~1.js

SHA256 5deb9766faf4d8be4d4d9e56360e5bdc985da19ad8e2d94e1a80a59eaecad916
MD5 cf9dda1c54df6502cf15b68220fbaab6
SHA1 3b49ca279ae8d2b02c0ec898562212001c34d715
SHA512 e7a6c45b8a11723b2f03d3ffd8cfc964382039c6d657fa4b7d7fbd05c42255c7aa2b83d4ac2312cbdf0b2457833e4a70864e23c788df501d45e6dccd5b8a65e2
SSDEEP 3072:8ZPe5rSdqQocrWMM0OmRxNYZBdCfOqWbUVZc66A9BM2sT/vRUMtwvaJOuMhWvsT3:8ZGcd5M0xwZBdCfOqSUVZc66A9BM2sTO
TLSH
T1BCF3C59D722555B6C39B3698AB0EB50CFEB88408BE23C4AC395CC4D9E4E4C5C617AF74
MD5 SHA1 SHA512 SSDEEP TLSH

slides~1.xml

SHA256 799c3b251c5856dae775c9f9fbb47c9ec33a601fcfe2e1bbd63b7f976e53c3b0
MD5 7b53d1103c0a17a32b60e7925f8c529e
SHA1 5b104e29fd8b9570459a2cd35b0ab35c9255bd13
SHA512 3636c2844bca0eec6369683d3af49a1eaad9dfb2115941e2942980079f1af0e1acb4aa6fd00259a4cb6647805e91c3d18a731ca522d0be2157ce5d7a13d04e78
SSDEEP 96:31Hez4kimrPH4ieokM1roVXofrpXJpoH8cSpXdHcoF79xA1Vn1gxyZt:3GimPzxF79xAXnrt
TLSH
T10A024943A7F92168F1F6AB40BE7691900EF5FDE19878C95D1090180D84F6F519CB2FA7
MD5 SHA1 SHA512 SSDEEP TLSH

splash.gif

SHA256 696ca709ae25835fffa1dddabb725e93f1c5de461c659ecf0a7878b704358c12
MD5 28e38509e9aced026d1a5dbc8f1dc767
SHA1 73b5cbee7ebfc693484a20cdc472efb0e3aaebb8
SHA512 95ed6f422e21e9301c206758b02a60a81fd7b09f13b1c2293e5405878e25e04ddde46902d82dd69bd496a6396884e738a4d0eea25bb57bdf55bd949c4f85d20e
TLSH
T1B2510879522CE143C393D07738552E90C7FA96E046093C79F5D9F42EC36A10EC359BAA
MD5 SHA1 SHA512 TLSH

startup.js

SHA256 1cc5e3ce8704492f87932983847c8c5a2be2aac1a4744b9fc5d0749efcd27321
MD5 82dac91011c75b5e433e29ab43780c8c
SHA1 23438c2e48ea5324cf3a9727320474540e5cdd45
SHA512 bb0d1e0d50dc0eaca926ad1246ee0c54e587468ffc65adfcf8e9df2881661394ae8c8eb32d9b60c8e70c45350d111489f6aa1ce61fb420c087545c1dfd4dc85d
SSDEEP 384:Xinc4ae4ySOL8uDbGWUUbLkXj9vnC5N9PaW1EN6xNX+DjkJq:ync4ae4BOaWsXj5EXD+DjZ
TLSH
T18692B556B64E82BF93912214593B95648D78A2512770D0E8F4CCFCDCD0B8EAC8777EB8
MD5 SHA1 SHA512 SSDEEP TLSH

unicows.dll

IMPHASH 785d5607ed2f18f4ea0be5809350b169
SHA256 22f23cc65698741184ec34f46e6f69717644e0b5aabf5d5bd015101f2d72e56e
MD5 e1102cedf0c818984c2aca2a666d4c5f
SHA1 d8d88ea7083aee9c40f6fdc6c56451a018d21a83
SHA512 e58b35815801d6d3797f95c986834d2ca5450ccc3f1fa1d27d127a8d1d36f8e21279173715a00686c9c831d22d7c5b5b9cc5874170223a4d78f09c4eefa390a2
SSDEEP 3072:fEWAQKw38JvCAib0uT++ICSQ6UOX/mQhYQXS0FsmaiUZZynGJ5x/59XH7PMYV1Nz:qwgvCAib0PAOOQhS0/s5x/R1PkOFB5
TLSH
T180344A19BCC05E43EF6733BEF9207B74D7DB8A241538AC8646CE5E0E25B1681133E5A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

74:61:85:10:84:38:b9:d3:08:de:5e:77:88:9b:e4:51

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

Chains

Jan 1, 0001

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Serial Number

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Timespan

May 12, 1997 - Jan 7, 2004

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Serial Number

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 28, 2001 - Jan 6, 2004

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 10, 2000 - Nov 12, 2005

Subject

Serial Number

61:07:11:43:00:00:00:00:00:34

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2002 - Nov 25, 2003

Minor OS version

0

Major OS version

6

Entry point

57683

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

unicows.pdb

kernel32

GetDiskFreeSpaceA GetDiskFreeSpaceW GetDriveTypeA GetDriveTypeW FreeEnvironmentStringsA GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW FindClose IsDBCSLeadByte GetFullPathNameA GetFullPathNameW GetLocaleInfoW GetLogicalDriveStringsA GetLogicalDriveStringsW GetModuleFileNameA GetModuleFileNameW GetModuleHandleW GetNamedPipeHandleStateA GetNamedPipeHandleStateW GetNumberFormatA GetNumberFormatW GetPrivateProfileIntA GetPrivateProfileIntW GetPrivateProfileSectionA GetPrivateProfileSectionW GetPrivateProfileSectionNamesA GetPrivateProfileSectionNamesW GetPrivateProfileStringA GetPrivateProfileStringW GetPrivateProfileStructA GetPrivateProfileStructW GetProfileIntA GetProfileIntW GetProfileSectionA GetProfileSectionW GetProfileStringA GetProfileStringW GetShortPathNameA GetShortPathNameW GetStartupInfoA GetStartupInfoW GetStringTypeExA GetStringTypeExW GetSystemDirectoryA GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTimeFormatA GetTimeFormatW GetVersionExA GetVersionExW GetVolumeInformationA GetVolumeInformationW GetWindowsDirectoryA GetWindowsDirectoryW GlobalAddAtomW GlobalFindAtomA GlobalFindAtomW GlobalGetAtomNameA GlobalGetAtomNameW IsBadStringPtrW IsValidCodePage LCMapStringA LCMapStringW LoadLibraryW LoadLibraryExW lstrcatW lstrcmpW lstrcmpiW lstrcpyW lstrcpynW MoveFileW OpenEventA OpenEventW GetDefaultCommConfigW OpenFileMappingW OpenMutexA OpenMutexW OpenSemaphoreA OpenSemaphoreW OutputDebugStringA OutputDebugStringW PeekConsoleInputA PeekConsoleInputW QueryDosDeviceA QueryDosDeviceW ReadConsoleA ReadConsoleW ReadConsoleInputA ReadConsoleInputW ReadConsoleOutputA ReadConsoleOutputW ReadConsoleOutputCharacterA ReadConsoleOutputCharacterW RemoveDirectoryA RemoveDirectoryW ScrollConsoleScreenBufferA ScrollConsoleScreenBufferW SearchPathA SearchPathW SetComputerNameA SetComputerNameW SetConsoleTitleA SetConsoleTitleW SetCurrentDirectoryA SetCurrentDirectoryW SetDefaultCommConfigA SetDefaultCommConfigW SetEnvironmentVariableA SetEnvironmentVariableW SetFileAttributesA SetFileAttributesW SetLocaleInfoA SetLocaleInfoW SetVolumeLabelA SetVolumeLabelW VerLanguageNameA VerLanguageNameW WaitNamedPipeA WaitNamedPipeW WriteConsoleA WriteConsoleW WriteConsoleInputA WriteConsoleInputW WriteConsoleOutputA WriteConsoleOutputW WriteConsoleOutputCharacterA WriteConsoleOutputCharacterW WritePrivateProfileSectionA WritePrivateProfileSectionW WritePrivateProfileStringA WritePrivateProfileStringW WritePrivateProfileStructA WritePrivateProfileStructW WriteProfileSectionA WriteProfileSectionW WriteProfileStringA WriteProfileStringW FindResourceA lstrcpyA IsBadWritePtr SetErrorMode GetStringTypeW FindResourceW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter GetDefaultCommConfigA GetDateFormatW GetDateFormatA GetCurrentDirectoryA GetCurrentDirectoryW GetCurrencyFormatW GetCurrencyFormatA GetConsoleTitleW GetConsoleTitleA GetComputerNameW GetComputerNameA GetAtomNameW GetAtomNameA FormatMessageW FormatMessageA LocalFree HeapReAlloc LocalAlloc FreeEnvironmentStringsW FindNextFileW FindNextFileA FindFirstFileW FindFirstFileA FindFirstChangeNotificationW FindFirstChangeNotificationA FindAtomW FindAtomA FillConsoleOutputCharacterW FillConsoleOutputCharacterA FatalAppExitW FatalAppExitA ExpandEnvironmentStringsW ExpandEnvironmentStringsA EnumTimeFormatsW EnumTimeFormatsA EnumSystemLocalesW EnumSystemLocalesA EnumSystemCodePagesW EnumDateFormatsW EnumDateFormatsA EnumCalendarInfoW EnumCalendarInfoA DeleteFileW CreateSemaphoreW CreateSemaphoreA CreateProcessW CreateProcessA CreateNamedPipeW CreateNamedPipeA CreateMutexW CreateMutexA CreateMailslotW CreateMailslotA CreateFileMappingW CreateFileMappingA CreateFileW CreateEventW CreateEventA CreateDirectoryExW CreateDirectoryExA CreateDirectoryW CreateDirectoryA CopyFileW CopyFileA CompareStringW CommConfigDialogW CommConfigDialogA CallNamedPipeW CallNamedPipeA BuildCommDCBAndTimeoutsW BuildCommDCBAndTimeoutsA BuildCommDCBW BuildCommDCBA AddAtomW AddAtomA InitializeCriticalSection GetACP GetOEMCP DeleteCriticalSection GetFileAttributesA LoadLibraryExA EnumResourceTypesW EnumResourceNamesW EnumResourceLanguagesW lstrlenW FindResourceExW SizeofResource LoadResource LockResource FreeResource GetTempFileNameA GetTempPathA DeleteFileA MoveFileA _lclose _lread _lwrite _llseek VirtualQuery GetSystemInfo VirtualFree VirtualAlloc VirtualProtect TlsAlloc TlsFree TlsGetValue TlsSetValue GetCurrentProcessId EnterCriticalSection LeaveCriticalSection CompareStringA GlobalAddAtomA AreFileApisANSI GlobalLock GlobalAlloc GlobalUnlock GlobalFree GetCurrentThreadId lstrcmpA WideCharToMultiByte lstrcmpiA GetLocaleInfoA CreateFileA GetFileSize CloseHandle IsDBCSLeadByteEx LoadLibraryA InterlockedExchange FreeLibrary GetModuleHandleA GetProcAddress GetCPInfo GetVersion GetFileAttributesW GetLastError lstrlenA GetProcessHeap HeapAlloc SetLastError MultiByteToWideChar OpenFileMappingA HeapFree RtlUnwind

user32

SystemParametersInfoW TranslateAcceleratorW TabbedTextOutA TabbedTextOutW UnregisterClassA UnregisterClassW VkKeyScanExA VkKeyScanExW WinHelpA WinHelpW wvsprintfW EnumClipboardFormats GetClipboardData VkKeyScanW wsprintfW IsCharLowerW IsCharAlphaNumericW IsCharAlphaW InsertMenuItemW InsertMenuItemA InsertMenuW InsertMenuA GrayStringW GrayStringA GetWindowTextLengthW GetWindowTextLengthA GetWindowTextW GetWindowTextA GetWindowLongW GetTabbedTextExtentW GetTabbedTextExtentA GetPropW GetMessageW GetMenuStringW GetMenuStringA GetMenuItemInfoW GetMenuItemInfoA GetKeyNameTextW GetKeyboardLayout GetKeyNameTextA GetKeyboardLayoutNameW GetKeyboardLayoutNameA GetDlgItemTextW GetDlgItemTextA GetClipboardFormatNameW GetClipboardFormatNameA GetClassNameW GetClassLongW GetClassLongA GetClassInfoExW GetClassInfoExA GetClassInfoW GetClassInfoA FindWindowExW FindWindowExA FindWindowW FindWindowA EnableWindow EnumPropsExW EnumPropsExA EnumPropsW EnumPropsA EnumDisplaySettingsW EnumDisplaySettingsA DrawTextExW DrawTextExA DrawTextW DrawTextA DrawStateW DrawStateA DlgDirSelectExW DlgDirSelectExA DlgDirSelectComboBoxExW DlgDirSelectComboBoxExA DlgDirListComboBoxW DlgDirListComboBoxA DlgDirListW SystemParametersInfoA DispatchMessageW DialogBoxParamW DialogBoxParamA DialogBoxIndirectParamW DialogBoxIndirectParamA DefMDIChildProcW DefFrameProcW DefDlgProcW DdeQueryStringW DdeQueryStringA DdeQueryConvInfo DdeInitializeW DdeInitializeA DdeCreateStringHandleW DdeCreateStringHandleA DdeConnectList DdeConnect CharUpperBuffW CharUpperW CharToOemBuffW CharToOemW CharPrevW CharNextW CharLowerBuffW CharLowerW ChangeMenuW SetWindowTextW SetWindowTextA SetWindowsHookExW SetWindowsHookW SetWindowsHookA SetWindowLongW SetPropW SetMenuItemInfoW SetMenuItemInfoA SetDlgItemTextW SetDlgItemTextA SetClassLongW SetClassLongA SendNotifyMessageW SendMessageTimeoutW SendMessageCallbackW SendMessageW SendDlgItemMessageW RemovePropW RegisterWindowMessageW RegisterClipboardFormatW RegisterClipboardFormatA RegisterClassExW RegisterClassExA RegisterClassW RegisterClassA PostThreadMessageW PostMessageW PeekMessageW OemToCharBuffW OemToCharW ModifyMenuW ModifyMenuA MessageBoxIndirectW MessageBoxIndirectA MessageBoxExW MessageBoxW MapVirtualKeyExW MapVirtualKeyExA ChangeMenuA ChangeDisplaySettingsW ChangeDisplaySettingsA CreateWindowExW CreateWindowExA CreateMDIWindowW CreateMDIWindowA CreateDialogParamW CreateDialogParamA CreateDialogIndirectParamW CreateDialogIndirectParamA CreateAcceleratorTableW CreateAcceleratorTableA CopyAcceleratorTableW CopyAcceleratorTableA CallWindowProcW CallMsgFilterW CallMsgFilterA AppendMenuW AppendMenuA GetWindowThreadProcessId SetWindowLongA TranslateAcceleratorA IsDialogMessageA DispatchMessageA PeekMessageA GetMessageA PostThreadMessageA PostMessageA SendNotifyMessageA SendMessageTimeoutA SendMessageCallbackA SendMessageA DefWindowProcA CallWindowProcA DefMDIChildProcA DefFrameProcA DefDlgProcA GetWindowLongA GetParent GetDlgItem SetPropA RemovePropA GetPropA IsDlgButtonChecked GetClassNameA CharLowerA CharUpperA UnhookWindowsHookEx SetWindowsHookExA MapVirtualKeyW CallNextHookEx MapVirtualKeyA LoadStringW LoadMenuIndirectW LoadMenuIndirectA EnumChildWindows RegisterWindowMessageA LoadMenuW LoadMenuA LoadKeyboardLayoutW LoadKeyboardLayoutA LoadImageW LoadImageA LoadIconW LoadIconA LoadCursorFromFileW LoadCursorFromFileA LoadCursorW LoadCursorA LoadBitmapW LoadBitmapA LoadAcceleratorsW LoadAcceleratorsA IsWindowUnicode IsWindow IsDialogMessageW DlgDirListA IsClipboardFormatAvailable IsCharUpperW

gdi32

GetEnhMetaFileDescriptionW GetGlyphOutlineA GetGlyphOutlineW GetICMProfileA GetICMProfileW GetKerningPairsA GetKerningPairsW GetLogColorSpaceA GetLogColorSpaceW GetMetaFileA GetMetaFileW GetObjectA GetObjectType GetObjectW GetOutlineTextMetricsA GetOutlineTextMetricsW GetTextExtentExPointA GetTextExtentExPointW GetTextExtentPointA GetEnhMetaFileDescriptionA GetTextExtentPoint32A GetTextExtentPoint32W GetTextFaceA GetTextFaceW GetTextMetricsA GetTextMetricsW PolyTextOutA PolyTextOutW RemoveFontResourceA RemoveFontResourceW ResetDCA ResetDCW SetICMProfileA SetICMProfileW StartDocA StartDocW TextOutW UpdateICMRegKeyA UpdateICMRegKeyW GetEnhMetaFileW GetEnhMetaFileA GetCharacterPlacementW GetCharacterPlacementA GetCharWidthFloatW GetCharWidthFloatA GetCharWidth32W GetCharWidthW GetCharWidthA GetCharABCWidthsFloatW GetCharABCWidthsFloatA GetCharABCWidthsW GetCharABCWidthsA ExtTextOutW ExtTextOutA EnumICMProfilesW EnumICMProfilesA EnumFontsW EnumFontsA EnumFontFamiliesExW EnumFontFamiliesExA EnumFontFamiliesW EnumFontFamiliesA CreateScalableFontResourceW CreateScalableFontResourceA CreateMetaFileW CreateMetaFileA CreateICW CreateICA CreateFontIndirectW CreateFontIndirectA CreateFontW CreateFontA CreateEnhMetaFileW CreateEnhMetaFileA CreateDCW CreateDCA CreateColorSpaceW CreateColorSpaceA CopyMetaFileW CopyMetaFileA CopyEnhMetaFileW CopyEnhMetaFileA AddFontResourceW AddFontResourceA GetFontData GetTextExtentPointW TranslateCharsetInfo GetTextCharset

mpr

WNetGetUniversalNameW MultinetGetConnectionPerformanceW WNetAddConnectionA WNetAddConnectionW WNetAddConnection2A WNetAddConnection2W WNetAddConnection3A WNetAddConnection3W WNetCancelConnectionA WNetCancelConnectionW WNetCancelConnection2A WNetCancelConnection2W WNetConnectionDialog1A WNetConnectionDialog1W WNetDisconnectDialog1A WNetDisconnectDialog1W WNetEnumResourceA WNetEnumResourceW WNetGetConnectionA WNetGetConnectionW WNetGetLastErrorA WNetGetLastErrorW WNetGetNetworkInformationA WNetGetNetworkInformationW WNetGetProviderNameA WNetUseConnectionW WNetUseConnectionA WNetOpenEnumW WNetOpenEnumA WNetGetUserW WNetGetUserA MultinetGetConnectionPerformanceA WNetGetUniversalNameA WNetGetResourceParentW WNetGetResourceParentA WNetGetResourceInformationW WNetGetResourceInformationA WNetGetProviderNameW

advapi32

RegOpenKeyA RegEnumValueA RegUnLoadKeyW RegUnLoadKeyA RegSetValueExW RegSetValueExA RegSetValueW RegSetValueA RegSaveKeyW RegSaveKeyA RegReplaceKeyW RegReplaceKeyA RegQueryValueExW RegQueryValueExA RegQueryValueW RegQueryValueA RegQueryMultipleValuesW RegQueryMultipleValuesA RegQueryInfoKeyW RegQueryInfoKeyA RegOpenKeyExW RegOpenKeyW RegCloseKey RegLoadKeyW RegLoadKeyA RegEnumValueW RegEnumKeyExW RegEnumKeyExA RegEnumKeyW RegEnumKeyA RegDeleteValueW RegDeleteValueA RegDeleteKeyW RegDeleteKeyA RegCreateKeyExW RegCreateKeyExA RegCreateKeyW RegCreateKeyA RegConnectRegistryW RegConnectRegistryA IsTextUnicode GetUserNameW GetUserNameA RegOpenKeyExA

comdlg32

GetOpenFileNameW GetFileTitleW GetFileTitleA FindTextW ChooseFontW ChooseFontA ChooseColorW ChooseColorA ReplaceTextW FindTextA ReplaceTextA GetOpenFileNameA GetSaveFileNameA PageSetupDlgA PageSetupDlgW PrintDlgA PrintDlgW GetSaveFileNameW

version

VerQueryValueW VerQueryValueA VerInstallFileW VerInstallFileA VerFindFileW VerFindFileA GetFileVersionInfoSizeW GetFileVersionInfoSizeA GetFileVersionInfoW GetFileVersionInfoA

shell32

SHGetPathFromIDListA ord180 ord179 SHGetFileInfoA SHFileOperationA SHChangeNotify SHBrowseForFolderA Shell_NotifyIconA ShellExecuteExA ShellExecuteW ShellExecuteA ShellAboutW ShellAboutA FindExecutableW FindExecutableA ExtractIconExA DragQueryFileA DragQueryFileW ExtractIconW ExtractIconA

winspool.drv

GetPrinterW GetPrinterDataW GetPrinterDriverW GetPrinterDriverDirectoryA GetPrinterDriverDirectoryW GetPrintProcessorDirectoryA GetPrintProcessorDirectoryW GetJobW OpenPrinterW ResetPrinterA ResetPrinterW SetJobA SetJobW SetPrinterA SetPrinterW SetPrinterDataA SetPrinterDataW StartDocPrinterA EnumPrintProcessorsW EnumPrintProcessorDatatypesW EnumPrintersW EnumPrinterDriversW EnumPortsW EnumMonitorsW DocumentPropertiesW DocumentPropertiesA DeviceCapabilitiesW DeviceCapabilitiesA DeletePrintProvidorW DeletePrintProvidorA DeletePrintProcessorW DeletePrintProcessorA DeletePrinterDriverW DeletePrinterDriverA DeletePortW DeletePortA DeleteMonitorW DeleteMonitorA ConfigurePortW ConfigurePortA AdvancedDocumentPropertiesW AdvancedDocumentPropertiesA AddPrintProvidorW AddPrintProvidorA AddPrintProcessorW AddPrintProcessorA AddPrinterDriverW AddPrinterDriverA AddPrinterW AddPrinterA AddPortW AddPortA AddMonitorW AddMonitorA AddJobW AddJobA OpenPrinterA StartDocPrinterW

oledlg

OleUIUpdateLinksW OleUIPromptUserW OleUIPasteSpecialW OleUIObjectPropertiesW OleUIInsertObjectW OleUIEditLinksW OleUIConvertW OleUIChangeSourceW OleUIChangeIconW OleUIBusyW ord8 OleUIAddVerbMenuW ord1 ord6

winmm

waveOutGetErrorTextW waveOutGetErrorTextA waveOutGetDevCapsW waveOutGetDevCapsA waveInGetErrorTextW mixerGetControlDetailsW midiOutGetErrorTextW midiOutGetErrorTextA midiOutGetDevCapsW midiOutGetDevCapsA midiInGetErrorTextW midiInGetDevCapsW midiInGetDevCapsA mciSendStringW mciSendStringA mciSendCommandW mciGetErrorStringW mciGetErrorStringA midiInGetErrorTextA mciGetDeviceIDW mciGetDeviceIDA joyGetDevCapsW joyGetDevCapsA auxGetDevCapsW auxGetDevCapsA PlaySoundW PlaySoundA mixerGetDevCapsW mixerGetLineControlsW mixerGetLineInfoW mmioInstallIOProcW mmioOpenA mmioOpenW mmioRenameA mmioRenameW mmioStringToFOURCCA mmioStringToFOURCCW sndPlaySoundA sndPlaySoundW waveInGetDevCapsA waveInGetDevCapsW waveInGetErrorTextA mixerGetDevCapsA

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

msvfw32

MCIWndCreateW MCIWndCreateA GetSaveFileNamePreviewW GetOpenFileNamePreviewW

imm32

ImmReleaseContext ImmGetCompositionStringA ImmGetContext ImmGetCompositionStringW

AcquireCredentialsHandleW AddAtomW AddFontResourceW AddJobW AddMonitorW AddPortW AddPrintProcessorW AddPrintProvidorW AddPrinterDriverW AddPrinterW AdvancedDocumentPropertiesW AppendMenuW BeginUpdateResourceA BeginUpdateResourceW BroadcastSystemMessageW BuildCommDCBAndTimeoutsW BuildCommDCBW CallMsgFilterW CallNamedPipeW CallWindowProcA CallWindowProcW ChangeDisplaySettingsExW ChangeDisplaySettingsW ChangeMenuW CharLowerBuffW CharLowerW CharNextW CharPrevW CharToOemBuffW CharToOemW CharUpperBuffW CharUpperW ChooseColorW ChooseFontW CommConfigDialogW CompareStringW ConfigurePortW CopyAcceleratorTableW CopyEnhMetaFileW CopyFileExW CopyFileW CopyMetaFileW CreateAcceleratorTableW CreateColorSpaceW CreateDCW CreateDialogIndirectParamW CreateDialogParamW CreateDirectoryExW CreateDirectoryW CreateEnhMetaFileW CreateEventW CreateFileMappingW CreateFileW CreateFontIndirectW CreateFontW CreateICW CreateMDIWindowW CreateMailslotW CreateMetaFileW CreateMutexW CreateNamedPipeW CreateProcessW CreateScalableFontResourceW CreateSemaphoreW CreateStdAccessibleProxyW CreateWaitableTimerW CreateWindowExW CryptAcquireContextW CryptEnumProviderTypesW CryptEnumProvidersW CryptGetDefaultProviderW CryptSetProviderExW CryptSetProviderW CryptSignHashW CryptVerifySignatureW DdeConnect DdeConnectList DdeCreateStringHandleW DdeInitializeW DdeQueryConvInfo DdeQueryStringW DefDlgProcW DefFrameProcW DefMDIChildProcW DefWindowProcW DeleteFileW DeleteMonitorW DeletePortW DeletePrintProcessorW DeletePrintProvidorW DeletePrinterDriverW DeviceCapabilitiesW DialogBoxIndirectParamW DialogBoxParamW DispatchMessageW DlgDirListComboBoxW DlgDirListW DlgDirSelectComboBoxExW DlgDirSelectExW DocumentPropertiesW DragQueryFileW DrawStateW DrawTextExW DrawTextW EnableWindow EndUpdateResourceA EndUpdateResourceW EnumCalendarInfoExW EnumCalendarInfoW EnumClipboardFormats EnumDateFormatsExW EnumDateFormatsW EnumDisplayDevicesW EnumDisplaySettingsExW EnumDisplaySettingsW EnumFontFamiliesExW EnumFontFamiliesW EnumFontsW EnumICMProfilesW EnumMonitorsW EnumPortsW EnumPrintProcessorDatatypesW EnumPrintProcessorsW EnumPrinterDriversW EnumPrintersW EnumPropsA EnumPropsExA EnumPropsExW EnumPropsW EnumSystemCodePagesW EnumSystemLocalesW EnumTimeFormatsW EnumerateSecurityPackagesW ExpandEnvironmentStringsW ExtTextOutW ExtractIconExW ExtractIconW FatalAppExitW FillConsoleOutputCharacterW FindAtomW FindExecutableW FindFirstChangeNotificationW FindFirstFileW FindNextFileW FindResourceExW FindResourceW FindTextW FindWindowExW FindWindowW FormatMessageW FreeContextBuffer FreeEnvironmentStringsW GetAltTabInfoW GetAtomNameW GetCPInfo GetCPInfoExW GetCalendarInfoW GetCharABCWidthsFloatW GetCharABCWidthsW GetCharWidth32W GetCharWidthFloatW GetCharWidthW GetCharacterPlacementW GetClassInfoExW GetClassInfoW GetClassLongW GetClassNameW GetClipboardData GetClipboardFormatNameW GetComputerNameW GetConsoleTitleW GetCurrencyFormatW GetCurrentDirectoryW GetCurrentHwProfileW GetDateFormatW GetDefaultCommConfigW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDlgItemTextW GetDriveTypeW GetEnhMetaFileDescriptionW GetEnhMetaFileW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesExW GetFileAttributesW GetFileTitleW GetFileVersionInfoSizeW GetFileVersionInfoW GetFullPathNameW GetGlyphOutlineW GetICMProfileW GetJobW GetKerningPairsW GetKeyNameTextW GetKeyboardLayoutNameW GetLocaleInfoW GetLogColorSpaceW GetLogicalDriveStringsW GetLongPathNameW GetMenuItemInfoW GetMenuStringW GetMessageW GetMetaFileW GetModuleFileNameW GetModuleHandleW GetMonitorInfoW GetNamedPipeHandleStateW GetNumberFormatW GetObjectW GetOpenFileNamePreviewW GetOpenFileNameW GetOutlineTextMetricsW GetPrintProcessorDirectoryW GetPrinterDataW GetPrinterDriverDirectoryW GetPrinterDriverW GetPrinterW GetPrivateProfileIntW GetPrivateProfileSectionNamesW GetPrivateProfileSectionW GetPrivateProfileStringW GetPrivateProfileStructW GetProcAddress GetProfileIntW GetProfileSectionW GetProfileStringW GetPropA GetPropW GetRoleTextW GetSaveFileNamePreviewW GetSaveFileNameW GetShortPathNameW GetStartupInfoW GetStateTextW GetStringTypeExW GetStringTypeW GetSystemDirectoryW GetSystemWindowsDirectoryW GetTabbedTextExtentW GetTempFileNameW GetTempPathW GetTextExtentExPointW GetTextExtentPoint32W GetTextExtentPointW GetTextFaceW GetTextMetricsW GetTimeFormatW GetUserNameW GetVersionExW GetVolumeInformationW GetWindowLongA GetWindowLongW GetWindowModuleFileNameW GetWindowTextLengthW GetWindowTextW GetWindowsDirectoryW GlobalAddAtomW GlobalFindAtomW GlobalGetAtomNameW GrayStringW InitSecurityInterfaceW InitializeSecurityContextW InsertMenuItemW InsertMenuW IsBadStringPtrW IsCharAlphaNumericW IsCharAlphaW IsCharLowerW IsCharUpperW IsClipboardFormatAvailable IsDestinationReachableW IsDialogMessageW IsTextUnicode IsValidCodePage IsWindowUnicode LCMapStringW LoadAcceleratorsW LoadBitmapW LoadCursorFromFileW LoadCursorW LoadIconW LoadImageW LoadKeyboardLayoutW LoadLibraryExW LoadLibraryW LoadMenuIndirectW LoadMenuW LoadStringW MCIWndCreateW MapVirtualKeyExW MapVirtualKeyW MessageBoxExW MessageBoxIndirectW MessageBoxW ModifyMenuW MoveFileW MultiByteToWideChar MultinetGetConnectionPerformanceW OemToCharBuffW OemToCharW OleUIAddVerbMenuW OleUIBusyW OleUIChangeIconW OleUIChangeSourceW OleUIConvertW OleUIEditLinksW OleUIInsertObjectW OleUIObjectPropertiesW OleUIPasteSpecialW OleUIPromptUserW OleUIUpdateLinksW OpenEventW OpenFileMappingW OpenMutexW OpenPrinterW OpenSemaphoreW OpenWaitableTimerW OutputDebugStringW PageSetupDlgW PeekConsoleInputW PeekMessageW PlaySoundW PolyTextOutW PostMessageW PostThreadMessageW PrintDlgW QueryContextAttributesW QueryCredentialsAttributesW QueryDosDeviceW QuerySecurityPackageInfoW RasConnectionNotificationW RasCreatePhonebookEntryW RasDeleteEntryW RasDeleteSubEntryW RasDialW RasEditPhonebookEntryW RasEnumConnectionsW RasEnumDevicesW RasEnumEntriesW RasGetConnectStatusW RasGetEntryDialParamsW RasGetEntryPropertiesW RasGetErrorStringW RasGetProjectionInfoW RasHangUpW RasRenameEntryW RasSetEntryDialParamsW RasSetEntryPropertiesW RasSetSubEntryPropertiesW RasValidateEntryNameW ReadConsoleInputW ReadConsoleOutputCharacterW ReadConsoleOutputW ReadConsoleW RegConnectRegistryW RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegLoadKeyW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryMultipleValuesW RegQueryValueExW RegQueryValueW RegReplaceKeyW RegSaveKeyW RegSetValueExW RegSetValueW RegUnLoadKeyW RegisterClassExW RegisterClassW RegisterClipboardFormatW RegisterDeviceNotificationW RegisterWindowMessageW RemoveDirectoryW RemoveFontResourceW RemovePropA RemovePropW ReplaceTextW ResetDCW ResetPrinterW SHBrowseForFolderW SHChangeNotify SHFileOperationW SHGetFileInfoW SHGetNewLinkInfoW SHGetPathFromIDListW ScrollConsoleScreenBufferW SearchPathW SendDlgItemMessageW SendMessageCallbackW SendMessageTimeoutW SendMessageW SendNotifyMessageW SetCalendarInfoW SetClassLongW SetComputerNameW SetConsoleTitleW SetCurrentDirectoryW SetDefaultCommConfigW SetDlgItemTextW SetEnvironmentVariableW SetFileAttributesW SetICMProfileW SetJobW SetLocaleInfoW SetMenuItemInfoW SetPrinterDataW SetPrinterW SetPropA SetPropW SetVolumeLabelW SetWindowLongA SetWindowLongW SetWindowTextW SetWindowsHookExW SetWindowsHookW ShellAboutW ShellExecuteExW ShellExecuteW Shell_NotifyIconW StartDocPrinterW StartDocW SystemParametersInfoW TabbedTextOutW TextOutW TranslateAcceleratorW UnregisterClassW UpdateICMRegKeyW UpdateResourceA UpdateResourceW VerFindFileW VerInstallFileW VerLanguageNameW VerQueryValueW VkKeyScanExW VkKeyScanW WNetAddConnection2W WNetAddConnection3W WNetAddConnectionW WNetCancelConnection2W WNetCancelConnectionW WNetConnectionDialog1W WNetDisconnectDialog1W WNetEnumResourceW WNetGetConnectionW WNetGetLastErrorW WNetGetNetworkInformationW WNetGetProviderNameW WNetGetResourceInformationW WNetGetResourceParentW WNetGetUniversalNameW WNetGetUserW WNetOpenEnumW WNetUseConnectionW WaitNamedPipeW WideCharToMultiByte WinHelpW WriteConsoleInputW WriteConsoleOutputCharacterW WriteConsoleOutputW WriteConsoleW WritePrivateProfileSectionW WritePrivateProfileStringW WritePrivateProfileStructW WriteProfileSectionW WriteProfileStringW __FreeAllLibrariesInMsluDll auxGetDevCapsW capCreateCaptureWindowW capGetDriverDescriptionW joyGetDevCapsW lstrcatW lstrcmpW lstrcmpiW lstrcpyW lstrcpynW lstrlenW mciGetDeviceIDW mciGetErrorStringW mciSendCommandW mciSendStringW midiInGetDevCapsW midiInGetErrorTextW midiOutGetDevCapsW midiOutGetErrorTextW mixerGetControlDetailsW mixerGetDevCapsW mixerGetLineControlsW mixerGetLineInfoW mmioInstallIOProcW mmioOpenW mmioRenameW mmioStringToFOURCCW sndPlaySoundW waveInGetDevCapsW waveInGetErrorTextW waveOutGetDevCapsW waveOutGetErrorTextW wsprintfW wvsprintfW

viewer.htm

SHA256 e22c640fb743ed4f898aee780cd7f51380486ccbd798593e999e5b5dc6442551
MD5 79c164f8143e4a53e87a758e82afe3e0
SHA1 9bb5f1f62b2ba8edaef186cba37366d637241c9a
SHA512 d8f49cf262cda54efd815029f78ac0e79db45c67295ed1f30add36a36f6ca3913f983881ac478063e2d94f1ca3e672d6521aae093b439ab873de221cce68f7b0
TLSH
T141312590BAA2EC58C076C9FAEB33D68CE462B0025651C2567D503C57D89DEF81DE6E4C
MD5 SHA1 SHA512 TLSH

polyglot

Sharing

General

Malware Config

Signatures

File Explorer

tmpanfn5x1c.exe

psapi

version

kernel32

user32

advapi32

shell32

shlwapi

wininet

ws2_32

generic

ADVPACK.DLL

ntdll

user32

gdi32

kernel32

advapi32

ole32

version

generic

PI.txt

W95INF16.DLL

W95INF32.DLL

kernel32

user32

generic

active~1.htm

config.xml

data.xml

fngrprnt.dll

msvcr71

kernel32

advapi32

generic

mega.gif

messen~1.xml

msnphoto.scr

advapi32

kernel32

gdi32

user32

ole32

comctl32

generic

msvcr71.dll

kernel32

generic

pi.inf

pibase.dll

msvcr71

kernel32

user32

advapi32

ole32

generic

pidav.dll

msvcr71

kernel32

advapi32

ole32

oleaut32

pibase

wininet

shlwapi

generic

piorg.dll

msvcr71

kernel32

user32

advapi32

gdi32

ole32

oleaut32

gdiplus

shlwapi