XunLei12[.]8[.]1_x64_exe

Sharing

Copy URL Twitter E-mail

General

Target
XunLei12.8.1_x64_exe
Size 118.3MB
Sample260715-d2p2laaz7l
SHA256 e38a77b86f9cead5ce4e3af21c8d6458b567c64e3fc5284161306924dfeb7117
MD5 1db2090f78404da4ede41b1d33ee2300
SHA1 b327dd570b4e1fcaa73a6071551e6fbecb28ced7
SHA512 765ec132d31002b34d332c7c08dae252759058c8c13b5fa70c5856348b86bcee4f6469cb59c48d8b73f191769ce1eacc042509b3a733c0bd7224606b4d693900
SSDEEP 3145728:QUfZ0XaAD8EOXey/FdIdgqghrWVr5IQIOpITrq+0rdfu0be4:0KpHIdLaiViOpSr/ufu0X
TLSH
T1294833408D7BA9D6F0A6C3351D7A36CC296C8C69F4BAC3D740487DB29A72B4261CD4B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
unpack001/C:/cygwin/Bio74/DMPDO/msupd_35107/vhtkjffr.exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XunLei12.8.1_x64_exe

File Explorer

XunLei12.8.1_x64_exe

.exe 118.3MB
$EXEDIR/XunLeiWebSetup12.4.10.3940gw.exe

.exe 7.9MB
C:/cygwin/Bio74/DMPDO/msupd_35107/vhtkjffr.exe

.exe 21.5MB

XunLei12.8.1_x64_exe

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 e38a77b86f9cead5ce4e3af21c8d6458b567c64e3fc5284161306924dfeb7117
MD5 1db2090f78404da4ede41b1d33ee2300
SHA1 b327dd570b4e1fcaa73a6071551e6fbecb28ced7
SHA512 765ec132d31002b34d332c7c08dae252759058c8c13b5fa70c5856348b86bcee4f6469cb59c48d8b73f191769ce1eacc042509b3a733c0bd7224606b4d693900
SSDEEP 3145728:QUfZ0XaAD8EOXey/FdIdgqghrWVr5IQIOpITrq+0rdfu0be4:0KpHIdLaiViOpSr/ufu0X
TLSH
T1294833408D7BA9D6F0A6C3351D7A36CC296C8C69F4BAC3D740487DB29A72B4261CD4B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13925

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$EXEDIR/XunLeiWebSetup12.4.10.3940gw.exe

IMPHASH aeb10b13e6793af559562116a0633d20
SHA256 129ea23ceac5b3f72516552ab32b2142f1dce8b6f14a745e4a866a842ce76870
MD5 43b3b273614c0ebd34d95edc5bf3b89d
SHA1 c73d3d5f0566db0eb20684a098da2354269464a7
SHA512 e7ecbcd3008f2fe11e00d5dd2e7baa718ed04382ae337d008eaa6125628d405db3937def5545403801bf619de610be3ab7418c030dd4ae4795f37b1ac53907e8
SSDEEP 196608:+Hxks/aTODF4wK7zsunLGk5YwHRWcfbQAIxf9IKh:+HxksSTOawhuLGk5JRR0AIx9IM
TLSH
T11E863352B2B2D4F6E19201300AB8D6F6487E7D202B0199EBA3E07D795E747D07A35B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

e4:73:b1:c6:01:aa:d0:68:77:33:67:d6:8c:35:3e:d0:c5:c5:dc:38:bf:aa:55:6d:53:d1:ad:db:ff:30:4f:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440300746612636Q,CN=Shenzhen Xunlei Network Technology Co.\, Ltd.,O=Shenzhen Xunlei Network Technology Co.\, Ltd.,L=Shenzhen,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Mar 2, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

03:b7:b0:b7:ee:03:f3:e8:37:1a:80:95:07:d6:f1:70

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2025 - Jan 10, 2029

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

135393

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\jenkins\workspace\ThunderPC\ThunderPC_AP_CI_Channel\channel\trunk\build\setup\pdb\Release\OnlineInstall.pdb

iphlpapi

GetAdaptersInfo

kernel32

WaitForSingleObject CreateEventW GetExitCodeProcess CreateProcessW GetSystemTime FreeLibrary FreeResource GetModuleFileNameW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW LoadLibraryW GetPrivateProfileStringW SystemTimeToTzSpecificLocalTime VerSetConditionMask GetCommandLineW DecodePointer RaiseException SetLastError InitializeCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection Sleep CreateThread GetCurrentThreadId GetModuleHandleW VerifyVersionInfoW HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetSystemDirectoryW RemoveDirectoryW CreateFileW SetFileAttributesW OutputDebugStringW DeleteFileW MoveFileExW CopyFileW ReadFile WriteFile SetFilePointer CreateFileA CreateDirectoryW WideCharToMultiByte lstrcatA GetFileAttributesA lstrcpyA WritePrivateProfileStringA CreateDirectoryA GetPrivateProfileStringA SetPriorityClass GetCurrentProcess DeviceIoControl GetVolumeInformationA GetVersionExA SetEndOfFile ReadConsoleW FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW LeaveCriticalSection EnterCriticalSection GetLastError CloseHandle GetTempPathW GetLongPathNameW GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW GetEnvironmentVariableW SetEvent FindClose WriteConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind InitializeSListHead GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent IsDebuggerPresent EncodePointer MultiByteToWideChar TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess

user32

MessageBoxW GetMessageW TranslateMessage DispatchMessageW PostThreadMessageW DefWindowProcW CharUpperW CharNextW wsprintfW

advapi32

UnregisterTraceGuids RegCloseKey GetTraceEnableLevel GetTraceLoggerHandle RegDeleteKeyW RegisterTraceGuidsW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW TraceEvent

shell32

SHGetSpecialFolderPathA SHCreateDirectoryExW

ole32

StringFromGUID2 OleInitialize CoUninitialize CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoInitialize CoCreateInstance OleUninitialize CoReleaseServerProcess

oleaut32

LoadTypeLi UnRegisterTypeLi SysAllocString SysFreeString SysStringLen RegisterTypeLi

shlwapi

PathCombineW PathFileExistsW PathIsDirectoryW StrCmpIW PathAppendW PathAddBackslashW

C:/cygwin/Bio74/DMPDO/msupd_35107/vhtkjffr.exe

IMPHASH 924169abab841f45359967e0dcb64dd5
SHA256 55f145ea84d113fa91440da859f65cf1d07de3318770393ade2bdcaa87df6803
MD5 24e29b112bacb13d110d6d56902c6d97
SHA1 22bed2c779cebc805c38b63edfea8a4db3997b43
SHA512 4ba4e05b6c355f87ee4dceb6d0cb3cc17a96137289e38e1375e1a0d92d66006a9bf993abdbed585ccd8a13433e50fd9d340ec1b4b855801f7dd8fccdbfda7803
SSDEEP 393216:jz2PIiAPumhUh9/pDHyz3y9CgBVjFoiHYlw6EPZQLx7e7DSESU0nsx1wpD:3aIiAWeqhjMiTBToiHYSDP2Lx+IQ1wpD
TLSH
T1D837332267F60349F57787358DFC66BBF43AB93BA915C61E4042108A1E32E62C975B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a0:bf:63:83:54:91:4e:f1:52:0c:44:9f:e0:7c:99:47:c3:95:cc:d6:63:63:f8:0e:87:1e:11:90:3e:97:34:28

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=010401039979,CN=LY Corporation,O=LY Corporation,L=Chiyoda-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 4, 2024

SERIALNUMBER=010401039979,CN=LY Corporation,O=LY Corporation,L=Chiyoda-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

SERIALNUMBER=010401039979,CN=LY Corporation,O=LY Corporation,L=Chiyoda-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

PE Signature issue

Digest

21:a9:aa:db:0e:56:e7:1c:4b:67:c9:e7:28:0c:5f:44:9c:3a:dc:34

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=010401039979,CN=LY Corporation,O=LY Corporation,L=Chiyoda-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 4, 2024

SERIALNUMBER=010401039979,CN=LY Corporation,O=LY Corporation,L=Chiyoda-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

SERIALNUMBER=010401039979,CN=LY Corporation,O=LY Corporation,L=Chiyoda-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=010401039979,CN=LY Corporation,O=LY Corporation,L=Chiyoda-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

5f:dd:a5:95:4f:db:2f:00:b1:ef:d5:c8

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 28, 2024 - Mar 29, 2027

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

12992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLastError QueryPerformanceCounter QueryPerformanceFrequency GetProcessHeap HeapCompact Sleep GetCurrentProcessId ExitProcess OpenProcess GetTickCount GetTickCount64 VirtualAlloc VirtualFree GetModuleFileNameW lstrlenW QueryFullProcessImageNameW MoveFileW MoveFileExW CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW ReadConsoleW SetFilePointer GetFileSizeEx CloseHandle GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetConsoleCtrlHandler ReadFile GetFileSize FindNextFileW FindFirstFileW FindClose LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect InitializeCriticalSectionEx IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleMode WriteFile GetLocaleInfoW GetStringTypeW DeleteFileW GetCommandLineW SetFilePointerEx CreateFileW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleHandleExW GetCurrentThread OutputDebugStringW HeapAlloc HeapFree FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType RtlUnwind

user32

GetLastInputInfo LoadStringW GetMessagePos wsprintfW PeekMessageW GetDC SystemParametersInfoW ReleaseDC

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW

ole32

CoUninitialize CoInitialize CoCreateInstance CreateStreamOnHGlobal

oleaut32

SysAllocString SysFreeString VariantInit

shell32

SHGetSpecialFolderPathW CommandLineToArgvW SHGetFileInfoW SHCreateDirectoryExW ShellExecuteExW

gdi32

GetDeviceCaps

version

GetFileVersionInfoSizeW

comctl32

InitCommonControlsEx

crypt32

CryptBinaryToStringW

Name

.text

Size

392KB

Virtual Size

391KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

XunLei12.8.1_x64_exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$EXEDIR/XunLeiWebSetup12.4.10.3940gw.exe

iphlpapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic

C:/cygwin/Bio74/DMPDO/msupd_35107/vhtkjffr.exe

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

shell32

gdi32

version

comctl32

crypt32

generic