a5119a22d48a35c53a90fce66ca15c762eb7c97f23eeac652b81e0a89359a0b8
- SHA256 a5119a22d48a35c53a90fce66ca15c762eb7c97f23eeac652b81e0a89359a0b8
Overview
overview
7Static
static
5PDFConvers...wn.url
windows10-2004-x64
4PDFConvers...wn.url
windows11-ltsc_2024-x64
4PDFConvers...de.pdf
windows10-2004-x64
3PDFConvers...de.pdf
windows11-ltsc_2024-x64
3PDFConvers...en.pdf
windows10-2004-x64
3PDFConvers...en.pdf
windows11-ltsc_2024-x64
3PDFConvers...om.dll
windows10-2004-x64
3PDFConvers...om.dll
windows11-ltsc_2024-x64
3PDFConvers...32.dll
windows10-2004-x64
3PDFConvers...32.dll
windows11-ltsc_2024-x64
3PDFConvers...nv.exe
windows10-2004-x64
3PDFConvers...nv.exe
windows11-ltsc_2024-x64
3PDFConvers...22.dll
windows10-2004-x64
3PDFConvers...22.dll
windows11-ltsc_2024-x64
3PDFConvers...l2.dll
windows10-2004-x64
3PDFConvers...l2.dll
windows11-ltsc_2024-x64
3PDFConvers...cc.dll
windows10-2004-x64
3PDFConvers...cc.dll
windows11-ltsc_2024-x64
3PDFConvers...32.dll
windows10-2004-x64
3PDFConvers...32.dll
windows11-ltsc_2024-x64
3PDFConvers...s6.dll
windows10-2004-x64
3PDFConvers...s6.dll
windows11-ltsc_2024-x64
3PDFConvers...le.exe
windows10-2004-x64
7PDFConvers...le.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
PDFConversa/App/PDFConversa/GnDown.url
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
PDFConversa/App/PDFConversa/GnDown.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
PDFConversa/App/PDFConversa/de.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
PDFConversa/App/PDFConversa/de.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
PDFConversa/App/PDFConversa/en.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
PDFConversa/App/PDFConversa/en.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
PDFConversa/App/PDFConversa/p2wcom.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
PDFConversa/App/PDFConversa/p2wcom.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
PDFConversa/App/PDFConversa/pdc32.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
PDFConversa/App/PDFConversa/pdc32.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
PDFConversa/App/PDFConversa/pdfconv.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
PDFConversa/App/PDFConversa/pdfconv.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
PDFConversa/App/PDFConversa/ter22.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
PDFConversa/App/PDFConversa/ter22.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
PDFConversa/App/PDFConversa/txml2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
PDFConversa/App/PDFConversa/txml2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
PDFConversa/App/PDFConversa/wpcc.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
PDFConversa/App/PDFConversa/wpcc.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
PDFConversa/App/PDFConversa/wps32.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
PDFConversa/App/PDFConversa/wps32.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
PDFConversa/App/PDFConversa/wrs6.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
PDFConversa/App/PDFConversa/wrs6.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
PDFConversa/PDFConversaPortable.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
PDFConversa/PDFConversaPortable.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/UAC.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/execDos.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/execDos.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target a5119a22d48a35c53a90fce66ca15c762eb7c97f23eeac652b81e0a89359a0b8
- Size 7.8MB
- Sample260928-klbbts1vav
- SHA256 a5119a22d48a35c53a90fce66ca15c762eb7c97f23eeac652b81e0a89359a0b8
- MD5 acefa2aaf8e65b91cb448e6468c22c18
- SHA1 ae7c130df66d0521dc2340a7cdc106b20a4fb804
- SHA512 094c70516b1dc373064dff4df72bbfd7f07958816a903c0b231d2e71c7b85ab25a14fc9a07c62c2cecc9488c84f26e7cf2e35dc33311221ac66d4d5d4a2cab89
- SSDEEP 196608:bEiD5t62DypIZfvf92TSXCc9yDuq68hhPWAj:DfZZf9K3U58hhPWAj
- TLSH T1A88633C5EA146328E32C797352F56848F2D6AB1472F2939F191A48DA9FCF970C79013A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Malformed data in PDF
A PDF can contain malformed data to evade detection
- Unsigned PE 17 IoCs
Checks for missing Authenticode signature.
resource unpack001/PDFConversa/App/PDFConversa/p2wcom.dll unpack001/PDFConversa/App/PDFConversa/pdc32.dll unpack001/PDFConversa/App/PDFConversa/pdfconv.exe unpack001/PDFConversa/App/PDFConversa/ter22.dll unpack001/PDFConversa/App/PDFConversa/txml2.dll unpack001/PDFConversa/App/PDFConversa/wpcc.dll unpack001/PDFConversa/App/PDFConversa/wps32.dll unpack001/PDFConversa/App/PDFConversa/wrs6.dll unpack001/PDFConversa/PDFConversaPortable.exe unpack004/$PLUGINSDIR/MoreInfo.dll unpack004/$PLUGINSDIR/System.dll unpack004/$PLUGINSDIR/UAC.dll unpack004/$PLUGINSDIR/execDos.dll unpack004/$PLUGINSDIR/newadvsplash.dll unpack004/$PLUGINSDIR/newtextreplace.dll unpack004/$PLUGINSDIR/nsExec.dll unpack004/$PLUGINSDIR/registry.dll
File Explorer
-
a5119a22d48a35c53a90fce66ca15c762eb7c97f23eeac652b81e0a89359a0b8.zip 7.8MB
-
PDFConversa/App/AppInfo/AppIcon.ico14KB
-
PDFConversa/App/AppInfo/AppInfo.ini203B
-
PDFConversa/App/AppInfo/Launcher/PDFConversaPortable.ini571B
-
PDFConversa/App/PDFConversa/GnDown.url.url 123B
-
PDFConversa/App/PDFConversa/ar.ini16KB
-
PDFConversa/App/PDFConversa/bg.ini15KB
-
PDFConversa/App/PDFConversa/de.ini17KB
-
PDFConversa/App/PDFConversa/de.pdf.pdf 171KB
-
PDFConversa/App/PDFConversa/en.ini16KB
-
PDFConversa/App/PDFConversa/en.pdf.pdf 172KB
-
PDFConversa/App/PDFConversa/es.ini16KB
-
PDFConversa/App/PDFConversa/fr.ini17KB
-
PDFConversa/App/PDFConversa/gr.ini17KB
-
PDFConversa/App/PDFConversa/hu.ini15KB
-
PDFConversa/App/PDFConversa/it.ini17KB
-
PDFConversa/App/PDFConversa/ko.ini12KB
-
PDFConversa/App/PDFConversa/nl.ini15KB
-
PDFConversa/App/PDFConversa/p2wcom.dll.dll 1.5MB
-
PDFConversa/App/PDFConversa/p2wcom.sxs.manifest907B
-
PDFConversa/App/PDFConversa/pdc32.dll.dll 348KB
-
PDFConversa/App/PDFConversa/pdfconv.exe.exe 11.2MB
-
PDFConversa/App/PDFConversa/pl.ini16KB
-
PDFConversa/App/PDFConversa/pt.ini16KB
-
PDFConversa/App/PDFConversa/ru.ini15KB
-
PDFConversa/App/PDFConversa/sl.ini16KB
-
PDFConversa/App/PDFConversa/ter22.dll.dll 1.8MB
-
PDFConversa/App/PDFConversa/tr.ini16KB
-
PDFConversa/App/PDFConversa/txml2.dll.dll 92KB
-
PDFConversa/App/PDFConversa/wpcc.dll.dll 44KB
-
PDFConversa/App/PDFConversa/wps32.dll.dll 144KB
-
PDFConversa/App/PDFConversa/wrs6.dll.dll 360KB
-
PDFConversa/Data/settings/PDF ConversaSettings.ini389B
-
PDFConversa/Data/settings/PDFConversa.reg676B
-
PDFConversa/PDFConversaPortable.exe.exe 142KB
-
$PLUGINSDIR/MoreInfo.dll.dll 7KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/UAC.dll.dll 13KB
-
$PLUGINSDIR/execDos.dll.dll 5KB
-
$PLUGINSDIR/newadvsplash.dll.dll 8KB
-
$PLUGINSDIR/newtextreplace.dll.dll 11KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
$PLUGINSDIR/registry.dll.dll 29KB
PDFConversa/App/AppInfo/AppIcon.ico
- SHA256 17456aca8067833b22634bb673dde5aaefbadb92f5d37949f3459b795d0d4db1
- MD5 bf4bdde72f8bdebdfc4d9cf29eaadade
- SHA1 08580404f4495e953707b8e7dd00913355ed2787
- SHA512 aabb09df3ea28609e920d25208807385e61a7e808a1d4d6d5ac314d195a97c5153f80e1b41893a220ac451c96533511e6032736060d4be122ae6fefc5a3bf7a0
- SSDEEP 192:jquXgnd5U6W3DtGPG0HKQwydeF0CqO4eFFMucmU:je3U6MD1htF0/O4Ucx
- TLSH T19A6209036F954F5BC904AF30B4E3A3F2F238DCE17E16872791586A6B3D712A8A467474
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/AppInfo/AppInfo.ini
- SHA256 c6ba49eb6e149e0b842b6b19fea0febb94f105772907fb537f7ba61c0aec3b8d
- MD5 943abe12298ca660bea81c4070f8c20b
- SHA1 f7802639f6f199f1876067e864c9cd205cf5d337
- SHA512 1029865c0975e5a884085cbb64522e4481b0480f3549a137b9662f2c4bbcf4d05117bfb89619fe5f6996f6e6ca59bd270545318db0204e4ca4897b0e25b23ea1
- TLSH T198D0220D0E801A3DD21CA20C613A3C80F3A6E3220749E21C30863E080242D0C016A9F8
- MD5 SHA1 SHA512 TLSH
PDFConversa/App/AppInfo/Launcher/PDFConversaPortable.ini
- SHA256 622ad533899671d5139b48152c1b89261ceee59e1f81685794523d79c417fa85
- MD5 cff3d10c03f90297c849f378a1a75b24
- SHA1 26f236797d4874993527f638c700e1877450b218
- SHA512 bca52e9d60536d410c87a6d17cd091a07173591fd0fc2c54fa4f46368538a4effa0112e87714b5a11748587a3935adba3e77dde8f99c24d102f32452f419408b
- TLSH T15BF0C03E7A83B33FA1929A543199374407470DEB97D138C571836348DC086CC127A7FA
- MD5 SHA1 SHA512 TLSH
PDFConversa/App/PDFConversa/GnDown.url
- SHA256 0b74409f68f0790962e718c2273a828e4b043554a2674702ea69618404eecadb
- MD5 1a237390ce695d9760e2dc0abdb81d92
- SHA1 c48d87fbcaf3d7e30569ac4219756d5b4c57277e
- SHA512 dbd033b7331148ff9cd27f5444a9f8d5504fd2e20b73543f6ab3b7687ab03ff13b13fab8c141972b99bc1d3ead02b26cef6e81ec057667cea4f10874acffeb2d
- TLSH T1AAB012BE4507C38BD381A50A60B0F9099C0F79A48CD2D0DC6658DECF1C880D3D458BB6
- MD5 SHA1 SHA512 TLSH
PDFConversa/App/PDFConversa/ar.ini
- SHA256 05a52ec00f545d83b0a0987625db1a3fcb91144bb048e4faf9902bb4bf2a6629
- MD5 fccbf70da40e37ab957276117f17da93
- SHA1 d30642cc0c7bac1638121ba384903d813a45ef62
- SHA512 c4565497abdaf8b0b242d2137c06390b73c0359342b04837acbf91b277bc0554b1f470245bcc1a76c6bd79030aaaac0b7cc17e6907f345c4619437d203056631
- SSDEEP 384:bdAkULcbgQD/0Nhgc4GY8TA05kA8uogqgg8gWwi/o4p/4EoJow8:RRidQQUcGF05kpuouEA/rwxWJ
- TLSH T16F7212121BACC538F1F39680E6B6C463533BBCB619B9E13E21AD050D83EA914514B7FB
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/bg.ini
- SHA256 fe3d119d14aeefb77e3854c5c4d9e6e552cb916d8a77be1f8394b3d8ee280923
- MD5 861f38c86749fa5cb6f3c56b995573c7
- SHA1 8039018878b21efe394c1c2b0b94dc6de3cf4aa0
- SHA512 d3d675164bbc0737f75edebf14fb45e1b77a45769c1eed7bd415092123145435dae1fb1bf8b970f488c6777181378bd1b33054b838e0b63aba2d1b79c698278f
- SSDEEP 192:LHapmE84264I0gfvK+uOMiTEkmZUrZnoXOW/qqX7sz0U3i1jJowSmUKq:raz8426qYEkmZUrZoxpX7s7wjJow8
- TLSH T11272060F67FC8514F2B2D6809F7A84E15279BE712739C19E618B280DD0E8A3573527EB
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/de.ini
- SHA256 d74aaa3fb95227fca5c6d58e46017cdce763b0e6ae5f9fd628fdcae91ad1901e
- MD5 abd1c92668ce04aedfe0c957006571e0
- SHA1 de06877fc5d0dc1ca2effa4b0ce4a7dcfb0b51cd
- SHA512 72cdc519a49938855ee36cd75fa88c4fbf274b52269741f89efd0d3729281edd0b40a7a50a3fececb3a6e31aa07ff326d1f22effe1ad94c955eaca9992b6d701
- SSDEEP 384:h19xH6np//iG6kWo39NVRV9hzb89HZZzo/M:h19xH6np//V6do39NVRV95bUHZS/M
- TLSH T1C382B11323FD4A58F2F3ABC4EFB985605B36FCF66979D52E2180010D94B0E0595A2B77
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/de.pdf
- SHA256 681e9305d643d4476aa3d8379f10c8740387f6f452d8b5881791deb029a809dd
- MD5 5d71ac4b791af522e25067872c00a9de
- SHA1 b479e04cdb22dc83307589a3349e5d544ef93807
- SHA512 7c207c8bcfe7a393d5c99063f1549076627c83c2771b81b4acea2e5ea3545bff2c3b463be6f7e7d2ee9414fd8663446aee187c72a3549419bef738829cfeefed
- SSDEEP 3072:HwQElP5apfoQMEFCsQ84MzG0N6OP1BOjLCcyc2o523HCP9fWo1rJ5ddzuW2Zn:HXElwpfJMEkgzG0QiBO/Ccy4N8or3dzC
- TLSH T1CB04E06DC0C69EDDD185EBC25BB5E8D6828FF39362C4A45214BC4AC387E0E9CE5D3912
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/en.ini
- SHA256 586a4cca5745a5d726a5f59d727bf44d1ffaf337e9cdbb1f5656835fde8a895c
- MD5 d995f2f59080647b70daff4b11c2a653
- SHA1 94a7b4de228b4c00c7a660dabbb1364eb9bea4ae
- SHA512 933992a324ec5a478e6a8af43b87f6bc995a4a3c0d1e50fa06f0d632ffddcbb671e6e494bc43cb0b517a418db8f1221a1e20ef8f28f0a91eed5e75aedff18dc4
- SSDEEP 384:v1tb+SJPAhCODVL34VN7UtKlGhPp6Jow8:v1tb+SJohCODVL34VN70KlGhPp6WJ
- TLSH T13F729E1363FD0514F2F3BBD0EBBE95604A3AFCB66939D56E2081010E98B0F1599A2777
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/en.pdf
- SHA256 388783c5b1ecb4d02f2e731ae0cde57ec74069dfa8102e7a68395cef208da006
- MD5 1aac5923a153e4f312eaddf40c40dd8f
- SHA1 bced64533b77690c35ac8ea173c6b7c54bce99b0
- SHA512 75863691f76cf185e8a366f4e29fb154d487d823c6aa077dbd7bef327a5caf36c0a465bcd440f95660fd1ad8801d3baeff0ac178d318f6f4410e591a5400d87c
- SSDEEP 3072:IhYzb5+njyExIARR/EtpgWW5rpa7VAusMjKJXnq1g1NbW2e22V:2UbUnjyBQR/AW5FsVvsMjGqglW2eFV
- TLSH T1C704F17D94C5AEEED187B7C3AF7EE961824DB35376C8900024AD8BC352B1E8CE693541
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/es.ini
- SHA256 265f48ddc44fd9a3c91f126ee9ff3831d02fded195e37abd7fe37a4dfa4b5cca
- MD5 df0b7b30f9346cc48270911055ecd837
- SHA1 a9054c9d720b7a79712e4512086a376162737a20
- SHA512 3f81e55563716f50f66c6f48ee6c9df40ba57140714f4ccc13c3a8289954484d09136eee2939a5ab6cb28d099a6024bf9685c99a16f06587509d4f3663973688
- SSDEEP 192:LQHQiCYAxAnsUW0I7HIisWaonCwC+p99XeroVV0U1tKyD2PA:sHQiFAxAnDqIPWaonCwCi3uro3iyDF
- TLSH T15772C11323FD5614F2F3ABC4EB7E54608A3AFCB66D39D52E2190110DD8B0E0599A2B77
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/fr.ini
- SHA256 2242599fcb829a4ff4be61fece746aaec1615fc9b776e7eab290f1b5ed5ca7ab
- MD5 803db73f816725e8676894217f015369
- SHA1 1cb5fa94c2f5d1079d97d0d2b2f4770ac5170280
- SHA512 c63a7821dc88882e47d87354b720517915f84a417c480e6296befdbce8c952fec34a33cda0572865a94867f1d3d9f6a2915de4872e2255f50f897730ff910915
- SSDEEP 384:8DtWnB7v1D1SPoxCsth/2N2TmTFoh6Jow8:8DtWB7v18PoxCsth/2N26TFoh6WJ
- TLSH T15782AF1323FD4614F2F3BBC1EABE54604A3AFCF66D39D52E2180010E98B0E5599A2777
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/gr.ini
- SHA256 93f11fbb2af6f9e21cfd30b459de9eace90e6014cdccbd49542c09a40e767ed6
- MD5 72308edc7d68a88ef7a68ab8444359dc
- SHA1 275cff68eba7adad368790290c98ecdd169e148a
- SHA512 3e2f46390bdac9df0edeb0ad75b6937270a2ed68f05e4c5aab185e7a2a6d765ab114fb11c4a4f5c696a3e726a129381df8ebfc6ef6bfa0ba60f100866be4feaf
- SSDEEP 384:9qOxPCnhkuED5cqCtmCnVLNHPgktUC4OxPCypfgLcFSBDoQzcxC9BAqKBRfwgLYp:QOJSkzePgcUC4OJCkgLcFSBDosck9skV
- TLSH T12F72F55F1BFF0611FAB2AAF1967A84614B3EFCB61824D92E71E5100DD4ACD0548C3B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/hu.ini
- SHA256 e95593b2b7fd89c7800ed7d63f05e92de6e98e6a8dcbd5f0b1b2de7038bb37e6
- MD5 504922b80969f9e22aeb0e27e16d635a
- SHA1 40faeda3cbc69b54cccb88942cd1de09b2f1dcd5
- SHA512 1fea25fd5bb1fafcfd99940a76f4aaa489c2496b69e475cffb6e340e930bdfdf9d60613b0bafcba4ca51c731d956e2067fbedc9ca3655507d6ae34f53bcc1c39
- SSDEEP 384:8n2d0wzvVWkq+rEbl243TUzk9UUjz0O3RcwnAwJow8:EQ0wzvV6+rQl243TUg9Njz0OWwnAwWJ
- TLSH T10B72901323FC1554F2F39BC1FABA85A04A3AFCB6693DC52EA080110DD9B4E45D5A2B77
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/it.ini
- SHA256 e54094192df60d931356d4626d2ee22716b032855613b795e5d5a023e986746f
- MD5 f6b8e9f6bf39fb08bf6be3b744ec8c21
- SHA1 0f55356e679848680be949e6cdbbd415af0da55d
- SHA512 f9b5da678342e0690b5adbeb75b5b9a67617bf5fa83a4849ed2e96ff3713666f8c4277a191b8d47550590b04547eec7eb1e778613edc0aabd80830d10bc0adfd
- SSDEEP 384:Ipuei/ZpQlYapN1I3H+PB++Czew0xrJow8:Ouei/nQ53I3H+PB++Czew0xrWJ
- TLSH T1EC72B21323FD0614F2F3BBC0EB7E95608A3AFCB66D39D12E2191014D98B0E5599A2777
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/ko.ini
- SHA256 69a833afe2f2b385a2a76e7a37677eccce7a073dcdee76ccfe2f5149c12d2399
- MD5 f5c44edf7c5733b81d6d5be988bf956e
- SHA1 6f03dd6effbbcefb7de7b812c7c63b03d8bd1957
- SHA512 422355f44d7df5d3276fc9c70f95ea89c42975024c212c09c2f78f48684baabd6970d2f377dd33d1cec6dcbd7fd44bad8f4ddc0512bab2925a307209fc79e238
- SSDEEP 384:7hF92qgAKTk/A0fmQp1a/j3eSqWEcPwFYb5QX9KA4W4a4f6VtEWMiLX4Z467rv:77dKTXreSqWEcPqJLb67L
- TLSH T1C142041727FD4954F2B3A6C0E7BB84A18239FCB6293AD52E2085010DD5F1E096593BBF
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/nl.ini
- SHA256 e7e8efb752365bbfe2984df3b3f14e89448d51f90fb9cb8f0097c30b967d51f1
- MD5 2ab7b4fc2e4f5e530794bb7cd9c7b81f
- SHA1 a0eba2321edef5cdd9afc374a6e8c7f67d650e84
- SHA512 abd124520040eaf4746c0192682983e5ad5aa041c4ecd3a587337b436ba71f6325cedbe69992e9c1bfaa6cf2e1811e75f77b0a99860e6e4630d60f2443ad599b
- SSDEEP 384:cTtej9DhjnwjhFv6JCHc+cKauy8ok7N+XHzuHFOJow8:cTtej5hLwjzv6JC8zKauy8ok7N+XHzuz
- TLSH T1FC72921333FD0918F2F3ABC1EBBA94608B7AFCB66975D52E2180010DD8B0E5595A2777
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/p2wcom.dll
- IMPHASH ba25d4161b1a852b3ebee45b99adb732
- SHA256 88a7de0634cf9e7291270f8d7fb0a0ff4ebbf45259148c677e02c52bd69d3877
- MD5 f2e0fef3799a51b2df2f01af6644b7e1
- SHA1 f88855371cf0b38206de17fd3313fea7c1a92fad
- SHA512 3fc28286ab0a48063b958c80c0b66284faf7a2769ab6eb700ccfe3a6c565b4c07a3ac3fc80f9f0055f848a7a96815897df8280153be30234b4ada9c32f8f9a51
- SSDEEP 24576:rpUpPrYf+4G72ZiaNlZeG/Pq0CYeCLQ8lZ4sFL9Hz+sl:1UpEfIqWG/PqbYdZ4sFhHzbl
- TLSH T13F757D10D743C126E89F05B599FFD66D366876710F2400DBB3C46EF9AE295E23A3122B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
983020
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadResource
FindResourceExA
EnterCriticalSection
LeaveCriticalSection
SetThreadLocale
GetThreadLocale
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExA
GetCurrentDirectoryA
GetFullPathNameA
GetFileAttributesA
FindFirstFileA
FindClose
FindNextFileA
LoadLibraryA
GetLocalTime
Sleep
lstrcpyA
GetVersionExA
LockResource
CreateFileA
GetTempFileNameA
GetTempPathA
FormatMessageA
WaitForSingleObject
CreateFileW
CreateProcessA
GetExitCodeProcess
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
SizeofResource
FindResourceA
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
MultiByteToWideChar
RaiseException
DeleteFileA
lstrcmpiA
IsDBCSLeadByte
GetLastError
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
lstrlenA
CloseHandle
lstrlenW
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
SetStdHandle
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetEndOfFile
FlushFileBuffers
SetFilePointer
ReadFile
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
GetModuleFileNameW
GetStartupInfoA
SetHandleCount
IsValidCodePage
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
IsDebuggerPresent
DebugBreak
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ExitProcess
GetCurrentThreadId
GetCommandLineA
GetSystemTimeAsFileTime
SetEnvironmentVariableA
GetFileType
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
VirtualFree
HeapCreate
WriteFile
GetStdHandle
GetACP
GetOEMCP
user32
GetDC
ReleaseDC
LoadStringA
CharNextW
CharNextA
gdi32
SelectObject
SetMapMode
SetTextCharacterExtra
GetTextExtentPoint32A
GetDeviceCaps
DeleteObject
CreateFontIndirectA
advapi32
RegDeleteValueA
RegQueryInfoKeyA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
shell32
SHGetFileInfoA
ole32
CoTaskMemFree
StringFromCLSID
ProgIDFromCLSID
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoInitialize
CoUninitialize
CoTaskMemAlloc
oleaut32
UnRegisterTypeLi
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
GetErrorInfo
VariantChangeType
VariantCopy
VariantClear
VariantInit
CreateErrorInfo
SysAllocString
SysStringLen
VarUI4FromStr
SysFreeString
SetErrorInfo
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
242KB
Virtual Size
241KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
121KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=51, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=185, id=1, productName=Unmarked objects,
count=221, id=131, productName=VS2008 build 21022, version=21022,
count=161, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
PDFConversa/App/PDFConversa/p2wcom.sxs.manifest
- SHA256 18be742511616ec49bca182435d839f1a2f1fd81ed68068037fb80cc6e70f7e0
- MD5 2193e39be0d0ea557c7e0d2b8f09e3c2
- SHA1 de60c78dd16b711ba9794990ec6e68757b9f6a52
- SHA512 27eeb471eb75987be3c031355deddf0942598e800e50df66dc267e3ba64768171d20e3297708274f1ecd81ab88352f478f44326fd8752216b9644596e5a54b02
- TLSH T1FF118040854A2C51DD70C7414D67B005E22C339B08D9429E79AD91CBBF334E389C1A5D
- MD5 SHA1 SHA512 TLSH
PDFConversa/App/PDFConversa/pdc32.dll
- IMPHASH 56a2590352b9a444d350829f59cb69ae
- SHA256 ed00a76486bf4b644186f2ea83559392d6a5c30beeae2674f4d56fb1f679c364
- MD5 1e2c7829fac8f5c3f02d5d46c164a908
- SHA1 4e8e9bafa543dc15d88542f2c026b7d87cb537b0
- SHA512 0e381fefbac7ea9937a76df4a5d1b1d8d899bc7332c40684a9a57625f437b2457b57959f3e2d42241824026fe7da4018b6f197b970a25d78f0ed0eae218f984f
- SSDEEP 6144:pW7XdRfaysRqCSLDxDn4ySae+TqvXKxf0xIZ2fA0Y:pW7XdRCKBL4DaervKxf0xqoY
- TLSH T105747C02E521E035C4A301FE417A927E9F746FB62345B2D763DCDE99BB212F46A32907
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
203613
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
K:\pdc\PDC32.pdb
kernel32
GetCurrentProcessId
SetStdHandle
SetConsoleCtrlHandler
RaiseException
VirtualProtect
GetSystemInfo
FlushFileBuffers
GetLocaleInfoW
CompareStringA
CompareStringW
IsBadReadPtr
_hread
SetErrorMode
GetModuleFileNameA
ReadFile
GetLastError
SetFilePointer
lstrlenW
GetLocalTime
LoadLibraryA
GetProcAddress
FreeLibrary
WriteFile
CreateFileA
GetCPInfo
lstrlenA
GetVersion
GlobalFree
QueryPerformanceCounter
LCMapStringW
LCMapStringA
HeapSize
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcatA
lstrcmpiA
lstrcpyA
CloseHandle
MulDiv
GetTickCount
GetCurrentThreadId
GetCommandLineA
GetVersionExA
DeleteFileA
HeapReAlloc
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualAlloc
IsBadWritePtr
GetTimeZoneInformation
GetACP
GetOEMCP
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
SetEnvironmentVariableA
advapi32
RegQueryValueExA
RegOpenKeyExA
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptGetKeyParam
CryptImportKey
CryptAcquireContextA
RegCreateKeyExA
RegSetValueExA
CryptHashData
CryptSignHashA
CryptDestroyHash
RegCloseKey
user32
ReleaseDC
GetDC
wsprintfA
FillRect
MessageBoxA
wvsprintfA
SendMessageA
GetWindow
FindWindowA
wvsprintfW
gdi32
GetObjectA
GetCharWidthW
CreateFontIndirectA
GetTextMetricsA
GetTextAlign
GetArcDirection
GetDIBits
BitBlt
SetDIBits
CreateBitmap
GetPixel
GetPolyFillMode
GetFontData
EnumFontFamiliesExA
GetCharWidthA
CreateCompatibleBitmap
DPtoLP
GetTextExtentPointW
GetCharacterPlacementW
GetTextFaceA
LPtoDP
GetBkColor
GetBkMode
GetTextColor
GetWindowExtEx
GetViewportExtEx
GetWorldTransform
CreateRectRgn
GetDeviceCaps
CreateEnhMetaFileA
DeleteObject
DeleteEnhMetaFile
EnumEnhMetaFile
GetStockObject
SelectObject
CreateCompatibleDC
CloseEnhMetaFile
PlayEnhMetaFileRecord
GetPath
GetRegionData
GetClipRgn
CreateDIBSection
usp10
ScriptStringFree
ScriptFreeCache
ScriptString_pSize
ScriptPlace
ScriptShape
ScriptItemize
ScriptStringCPtoX
ScriptStringGetOrder
ScriptStringGetLogicalWidths
ScriptStringAnalyse
crypt32
CertFreeCertificateContext
CryptAcquireCertificatePrivateKey
CertFindCertificateInStore
CertOpenStore
CertFreeCertificateChain
CryptSignMessage
CertGetCertificateChain
CertCloseStore
EnhMetaFileProc
PdcAbortDoc
PdcAbortPage
PdcEmbedFile
PdcEndDoc
PdcEndDoc2
PdcEndPage
PdcEnumFontFamiliesEx
PdcGetData
PdcGetLastMessage
PdcHandleToStr
PdcHandleToStrInChunks
PdcNewTEDoc
PdcResetLastMessage
PdcSaveFile
PdcSetFlags
PdcSetHlinkBase
PdcSetPictQuality
PdcStartDoc
PdcStartDoc2
PdcStartDoc3
PdcStartPage
PdcStrToHandle
PdcStrToHandleInChunks
WEP
Name
.text
Size
272KB
Virtual Size
271KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=4, id=105, version=2067,
count=34, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=11, id=93, version=2179,
count=180, id=1, productName=Unmarked objects,
count=117, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
PDFConversa/App/PDFConversa/pdfconv.exe
- IMPHASH 1845765d627445c8cb8cdcfbe2807dda
- SHA256 0163008326fab1612472eddb5fc3dc7f867c8bff6be3e1afcf3d341be40d82fc
- MD5 10bb2d9e226970e39e77145428773f91
- SHA1 aa17ff646b5d19ee02477280fc02b812092d2e3b
- SHA512 48ac1b3649d232f2da79f69987b1572144cbc6a0bc43418276e0db5e4bd1b81531b7cbcd9dae62e6f99fc0730836c322cfe3e6338dc0a49d1aafb24a2768acb7
- SSDEEP 196608:3zcuV6wIHQmklbKTLezC3orEotl48DueJO475:DcusNQmklWTLC+OT/aO
- TLSH T1DBC64B0DA502F537F802FA39841B939A7A7BB1E8EA10C94FEF54DDBC2E313512919647
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
5942136
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
GetErrorInfo
GetActiveObject
VariantInit
SysFreeString
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
VariantChangeTypeEx
VariantClear
SysFreeString
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
RegUnLoadKeyW
RegSetValueExA
RegSetValueExW
RegSetValueW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExA
RegQueryValueExW
RegQueryInfoKeyA
RegQueryInfoKeyW
RegOpenKeyExA
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyA
RegEnumKeyExW
RegDeleteValueA
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExA
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
InitializeSecurityDescriptor
GetUserNameA
GetUserNameW
GetTokenInformation
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
user32
LoadStringW
MessageBoxA
CharNextW
CreateWindowExA
CreateWindowExW
wvsprintfA
WindowFromPoint
WaitMessage
ValidateRect
UpdateWindow
UnregisterClassA
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
TabbedTextOutW
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCaret
SetWindowRgn
SetWindowsHookExW
SetWindowTextA
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetWindowLongA
SetWindowLongW
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRectEmpty
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetKeyboardState
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetClassLongW
SetCaretPos
SetCapture
SetActiveWindow
SendMessageTimeoutA
SendMessageA
SendMessageW
ScrollWindowEx
ScrollWindow
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassA
RegisterClassW
RedrawWindow
PtInRect
PostThreadMessageA
PostThreadMessageW
PostQuitMessage
PostMessageA
PostMessageW
PeekMessageA
PeekMessageW
OpenClipboard
OffsetRect
NotifyWinEvent
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxA
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadImageA
LoadImageW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageA
IsDialogMessageW
IsClipboardFormatAvailable
IsChild
IsCharAlphaNumericW
IsCharAlphaW
InvalidateRect
InsertMenuItemW
InsertMenuW
InflateRect
HideCaret
GetWindowThreadProcessId
GetWindowTextLengthW
GetWindowTextA
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowLongA
GetWindowLongW
GetWindowDC
GetTopWindow
GetTabbedTextExtentW
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropW
GetParent
GetWindow
GetMessageTime
GetMessagePos
GetMessageExtraInfo
GetMessageA
GetMessageW
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDoubleClickTime
GetDlgItem
GetDlgCtrlID
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameA
GetClassNameW
GetClassLongW
GetClassInfoW
GetCaretPos
GetCapture
GetAsyncKeyState
GetActiveWindow
FrameRect
FindWindowExW
FindWindowA
FindWindowW
FillRect
ExitWindowsEx
EnumWindows
EnumThreadWindows
EnumClipboardFormats
EnumChildWindows
EndPaint
EndMenu
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextExW
DrawTextA
DrawTextW
DrawStateW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DestroyCaret
DeleteMenu
DefWindowProcA
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
CreateCaret
CreateAcceleratorTableW
CountClipboardFormats
CopyIcon
CloseClipboard
ClientToScreen
ChildWindowFromPoint
CheckMenuItem
CharUpperBuffW
CharUpperW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcA
CallWindowProcW
CallNextHookEx
BringWindowToTop
BeginPaint
AttachThreadInput
AdjustWindowRectEx
ActivateKeyboardLayout
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
kernel32
lstrcmpiA
LoadLibraryA
LocalFree
LocalAlloc
Sleep
VirtualFree
VirtualAlloc
SwitchToThread
GetACP
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
IsValidLocale
GetSystemDefaultUILanguage
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetUserDefaultUILanguage
GetLocaleInfoW
GetLastError
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringW
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateFileW
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
lstrlenW
lstrcmpiW
lstrcmpA
lstrcmpW
WritePrivateProfileStringW
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
UnmapViewOfFile
TryEnterCriticalSection
TerminateThread
TerminateProcess
SystemTimeToFileTime
SwitchToThread
SuspendThread
Sleep
SizeofResource
SetUnhandledExceptionFilter
SetThreadPriority
SetThreadLocale
SetLastError
SetFilePointer
SetFileAttributesA
SetFileAttributesW
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
RemoveDirectoryA
RemoveDirectoryW
ReleaseMutex
ReadProcessMemory
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
IsDebuggerPresent
OpenProcess
OpenFileMappingA
OpenFileMappingW
MultiByteToWideChar
MulDiv
MoveFileW
MapViewOfFile
LockResource
LocalSize
LocalFree
LocalFileTimeToFileTime
LocalAlloc
LoadResource
LoadLibraryExA
LoadLibraryA
LoadLibraryW
LeaveCriticalSection
IsValidLocale
IsBadReadPtr
InitializeCriticalSection
GlobalUnlock
GlobalSize
GlobalMemoryStatus
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetWindowsDirectoryA
GetWindowsDirectoryW
GetVersionExA
GetVersionExW
GetVersion
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetThreadContext
GetTempPathA
GetTempPathW
GetTempFileNameW
GetSystemTimeAsFileTime
GetSystemTime
GetSystemDirectoryW
GetSystemDefaultLangID
GetStdHandle
GetProcAddress
GetPrivateProfileStringW
GetPriorityClass
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW
GetLocaleInfoA
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileTime
GetFileSize
GetFileAttributesA
GetFileAttributesW
GetExitCodeThread
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryA
GetCurrentDirectoryW
GetComputerNameA
GetComputerNameW
GetCommandLineA
GetCommandLineW
GetCPInfoExW
GetCPInfo
GetACP
FreeResource
InterlockedIncrement
InterlockedExchangeAdd
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
FreeLibrary
FormatMessageA
FormatMessageW
FlushInstructionCache
FlushFileBuffers
FindResourceA
FindResourceW
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
ExitThread
ExitProcess
EnumSystemLocalesW
EnumCalendarInfoW
EnterCriticalSection
DuplicateHandle
DeleteFileA
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessA
CreateProcessW
CreatePipe
CreateMutexA
CreateMutexW
CreateFileMappingA
CreateFileMappingW
CreateFileA
CreateFileW
CreateEventA
CreateEventW
CreateDirectoryA
CreateDirectoryW
CopyFileA
CopyFileW
CompareStringA
CompareStringW
CloseHandle
Beep
RtlUnwind
Sleep
MulDiv
msimg32
AlphaBlend
gdi32
UnrealizeObject
TextOutA
TextOutW
StrokePath
StrokeAndFillPath
StretchDIBits
StretchBlt
StartPage
StartDocA
StartDocW
SetWindowOrgEx
SetWindowExtEx
SetWinMetaFileBits
SetViewportOrgEx
SetViewportExtEx
SetTextColor
SetTextAlign
SetStretchBltMode
SetROP2
SetPixel
SetPaletteEntries
SetMapMode
SetICMMode
SetEnhMetaFileBits
SetDIBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SelectClipRgn
SaveDC
RoundRect
RestoreDC
ResizePalette
RemoveFontResourceW
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyPolyline
PolyBezierTo
PolyBezier
PlayEnhMetaFile
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetViewportOrgEx
GetTextMetricsA
GetTextMetricsW
GetTextFaceA
GetTextFaceW
GetTextExtentPointW
GetTextExtentPoint32A
GetTextExtentPoint32W
GetTextColor
GetTextAlign
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetOutlineTextMetricsA
GetOutlineTextMetricsW
GetObjectW
GetNearestPaletteIndex
GetNearestColor
GetMapMode
GetKerningPairs
GetGlyphOutlineW
GetGlyphIndicesA
GetGlyphIndicesW
GetFontLanguageInfo
GetFontData
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentPositionEx
GetClipBox
GetCharWidthW
GetCharWidth32W
GetBrushOrgEx
GetBkColor
GetBitmapBits
GdiFlush
FrameRgn
FillPath
ExtTextOutW
ExtFloodFill
ExtEscape
ExtCreatePen
ExcludeClipRect
EnumFontsW
EnumFontFamiliesExA
EnumFontFamiliesExW
EnumEnhMetaFile
EndPath
EndPage
EndDoc
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateScalableFontResourceW
CreateRectRgnIndirect
CreateRectRgn
CreatePenIndirect
CreatePen
CreatePalette
CreateICW
CreateHalftonePalette
CreateFontIndirectW
CreateFontA
CreateFontW
CreateEnhMetaFileW
CreateDIBitmap
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
CombineTransform
CombineRgn
CloseFigure
CloseEnhMetaFile
Chord
BitBlt
BeginPath
ArcTo
Arc
AngleArc
AddFontResourceW
AbortDoc
version
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoW
ole32
CreateStreamOnHGlobal
OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
StringFromGUID2
CLSIDFromProgID
ProgIDFromCLSID
CLSIDFromString
StringFromCLSID
CoCreateInstance
CoUninitialize
CoInitialize
IsEqualGUID
OleUninitialize
OleInitialize
CoTaskMemFree
CLSIDFromProgID
CLSIDFromString
StringFromCLSID
CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
IsEqualGUID
CoCreateGuid
comctl32
InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Copy
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_SetOverlayImage
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControls
shell32
ShellExecuteExA
ShellExecuteA
ShellExecuteW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetMalloc
wininet
InternetGetConnectedState
InternetReadFile
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpSendRequestW
HttpQueryInfoW
HttpOpenRequestA
comdlg32
PrintDlgW
GetSaveFileNameA
GetSaveFileNameW
GetOpenFileNameW
wsock32
WSACleanup
WSAStartup
WSAGetLastError
gethostbyname
socket
setsockopt
sendto
send
select
recvfrom
recv
ioctlsocket
inet_addr
htons
connect
closesocket
bind
winspool.drv
SetJobA
OpenPrinterA
OpenPrinterW
GetJobA
EnumPrintersW
DocumentPropertiesW
DeviceCapabilitiesA
DeviceCapabilitiesW
ClosePrinter
GetDefaultPrinterW
GetDefaultPrinterW
winmm
timeSetEvent
timeKillEvent
timeGetTime
sndPlaySoundW
PlaySoundW
crypt32
CryptSignMessage
CertGetCertificateContextProperty
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
PFXImportCertStore
PFXIsPFXBlob
fontsub
CreateFontPackage
oleacc
LresultFromObject
gdiplus
GdiplusShutdown
GdiplusStartup
wps32
WpsSetBoolProp
WpsSetNumProp
WpsSetTextProp
WpsSetLicenseInfo
WpsConvertFile
WpsSetFlags
WpsEndSession
WpsNewSession
madTraceProcess
Name
.text
Size
5.7MB
Virtual Size
5.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
195KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
34KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
604B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
356KB
Virtual Size
356KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
PDFConversa/App/PDFConversa/pl.ini
- SHA256 a10ac98198cb647920cedbc230445d2e8f4db097fc2d2b1f6fc7d8d7fa2f7573
- MD5 e177f9813f02af014d53d4d6d66ac3db
- SHA1 3e61b2d5dcf09566ca0e0094208e21e98bf46fc4
- SHA512 a7ef6f85bc094278f2d39593a556ad6813bd6fabb6b6308f2f0b16339f42c82c3e10d39dc861fb3c2b800124ae1ffed08cbd7f376667b32855e3c71313ba66dd
- SSDEEP 384:h6tgCiDdW/IsjUERr2jL+KpkPNAx6EpCD/mPzczJow8:h6tgzDdW/djU4r2jiEkPNAx3pCD/mbcC
- TLSH T1DF72A21323FC0554F2F3AFC5EBBAA5A08B3AFC766A39D16F2080010D95B0E55A562777
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/pt.ini
- SHA256 35cb6579063d42764015e3111f5ecf2c810f256c2cfe9c697f77568cd76b316e
- MD5 1d9480875014c85a5da6a2b646811cd9
- SHA1 8a49f9c545d29fa6d7a16728f00e1e8fa18c95f7
- SHA512 74c7b782358e86913d2b776408e178c30d7c79d97ae6856095faca2f6c045971c737cc6c460387626453f42c73ee6c029cc669effe8240a5a555ffbca69a31f7
- SSDEEP 192:LZ8uLdS78V+3eMJqCWZH5qRR+ijOxI19merl7Kb2gXeXK9mPYylUAZ7X6JowSmUJ:V8uLU8V+35I7oOxI18erl7sOZ4I6Jow8
- TLSH T1F472B01363FC1614F2F3ABC1ABBE55618A3BFCB66D39D11E2090014E88B0F1599A6777
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/ru.ini
- SHA256 af83f0426b30f69a369526217a9c8577e4ba77ea57a58fccaa242600a736c6b4
- MD5 65c3a0a90105075a378f543723153251
- SHA1 58447a961d66a2a90e6a500b03277fad78eb543b
- SHA512 7c7cd87a3bf19ce0082a6e1324262ee485176d10ca7d2157a8d866d9c010069b04ec60e1a159161d3549b4e3452e0de95ef3f7c937fd05f2599d369c7e17a546
- SSDEEP 192:LjNEPE7+KjefQKi6rj+70OO6RXy+kQH0jgYDUpS992j39B7/Nhi:/NMESsk5rj+70OOAd70jgH292z9B7Li
- TLSH T15E62F50FA7BC8558F1B2D6809B7A88D14279FE752739C09E608F2C1DD0E892573527EB
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/sl.ini
- SHA256 18b04bf5fecc69995130d0142f85214158843b99d3193caaba57376de9474b78
- MD5 06fb511dac195eace694b3a80a635b89
- SHA1 2e7938f581e3c0829d9e5e7b0a3f2f2b86c4241f
- SHA512 c8cf3fe16978fa4bb5e7a56da676908f01b7032bbfa45fe25c65afde627a868d7ae65ffce11af53d8b7286b7bbaba5ee19de487d95c55f63929d7404b5aaeb33
- SSDEEP 384:ceaecG6w0ZkHi2ZzaBNWu6SAIASOwD+LfSF4jxz1b:ceaecG6LZMi2ZzaBNWu6FIA/PaFcN1b
- TLSH T1C572C21723FD1615F1F3ABC0EBBA45A04B3AFCB67A39C12F2090024D85B1E9595A2777
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/ter22.dll
- IMPHASH 76ffdde0a8a19f6623e1be1c9cd25ce0
- SHA256 3e20fd7f5c97cc35b9567bbe85be68b70cf4eafba9b7d9adebd753e98b5cda8f
- MD5 ca1b509a093a8121d9b5753fca1e070a
- SHA1 e2d20c24c8f2ddf460658d0637b1a91972163a52
- SHA512 b20423239c43aa87fd032053d65f83b89adf9479dc38a8abc88b4f2e0e15c9a6eb86f6f2b1ea451f9f7af250ac17fed236cf7c8a736559ae504131cb44deda04
- SSDEEP 49152:wjefGHx0PUtCJAlveoYCKcPusGBiU7MaretsRUNG28L0LA5zGKmHsjUnrXBnt5+c:RuRQHLCKYuB7MaretsRcG28L0LA5zGK2
- TLSH T14C957D51A8A2C076D45E50B2120A0BB4AFA97F3760345DBB8E883C5C7B71686DF35B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1597535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ole32
StgCreateDocfileOnILockBytes
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
OleBuildVersion
OleInitialize
OleGetClipboard
OleCreateLinkFromData
OleCreateFromData
CoCreateInstance
CLSIDFromString
OleCreate
CreateFileMoniker
CreateItemMoniker
OleCreateLink
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
WriteClassStg
WriteFmtUserTypeStg
CLSIDFromProgID
OleConvertOLESTREAMToIStorage
OleLoad
OleCreateFromFile
OleCreateLinkToFile
StgCreateDocfile
ProgIDFromCLSID
OleSetContainedObject
ReleaseStgMedium
OleConvertIStorageToOLESTREAM
StringFromCLSID
CoTaskMemFree
OleSave
OleUninitialize
DoDragDrop
OleDraw
RevokeDragDrop
RegisterDragDrop
shell32
DragQueryPoint
DragQueryFileW
DragFinish
ShellExecuteW
DragAcceptFiles
ShellExecuteA
kernel32
GetStartupInfoA
DeleteCriticalSection
GetFileType
GetEnvironmentStrings
FreeEnvironmentStringsW
GetCurrentProcess
GetStdHandle
SetHandleCount
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
FreeEnvironmentStringsA
SetLastError
IsBadReadPtr
GetCurrentThreadId
GetModuleFileNameA
FindResourceA
LoadResource
LockResource
FreeResource
GetStringTypeW
Sleep
GetFullPathNameA
SystemTimeToFileTime
FileTimeToDosDateTime
lstrcpynW
DosDateTimeToFileTime
FileTimeToSystemTime
GlobalReAlloc
GlobalHandle
GlobalSize
lstrcmpiW
lstrcmpW
GetFileAttributesW
DeleteFileW
MoveFileW
CreateFileW
CreateFileA
CloseHandle
SetErrorMode
LoadLibraryA
WriteFile
ReadFile
SetFilePointer
GetUserDefaultLangID
WideCharToMultiByte
lstrcmpA
GetDateFormatA
GetLastError
GetTimeFormatA
GetProcAddress
GetLocalTime
lstrcatA
GetACP
IsDBCSLeadByteEx
IsDBCSLeadByte
GetCPInfo
GetVersion
GetVersionExA
GetUserDefaultLCID
GetLocaleInfoA
lstrcatW
MultiByteToWideChar
FreeLibrary
lstrcmpiA
MulDiv
GetCommandLineA
lstrlenW
GlobalUnlock
GlobalAlloc
GlobalLock
GlobalFree
lstrlenA
lstrcpyA
lstrcpyW
TerminateProcess
GetModuleHandleA
ExitProcess
HeapFree
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
GetOEMCP
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
GetStringTypeA
VirtualProtect
GetSystemInfo
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapSize
RaiseException
SetStdHandle
FlushFileBuffers
DeleteFileA
GetFileAttributesA
advapi32
RegQueryValueExA
RegDeleteKeyA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
GetUserNameA
RegEnumKeyA
RegQueryValueA
GetUserNameW
RegOpenKeyExA
user32
CharLowerBuffW
CharUpperBuffW
IsCharUpperW
CharLowerW
SetForegroundWindow
TrackPopupMenuEx
EnableMenuItem
CheckMenuItem
CreatePopupMenu
AppendMenuA
TrackPopupMenu
GetWindowThreadProcessId
SetDlgItemTextW
IsWindowEnabled
GetDlgItemInt
EndDialog
CreateWindowExW
GetWindowLongW
SetWindowLongW
CallWindowProcW
SendDlgItemMessageW
GetSysColor
GetCursorPos
GetWindow
DialogBoxParamA
CharUpperBuffA
CharLowerBuffA
SendDlgItemMessageA
CallWindowProcA
IsClipboardFormatAvailable
GetClipboardData
OpenClipboard
EmptyClipboard
CloseClipboard
GetWindowTextLengthA
GetDlgItemTextA
GetDlgItem
SetClipboardData
UpdateWindow
SetDlgItemTextA
CreateDialogParamA
GetWindowTextA
SetDlgItemInt
TranslateMessage
DispatchMessageA
GetWindowLongA
MessageBoxW
GetDC
LoadBitmapA
LoadAcceleratorsA
SetScrollPos
RegisterClipboardFormatA
GetParent
ShowScrollBar
SetScrollRange
TrackMouseEvent
wsprintfW
SetScrollInfo
FillRect
SetCaretPos
ScreenToClient
ClientToScreen
PtInRect
wsprintfA
FindWindowA
BeginPaint
EndPaint
ShowCaret
HideCaret
ValidateRect
SetRect
GetClientRect
MoveWindow
IsCharLowerA
LoadMenuA
GetClassInfoExA
LoadIconA
LoadCursorA
RegisterClassExA
GetClassInfoExW
RegisterClassExW
MapVirtualKeyA
GetKeyboardState
ToUnicodeEx
InSendMessage
ReplyMessage
MessageBeep
GetMenu
SetCapture
ReleaseCapture
SystemParametersInfoA
GetSystemMetrics
SetWindowLongA
SetMenu
KillTimer
ReleaseDC
DestroyWindow
DestroyCursor
TranslateAcceleratorA
IsWindow
PeekMessageA
SetTimer
SetWindowsHookExA
UnhookWindowsHookEx
SetWindowTextW
SetCursor
SetWindowTextA
DestroyMenu
DestroyAcceleratorTable
UnregisterClassA
UnregisterClassW
GetKeyboardLayout
GetDlgCtrlID
GetFocus
GetKeyState
CallNextHookEx
GetClassNameA
DefWindowProcA
SendMessageA
MessageBoxA
PostMessageA
EnableWindow
InvalidateRect
CreateWindowExA
ShowWindow
BringWindowToTop
SetFocus
GetWindowRect
SetWindowPos
wvsprintfA
DestroyCaret
CreateCaret
IsWindowVisible
CharUpperW
IsCharLowerW
DialogBoxParamW
IsCharAlphaA
IsDialogMessageA
gdi32
SaveDC
RestoreDC
CreatePen
GetTextColor
SetTextColor
SetBkMode
GetBkMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
PlayEnhMetaFileRecord
BitBlt
PlayMetaFileRecord
CreatePalette
SetWindowOrgEx
SetViewportOrgEx
RealizePalette
EnumMetaFile
SetViewportExtEx
SetWindowExtEx
SetMapMode
Rectangle
EnumEnhMetaFile
SetStretchBltMode
GetWorldTransform
PtInRegion
CreatePolygonRgn
CreateDIBSection
GetDeviceCaps
CreateCompatibleBitmap
StretchDIBits
StretchBlt
StrokePath
FillPath
StrokeAndFillPath
EndPath
CloseFigure
PolyBezierTo
LineTo
MoveToEx
BeginPath
ExtTextOutA
GetTextExtentPointA
SetPixel
GetTextExtentPointW
Ellipse
ExtTextOutW
GdiComment
Polygon
GetPaletteEntries
TextOutA
Arc
RoundRect
SetTextAlign
ExtCreatePen
TranslateCharsetInfo
GetObjectA
GetTextMetricsA
Escape
GetObjectType
PlayEnhMetaFile
StartDocA
CreateDCA
EndDoc
EndPage
DPtoLP
GetMapMode
GetViewportExtEx
GetWindowExtEx
GetWindowOrgEx
GetViewportOrgEx
StartPage
ResetDCA
CloseEnhMetaFile
CreateEnhMetaFileA
CloseMetaFile
CreateMetaFileA
AbortDoc
SetAbortProc
CreateBitmap
CreateBitmapIndirect
DeleteMetaFile
CopyMetaFileA
GetEnhMetaFileHeader
CopyEnhMetaFileA
GetDIBits
CreateFontIndirectA
GetFontLanguageInfo
EnumFontsA
GetCharWidthA
GetCharWidthW
DeleteEnhMetaFile
GetPixel
EnumFontFamiliesExA
SetROP2
Polyline
LPtoDP
CreateRectRgn
SelectClipRgn
CreateCompatibleDC
SetBkColor
SelectPalette
DeleteObject
CreateSolidBrush
GetStockObject
SetTextCharacterExtra
DeleteDC
GetCharacterPlacementA
GetCharacterPlacementW
SetDIBits
SetEnhMetaFileBits
GetEnhMetaFileBits
SetMetaFileBitsEx
GetMetaFileBitsEx
UnrealizeObject
SelectObject
comdlg32
ChooseFontA
ChooseColorA
PrintDlgExA
PrintDlgA
GetOpenFileNameW
GetSaveFileNameW
GetOpenFileNameA
GetSaveFileNameA
winspool.drv
ord201
DeviceCapabilitiesA
OpenPrinterA
DocumentPropertiesA
ClosePrinter
imm32
ImmSetCandidateWindow
ImmGetCompositionStringA
ImmNotifyIME
ImmGetContext
ImmGetCompositionStringW
ImmReleaseContext
ImmIsUIMessageA
oleaut32
SysAllocString
SysFreeString
usp10
ScriptStringAnalyse
ScriptStringGetLogicalWidths
ScriptStringGetOrder
ScriptStringCPtoX
ScriptString_pSize
ScriptStringFree
BookmarkParam
CellBorderColorParam
CellBorderParam
CellColorParam
CellRotationParam
CellShadingParam
CellVertAlignParam
CellWidthFlagParam
CellWidthParam
CharScaleXParam
CharSpaceParam
CheckBoxFieldParam
ClearAllTabs
ClearTab
CloseTer
CreateTerWindow
CtlDlgFn
CtlFlags
CtlInfo
CtlStyle
CustomControlInfoA
CustomControlSizeToText
CustomControlStyle
DataFieldParam
DateParam
DeleteCellsParam
DeselectTerText
DrawObjectParam
EditInputFieldParam
EditPictureParam
EditStyleParam
FontParam
FootnoteParam
FormFieldSubclass
GetFontInfo
GetFontInfo2
GetTerBuffer
GetTerCursorPos
GetTerFields
GetTerFieldsAlt
GetTerLine
HandleToIntArray
HandleToStr
HandleToStrInChunks
HandleToStrU
HookGetMsgProc
HyperlinkParam
InputFieldParam
InsertObjectParam
InsertRtfBuf
InsertRtfBufU
InsertTerText
InsertTerTextU
JumpParam
ListLevelParam
ListOrPropParam
ListOrSelectParam
ListParaParam
ListPropParam
ListSelectParam
LoadTerControl
MergeEnumMetafile
ObjectAttribParam
ObjectPosParam
OleEnumMetafile
OleFromFileParam
OverrideBinParam
PageParam
ParaBoxParam
ParaHangingIndent
ParaIndentTwips
ParaLeftIndent
ParaNormal
ParaRightIndent
ParaSpaceParam
ParaTextFlowParam
PasteSpecialParam
PrintAbortParam
PrintPreviewProc
PrintProc
PrtEnumMetafile
RangeParam
ReadTerFile
ReadTerFileU
ReplaceParam
RowHeightParam
RowPositionParam
RowTextFlowParam
SaveTerFile
SaveTerFileU
ScrEnhMetaFileProc
SearchParam
SectionParam
SelectStyleParam
SelectTerText
SetTab
SetTabParam
SetTerBkColor
SetTerBuffer
SetTerCharStyle
SetTerColor
SetTerCursorPos
SetTerDefaultFont
SetTerFields
SetTerFont
SetTerLine
SetTerParaFmt
SetTerPointSize
StrToHandle
StrToHandleInChunks
StrToHandleU
TerAbsToRowCol
TerAcceptChanges
TerAddAnimPict
TerAddAutoCompWord
TerAddImageMapRect
TerAddToolbarIcon
TerAddToolbarItem
TerAdjustHtmlTable
TerAdjustUserColor
TerAnd
TerAppendText
TerAppendTextEx
TerAppendTextEx2
TerAppendTextU
TerAppendTextU2
TerApplyComment
TerApplyCommentU
TerApplyHyperlink
TerApplyHyperlinkU
TerBmp2Png
TerBulletToText
TerCancelEditStyle
TerCellBorder
TerCellBorder2
TerCellBorderColor
TerCellColor
TerCellRotateText
TerCellShading
TerCellVertAlign
TerCellWidth
TerChangeField
TerChangeFieldPicture
TerChangeFieldRtf
TerChangeFieldRtfU
TerChangeFieldU
TerChangeToolbarIcon
TerClearAutoCompList
TerClosePrinter
TerColBreak
TerCommand
TerCommand2
TerConnectTextBoxes
TerCopyHeadersFooters
TerCreateBulletId
TerCreateBulletId2
TerCreateBulletId3
TerCreateCellId
TerCreateFirstHdrFtr
TerCreateFont
TerCreateFont2
TerCreateFont3
TerCreateFont4
TerCreateHtmlRule
TerCreateHtmlRule2
TerCreateImageMap
TerCreateLeftRightHdrFtr
TerCreateListBulletId
TerCreateListBulletId2
TerCreateOcxObject
TerCreateOcxObject2
TerCreateParaFrameId
TerCreateParaId
TerCreateParaIdEx
TerCreateShape
TerCreateTabId
TerCreateTable
TerCreateTable2
TerCreateWindowAlt
TerDataVersion
TerDeleteBlock
TerDeleteBookmark
TerDeleteCellText
TerDeleteCells
TerDeleteField
TerDeleteFirstHdrFtr
TerDeleteHdrFtr
TerDeleteHypertext
TerDeleteIDispatch
TerDeleteMenuItem
TerDeleteObject
TerDeleteParaFrame
TerDeleteReviewer
TerDeleteStyle
TerDeleteStyleU
TerDeleteTag
TerDifTableRows
TerDisableDragDrop
TerDocName
TerDocNameU
TerDrawImage
TerDrawImage2
TerEditComment
TerEditCommentU
TerEditList
TerEditListLevel
TerEditListOr
TerEditStyle
TerEditStyleU
TerEditTooltip
TerEnableDashes
TerEnableDragDrop
TerEnableHScrollBar
TerEnableMbcs
TerEnableRefresh
TerEnableScrollBar
TerEnableSpeedKey
TerEnableTracking
TerEngageCaret
TerEnumFontFamiliesEx
TerEnumFonts
TerEquateHtmlTable
TerExit
TerExpandWidthToFit
TerFieldToText
TerFileToMem
TerFileToMem2
TerFileToMem2U
TerFindHlinkField
TerFindNextChange
TerFlushUndo
TerGetAppMemory
TerGetBaseLineY
TerGetBkPictId
TerGetBookmark
TerGetBufferDC
TerGetBulletInfo
TerGetBulletInfo2
TerGetBulletInfo3
TerGetCaretPos
TerGetCellBorderColor
TerGetCellBorderWidth
TerGetCellInfo
TerGetCellInfo2
TerGetCellParam
TerGetCellParam2
TerGetCharDim
TerGetCheckboxInfo
TerGetComboboxInfo
TerGetControlId
TerGetControlPos
TerGetCurFont
TerGetCurParaNum
TerGetDeviceRes
TerGetDevmode
TerGetDispPageNo
TerGetDrawObjectInfo
TerGetDropDataObject
TerGetEffectiveFont
TerGetField
TerGetFieldFont
TerGetFieldFontU
TerGetFieldU
TerGetFlowFont
TerGetFontAux1Id
TerGetFontFieldCode
TerGetFontFieldCodeU
TerGetFontFieldId
TerGetFontLang
TerGetFontParam
TerGetFontSpace
TerGetFontStyleId
TerGetFrameParam
TerGetFrameSize
TerGetHdrFtrPos
TerGetHtmlDocTitle
TerGetHypertext
TerGetHypertext2
TerGetHypertextEx
TerGetHypertextU
TerGetHypertextU2
TerGetIDispatch
TerGetImageMapInfo
TerGetImageMapRectInfo
TerGetInputFieldId
TerGetInputFieldInfo
TerGetLastMessage
TerGetLastMessage2
TerGetLevelCell
TerGetLine
TerGetLineCol
TerGetLineEx
TerGetLineInfo
TerGetLineParam
TerGetLineParamStr
TerGetLineU
TerGetLineWidth
TerGetLineWidth2
TerGetListId
TerGetListInfo
TerGetListInfo2
TerGetListLevelInfo
TerGetListLevelInfoU
TerGetListLine
TerGetListOrInfo
TerGetMarginEx
TerGetMsgCallback
TerGetNextControlPos
TerGetNextTagId
TerGetOleClass
TerGetOlePtr
TerGetOrigPictSize
TerGetOverrideBin
TerGetPageBorderDim
TerGetPageCount
TerGetPageFirstLine
TerGetPageNumFmt
TerGetPageOffset
TerGetPageOrient
TerGetPageOrient2
TerGetPageOrientEx
TerGetPageParam
TerGetPagePos
TerGetPageSect
TerGetPageSize
TerGetParaAux1Id
TerGetParaCount
TerGetParaInfo
TerGetParaInfo2
TerGetParaInfo3
TerGetParaInfo4
TerGetParaParam
TerGetParam
TerGetParentPtr
TerGetPdfPageCount
TerGetPictCropping
TerGetPictFrame
TerGetPictInfo
TerGetPictMapId
TerGetPictOffset
TerGetPlaceHolderPict
TerGetPrevControlPos
TerGetPrinter
TerGetReadOnly
TerGetRefParam
TerGetRefParamStr
TerGetReviewerInfo
TerGetRowCellCount
TerGetRowInfo
TerGetRowParam
TerGetRtfDocInfo
TerGetRtfDocInfoU
TerGetRtfSel
TerGetSectAuxId
TerGetSectBins
TerGetSectColWidth
TerGetSectInfo
TerGetSectParam
TerGetSelection
TerGetSeqSect
TerGetStyleId
TerGetStyleIdU
TerGetStyleInfo
TerGetStyleInfoU
TerGetStyleParam
TerGetTabStop
TerGetTabStop2
TerGetTableId
TerGetTableLevel
TerGetTablePos
TerGetTablePos2
TerGetTag
TerGetTagEx
TerGetTagName
TerGetTagPos
TerGetTagPos2
TerGetTextColor
TerGetTextFieldInfo
TerGetTextHeight
TerGetTextSel
TerGetTextSelNR
TerGetTextSelU
TerGetTextSelUNR
TerGetVbxCallback
TerGetVersion
TerGetVisibleCol
TerGetWordCount
TerHdrFtrExists
TerHideToolbarIcon
TerHideWindow
TerHigh16Bits
TerHtmlCellWidthFlag
TerHtmlCharSet
TerHtmlGetBasePictFile
TerHtmlNegativeIndent
TerHtmlSetBasePictFile
TerHtsGetInitAlign
TerHtsSetInitAlign
TerIgnoreCommand
TerImageMapNameToId
TerInServer
TerInit
TerInputFieldToTextBox
TerInsertArrowLineObject
TerInsertBookmark
TerInsertCheckBoxField
TerInsertComboBoxField
TerInsertControl
TerInsertDateTime
TerInsertDrawObject
TerInsertDrawObject2
TerInsertDrawObject3
TerInsertDynamicField
TerInsertField
TerInsertFieldU
TerInsertFootnote
TerInsertFootnote2
TerInsertHyperlink
TerInsertHyperlinkU
TerInsertHyperlinkU2
TerInsertLine
TerInsertLineObject
TerInsertLineU
TerInsertObjectId
TerInsertOleFile
TerInsertOleFileDlgU
TerInsertOleFileU
TerInsertOleObject
TerInsertPageRef
TerInsertParaFrame
TerInsertPictureFile
TerInsertPictureFileU
TerInsertPictureFileXY
TerInsertPictureFileXY2
TerInsertPictureFromMemory
TerInsertRtfFile
TerInsertRtfFileU
TerInsertTableCol
TerInsertTableRow
TerInsertText
TerInsertTextInputField
TerInsertTextU
TerInsertToc
TerInsertToc2
TerInsertUserField
TerInternetClose
TerInternetGet
TerInternetOpen
TerInternetPut
TerInvokeOcx
TerInvokeOcx2
TerIsAvailableFont
TerIsBlankPage
TerIsDeletedLine
TerIsInIE
TerIsMixPara
TerIsModified
TerIsPrinting
TerIsSspAvail
TerIsTableSelected
TerIsTableWider
TerLineInfoFlags
TerLineSelected
TerLineSpaceAfter
TerLoadExtFont
TerLocateAuxIdChar
TerLocateChangedChar
TerLocateChangedChar2
TerLocateChangedChar3
TerLocateField
TerLocateFieldChar
TerLocateFieldChar2
TerLocateFontFlags
TerLocateFontId
TerLocateInputField
TerLocateStyle
TerLocateStyleChar
TerLow16Bits
TerLparam2String
TerMakeMbcs
TerMarkCells
TerMbcsChar
TerMbcsDir
TerMbcsExt
TerMbcsLen
TerMenuEnable
TerMenuEnable2
TerMenuSelect
TerMenuSelect2
TerMergeFields
TerMergeFieldsU
TerMergePrint
TerMergePrintMeta
TerMergePrintMeta2
TerMergePrintRE
TerMergePrintRep
TerMergePrintRep2
TerMergePrintRep3
TerMergePrintVB
TerMoveParaFrame
TerMoveParaFrame2
TerMovePictFrame
TerMovePictFrame2
TerNewDivId
TerNewDivId2
TerNormalizeBlock
TerOcxPropInfo
TerOcxPropInfo2
TerOr
TerOverridePageCount
TerOverridePageSize
TerOverrideStyles
TerPageBitmapHin
TerPageBitmapHin2
TerPageBreak
TerPageFromLine
TerPageMetafileHin
TerPaintFormat
TerPastePicture
TerPdcEnd
TerPdcEnd2
TerPdcPrintPage
TerPdcPrintPage2
TerPdcPrintPage3
TerPdcPrintPage4
TerPdcStart
TerPdcStart2
TerPdfEnd
TerPdfPrintPage
TerPdfSetDllName
TerPdfStart
TerPdfStart2
TerPdfStart3
TerPdfStart4
TerPickBknd
TerPictAltInfo
TerPictLinkName
TerPictLinkNameU
TerPictureFromEmf
TerPictureFromFile
TerPictureFromGif
TerPictureFromJpg
TerPictureFromOther
TerPictureFromPng
TerPictureFromTif
TerPictureFromWmf
TerPixToTextPos
TerPlayMergeMeta
TerPlayMergeMeta2
TerPosAfterTable
TerPosAtParaNum
TerPosBodyText
TerPosBookmark
TerPosFrame
TerPosHdrFtr
TerPosHdrFtrEx
TerPosLineAtTop
TerPosPage
TerPosTable
TerPosTable2
TerPosTable3
TerPosTable4
TerPosTag
TerPosTagEx
TerPrint
TerPrint2
TerPrint3
TerPrint3U
TerPrintBlankPageBefore
TerPrintEx
TerPrintPreview
TerPrintPreviewMode
TerPrintf
TerProcessTab
TerQueryExit
TerQuickRepaint
TerRecreateColSpan
TerRecreateToolbar
TerRedirectArrowKeys
TerReformatTable
TerRefreshStyles
TerRegisterMsgCallback
TerRegisterPrintCallback
TerRegisterVbxCallback
TerRejectChanges
TerRepaginate
TerRepaint
TerRepaintArea
TerResetAutoSpell
TerResetLastMessage
TerResetUserColors
TerRestrictFont
TerReverseSelection
TerRewrap
TerRotateFrameText
TerRowColToAbs
TerRowHeight
TerRowPosition
TerRowPositionEx
TerSavePict
TerSavePictDIB
TerSavePictEmf
TerSavePictGif
TerSavePictJpg
TerSavePictPng
TerSaveUndo
TerScrLineHeight
TerScrToTwipsX
TerScrToTwipsY
TerSearchReplace
TerSearchReplace2
TerSearchReplaceU
TerSectBreak
TerSelectCellText
TerSelectCharStyle
TerSelectCol
TerSelectField
TerSelectFrameText
TerSelectParaStyle
TerSelectParaText
TerSelectPrint
TerSelectPrint2
TerSelectRow
TerSelectTable
TerSetAccelHandle
TerSetAnimInfo
TerSetAppMemory
TerSetAutoWidth
TerSetBkPictId
TerSetBorderColor
TerSetBorderLineColor
TerSetBullet
TerSetBullet2
TerSetBullet3
TerSetBulletEx
TerSetBulletId
TerSetCaretPos
TerSetCaretWidth
TerSetCellBorderColor
TerSetCellInfo
TerSetCellInfo2
TerSetCellParam
TerSetCellSpan
TerSetCharAuxId
TerSetCharFlow
TerSetCharLang
TerSetCharOffset
TerSetCharScaleX
TerSetCharSet
TerSetCharSet2
TerSetCharSpace
TerSetCheckboxInfo
TerSetComboboxInfo
TerSetCommentMinRightMarg
TerSetCtlColor
TerSetCustomFontList
TerSetCustomFontSizes
TerSetCustomFontStyles
TerSetCustomMessage
TerSetCustomSymbolFonts
TerSetDebug
TerSetDefBkColor
TerSetDefCellMargin
TerSetDefDir
TerSetDefLang
TerSetDefListFormat
TerSetDefPrinter
TerSetDefTabType
TerSetDefTabWidth
TerSetDefTextColor
TerSetDefaultCellBorderWidth
TerSetDocTextFlow
TerSetEffectiveFont
TerSetFixRes
TerSetFlags
TerSetFlags10
TerSetFlags2
TerSetFlags3
TerSetFlags4
TerSetFlags5
TerSetFlags6
TerSetFlags7
TerSetFlags8
TerSetFlags9
TerSetFocus
TerSetFontField
TerSetFontId
TerSetFontProps
TerSetFontSpace
TerSetFontStyle
TerSetFontStyleId
TerSetFrameMarginDist
TerSetFrameParam
TerSetFrameTextDist
TerSetFrameYBase
TerSetHdrRow
TerSetHilightColor
TerSetHtmlAddOnKey
TerSetHtmlAutoSpacing
TerSetHtmlCellHeight
TerSetHtmlCellPadding
TerSetHtmlCellPaddingH
TerSetHtmlColSpan
TerSetHtmlColSpan2
TerSetHtmlDocTitle
TerSetHtmlTblCellSpacing
TerSetHtmlTblWidth
TerSetInitTypeface
TerSetInputFieldInfo
TerSetInputTextAuxId
TerSetLastMessage2
TerSetLicenseKey
TerSetLine
TerSetLineEx
TerSetLineU
TerSetLinkDblClick
TerSetLinkPictDir
TerSetListBullet
TerSetListBullet2
TerSetListLevel
TerSetMapRectInfo
TerSetMargin
TerSetMarginEx
TerSetMaxUndo
TerSetMdiParent
TerSetMenuItemDesc
TerSetMergeDelim
TerSetModify
TerSetNewFrameDim
TerSetNextFontAux1Id
TerSetNextParaAux1Id
TerSetNoDropList
TerSetObjectAttrib
TerSetObjectAttribEx
TerSetObjectWrapStyle
TerSetOcxIntProp
TerSetOcxTextProp
TerSetOutputFormat
TerSetOverrideBin
TerSetPageBkColor
TerSetPageBorderWidth
TerSetPageNumFmt
TerSetPagePos
TerSetPaper
TerSetPaperEx
TerSetParaAuxId
TerSetParaBkColor
TerSetParaBorderColor
TerSetParaId
TerSetParaIdBorderColor
TerSetParaIdDiv
TerSetParaIdTextFlow
TerSetParaIdWidthHeight
TerSetParaIndent
TerSetParaList
TerSetParaProps
TerSetParaShading
TerSetParaSpacing
TerSetParaSpacing2
TerSetParaTextFlow
TerSetParam
TerSetParamRect
TerSetParentPtr
TerSetPdfFirstPage
TerSetPflags
TerSetPictBkColor
TerSetPictCropping
TerSetPictFrame
TerSetPictFrame2
TerSetPictInfo
TerSetPictMapId
TerSetPictOffset
TerSetPictPctSize
TerSetPictSize
TerSetPlaceHolderPict
TerSetPreview
TerSetPrintPreview
TerSetPrinter
TerSetReadOnly
TerSetRepInfo
TerSetResourceDLL
TerSetRowFlags
TerSetRowKeep
TerSetRowParam
TerSetRowTextFlow
TerSetRtfDocInfo
TerSetRtfDocInfoU
TerSetSearchString
TerSetSect
TerSetSect2
TerSetSect3
TerSetSect4
TerSetSectAuxId
TerSetSectBorder
TerSetSectColWidth
TerSetSectEx
TerSetSectLineNbr
TerSetSectLineNbr2
TerSetSectOrient
TerSetSectPageSize
TerSetSectParam
TerSetSectTextFlow
TerSetSectVertAlign
TerSetSpannedCellProp
TerSetStCharSet
TerSetStDictPath
TerSetStKey
TerSetStatusColor
TerSetStyleParam
TerSetStyleParamU
TerSetTab
TerSetTableColWidth
TerSetTableId
TerSetTag
TerSetTag2
TerSetTcField
TerSetTextAreaSize
TerSetTextCase
TerSetTextFieldInfo
TerSetToolbarComboWidth
TerSetUlineColor
TerSetUndoRef
TerSetUniFont
TerSetUserClipFormat
TerSetUserField
TerSetUserFieldU
TerSetUserFont
TerSetWatermarkPict
TerSetWaveUnderline
TerSetWaveUnderline2
TerSetWebFolder
TerSetWinBorder
TerSetWrapWidth
TerSetZoom
TerShadeProtectedText
TerShowPopupMenu
TerShowSubMenu
TerShowWindow
TerShrinkFontTable
TerShrinkPageToFit
TerShrinkPictureToPage
TerShrinkTable
TerShrinkTableToPageWidth
TerSpellCheck
TerSpellCheck2
TerSpellCheckCurWord
TerSpellCheckerPopped
TerSplitMbcs
TerSpoolBegin
TerSpoolEnd
TerStResetUserDict
TerStopMessages
TerStrToUnicode
TerString2Lparam
TerTab2Spaces
TerTableOutlineBorder
TerTableOutlineBorder2
TerTest
TerTextPosToPix
TerTocToText
TerUpdateDynField
TerUpdateHyperlinkCode
TerUpdateHyperlinkCodeU
TerUpdateHyperlinkText
TerUpdateHyperlinkTextU
TerUpdateStyle
TerUpdateToolbar
TerWndProc
TerWrsSetLicenseKey
TerXlateControlId
TextRotationParam
UHandleToStrU
VbxProcessMessage
ZoomParam
ZoomSubclass
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
112KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=105, version=2067,
count=32, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=2, id=25, version=9210,
count=6, id=95, version=2179,
count=19, id=93, version=2179,
count=458, id=1, productName=Unmarked objects,
count=175, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
PDFConversa/App/PDFConversa/tr.ini
- SHA256 6fceb83063b4c8ebe0ccb69f655301bddd308e59f4ca85e2b6fcf0f82a748603
- MD5 126334c2011809881880df028e46e991
- SHA1 7067cf5f87686fd637d6897249b5b2fc3a00b2fd
- SHA512 41b698a64563db9684a98569839ef17ac704f3e9af055e6fa98cec92276f62dbc4f1c804c835dd527644353a41f0bc23f7ea5901b0fa14a10e69da31fb0054ba
- SSDEEP 384:tbTgxehWKK6S7OmZW7Ffg2Mblh2ArJow8:tbTgxEWKK6S7OmZW7Ffg2Mblh2ArWJ
- TLSH T13172D21323FD0515F6F3ABC1AABE94A047BAFDB67939D12F2181010DC8B0E459562BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
PDFConversa/App/PDFConversa/txml2.dll
- IMPHASH 87134a600d6346a04fb26498c5ec13e6
- SHA256 2b8807fffb2ec0a9c08d488f2c85ee02ca717acc6a939623f2276d7ae0c2f99a
- MD5 2e41bf6c5121338d164c760e805b29e5
- SHA1 01348c562a7a69c03897405173a42ac6f3704145
- SHA512 7d88e68e75d6240ce144e4dad35ac26bb048f577d9ea9565a4020e85ccf67f18a0f5f00e452becba0377e03bd1aec21eba6e4204094504deb86daf5fa0c8059c
- SSDEEP 768:BwSMprpKcLkeWylGtTpEUb7cYj41XCDeOT2PkqPAojHbBkteqrDAyIbApKi:WltLkeWt1US4tC3o/BknDAyI8A
- TLSH T1AA938D5172C2D4B3C4DA8C3D94A65B126B3B6870AFF058DB1F98074D9E293D1AE3A347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4873
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
L:\dev\tecf\TXML2.pdb
ole32
CoCreateInstance
kernel32
VirtualFree
CompareStringW
lstrlenA
CompareStringA
GetLocaleInfoW
GetSystemInfo
VirtualProtect
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
GetLastError
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
SetEnvironmentVariableA
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
HeapSize
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
user32
wvsprintfA
FindWindowA
GetWindow
SendMessageA
MessageBoxA
TxmlCreateDOMDocument
TxmlCreateXmlReader
WEP
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=20, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=5, id=93, version=2179,
count=78, id=1, productName=Unmarked objects,
count=68, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
PDFConversa/App/PDFConversa/wpcc.dll
- IMPHASH a2d5ec9f5e3ebfa976c02f5005d55303
- SHA256 6c4e686b2c40383cc644686d8d926c9c132ca59190eacc9c3506aff60eff277b
- MD5 624dc96fa4ec8da95ef525302b285ae2
- SHA1 ec075ca249c60ce5c60822f0d62f3beecdd561bc
- SHA512 a864f0d74c8199c8afc5f53b7b7e9c8217bc9530f94275b395cb9cc9ed0730ee40cb1cbfe0bfd9f22a49a5cead29b7ce9f44e09625c8fb16e8dc88e8c9dab9dd
- SSDEEP 768:YlKxcsy0iIdtmiQpZVdB8EciwqnRY8pI:oaA7d5ciZO
- TLSH T1C3138462F3EAD87BE1490131491BA39D1E647C920F80D60F738CF36D9F725C16B52A66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5236
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvbvm60
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
_adj_fdiv_m64
ord621
ord516
_adj_fprem1
__vbaResume
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
ord301
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
_adj_fdivr_m16i
ord307
__vbaBoolVarNull
_CIsin
ord525
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
DllFunctionCall
_adj_fpatan
__vbaRedim
__vbaStrR8
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaStrVarVal
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaR8Str
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord578
ord101
ord102
ord103
ord104
ord105
__vbaAryLock
__vbaStrToAnsi
__vbaVarDup
__vbaVarCopy
ord617
_CIatan
__vbaStrMove
ord619
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=2, id=9, version=8041,
count=1, id=13, version=8169,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
PDFConversa/App/PDFConversa/wps32.dll
- IMPHASH 08c56cede1ee5b241d2e304479a8d2a0
- SHA256 1913b760ae93a76cc10ea08c0380e5ad17fe3a8d07a9ec735def5bdb8735ab91
- MD5 2abdc42bce4697d22fa8000982566949
- SHA1 87af0739ca71e00cc860e04c0fa3f11e42adecdf
- SHA512 09b609895b27cfe37c477b7769cddee1b7fdeab7360c6794dba36a8dd50b2e0f2e761e8431585f0d79c9bd8793b2cff18c75714c5e6ddce537359d3f7ce1b163
- SSDEEP 1536:7vAY+S9s6Yq/1WdQcmHnkRWcpJHpc9ZDJIifEyVPkarm6DvW:51fh9W1mwppqLP7y6Dv
- TLSH T17DE39E02F181C176E5A700BD49DB6B5E6F3DF8E163A095C363980A8D1F792D76A3A313
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23607
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
K:\wpc\WPS32.pdb
kernel32
GetProcAddress
LoadLibraryA
lstrlenA
GetModuleFileNameA
SetErrorMode
CloseHandle
ReadFile
FreeLibrary
lstrlenW
GetLocalTime
lstrcatA
lstrcmpiA
WriteFile
GetCurrentThreadId
SetFilePointer
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
CreateFileA
lstrcpyA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
GetLocaleInfoW
SetStdHandle
SetConsoleCtrlHandler
GetSystemInfo
VirtualProtect
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LCMapStringW
LCMapStringA
HeapSize
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
VirtualQuery
InterlockedExchange
RtlUnwind
InitializeCriticalSection
GetCPInfo
GetOEMCP
GetACP
IsBadWritePtr
VirtualAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
GetTimeZoneInformation
UnhandledExceptionFilter
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileAttributesA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCommandLineA
GetVersionExA
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
GetLastError
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
advapi32
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
user32
wvsprintfA
SendMessageA
GetWindow
FindWindowA
MessageBoxA
wsprintfA
iphlpapi
GetAdaptersInfo
wininet
InternetConnectA
FtpOpenFileA
InternetWriteFile
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
FtpSetCurrentDirectoryA
ter22
ord134
ord175
ord766
ord49
ord31
ord120
ord29
ord135
ord536
ord731
ord622
ord749
ord204
ord75
ord777
ord811
ord623
ord746
ord618
ord684
ord142
ord47
ord489
ord488
ord67
pdc32
ord26
wrs6
ord9
ord11
ord13
ord12
ord10
ord16
WEP
WpsConvertBuffer
WpsConvertFile
WpsEndSession
WpsGetLastMessage
WpsGetLicenseStatus
WpsHandleToByteArray
WpsHandleToStr
WpsNewSession
WpsResetLastMessage
WpsSetBoolProp
WpsSetFlags
WpsSetInServer
WpsSetLicenseInfo
WpsSetLicenseInfoU
WpsSetNumProp
WpsSetPageBorder
WpsSetPageMargin
WpsSetPaperOrient
WpsSetPaperSize
WpsSetRepInfo
WpsSetTextProp
Name
.text
Size
92KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=3, id=105, version=2067,
count=23, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=4, id=93, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=9, id=93, version=2179,
count=143, id=1, productName=Unmarked objects,
count=106, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
PDFConversa/App/PDFConversa/wrs6.dll
- IMPHASH 5c7206255c5b3a02c8f99eb06b4fc8c8
- SHA256 7f741ee47a3ac13b2f310a94c75204f842c13d57bb9a05a04e5a6d4a9d55a87e
- MD5 b8d1b2aefecfe0ec73ef065f377af918
- SHA1 eab322acb1d95179969b75c56febd042258cc668
- SHA512 9ca8cfa74af6a607a25ba61ccb4bc6608e63cb4ff37da6403395acd85177259d9e482d3787715b38776edf66eef49983830add9d21b033dfffea18a4d70ffc68
- SSDEEP 6144:MWNH28VNONT0jWVej93TOtcYnkG0CWhNJKAcUrVZy:MWONT0Ia1ORnECWhNJRXy
- TLSH T143747C21D671E52ED49220F552B287BA5D5C7731130032C792F6AEDAB7227F0BE35A13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
228863
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ole32
OleConvertIStorageToOLESTREAM
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgOpenStorage
kernel32
GlobalFree
GetACP
GetUserDefaultLangID
GetCPInfo
CloseHandle
CreateFileW
WriteFile
lstrcatA
ReadFile
MultiByteToWideChar
GetLocalTime
CreateFileA
GlobalReAlloc
lstrlenW
GetCurrentThreadId
SetFilePointer
MulDiv
lstrcmpiW
lstrcmpiA
lstrlenA
FileTimeToSystemTime
lstrcpyA
GetVersionExA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
SetStdHandle
RtlUnwind
Sleep
SetConsoleCtrlHandler
LCMapStringW
GlobalAlloc
GlobalLock
GlobalUnlock
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalHandle
HeapReAlloc
GetCommandLineA
GetVersion
GetLocaleInfoW
HeapAlloc
HeapFree
GetTimeZoneInformation
GetSystemTime
ExitProcess
TerminateProcess
GetCurrentProcess
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
GetProcAddress
GetModuleHandleA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
GetOEMCP
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
LCMapStringA
advapi32
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
user32
wvsprintfW
wvsprintfA
FindWindowA
GetWindow
SendMessageA
MessageBoxA
MessageBoxW
wsprintfA
GetDC
ReleaseDC
gdi32
GetDeviceCaps
CloseMetaFile
SetWindowExtEx
SetWindowOrgEx
CreateMetaFileA
DeleteMetaFile
GetMetaFileBitsEx
TranslateCharsetInfo
WEP
WrsConvertBuffer
WrsConvertFile
WrsConvertFileToBuffer
WrsConvertFileToBufferU
WrsConvertFileU
WrsEndSession
WrsGetLastMessage
WrsHandleToStr
WrsHandleToStrInChunks
WrsNewSession
WrsOleGet
WrsOlePut
WrsResetLastMessage
WrsSetFlags
WrsSetLicenseKey
WrsStrToHandle
WrsStrToHandleInChunks
Name
.text
Size
280KB
Virtual Size
278KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=21, id=14, version=7299,
count=116, id=1, productName=Unmarked objects,
count=11, id=19, version=8034,
count=96, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
PDFConversa/Data/settings/PDF ConversaSettings.ini
- SHA256 9df4c98dbf068e7cc7fde3afa6ac1311b6c2059641023ae59237079ba828921e
- MD5 5235807d20f739883c6e3088a449e5b2
- SHA1 f5048ebefda9d8107638abb50e8384193692619b
- SHA512 5ddbbad953af124ad1e559520effbf4350b3777ac660bef8495d51e1bf7bcd3a64afb91e6358c2456274888953cb57d0a4a7403b0a9e2f8b4da8892e0068fca1
- TLSH T16CE022582A613E0FAA9DB05DA795F0A903A62516A6C122BAF0070002001872F8671BC2
- MD5 SHA1 SHA512 TLSH
PDFConversa/Data/settings/PDFConversa.reg
- SHA256 5dd67838eb1d9b58b0c3af0805a2d7c52a155f76fedaeb2972aa16a7d2a4ee42
- MD5 ded3da068fe043c1d9911b844e82c43b
- SHA1 ca224e1a504ab389b951dae933687b7f6d439ec9
- SHA512 239f586339c4450dbd78714a50c408d9cb1a14ab90c206df4051e8836926ca4ff0a6e29a8ed9cf8818b7e123454554db2e3717c6dcfa84d709605238365902e7
- TLSH T18F01F40233F41015B3B35F8497FC24169631BCE22E56F8CD0084074D44B1920D9B27BB
- MD5 SHA1 SHA512 TLSH
PDFConversa/PDFConversaPortable.exe
- IMPHASH 32f3282581436269b3a75b6675fe3e08
- SHA256 eaaec3fa62778092df00451277f578b60940e42073588db3404e4a1164ead8a6
- MD5 3783daf78e3102c05631a5f5253a66d6
- SHA1 456523dc03fb5cacd0cb4b6f4ca3aa04ae239169
- SHA512 5a9ac97d7bb447f7ba9f48d7bc8f9c6414e0ae08347c804ea7c73b6da32707f98cfaa4dcf7578d9f7c7a33b6c9a1e1ef9b5f13ac9063fd43428327619d228fa4
- SSDEEP 3072:mqeqOYEUXPnYUk797o6c9jHtn16p8osnBV0mp0TLZX:ZEUXg579+jNnQCLBVwB
- TLSH T125E3DF429BD4C43BE6B20FB125B29BB15E7AF8211874CA1FA3449FCD7C32684D929717
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
14819
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA
user32
GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation
advapi32
RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
415KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=172, id=1, productName=Unmarked objects,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/MoreInfo.dll
- IMPHASH 149adf074d317fbf0d2f17314bd18969
- SHA256 227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
- MD5 bd393029cc49b415b6c9aeb8a4936516
- SHA1 c67fd92fffd18941bed41bfd6ac4f3b04fd123df
- SHA512 3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96
- SSDEEP 96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
- TLSH T1EEE1603263F441EDF9DB0B346C334B291D75BC21EA21957F2691098D3DB1A44EE227B6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5017
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb
user32
wsprintfW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
kernel32
lstrlenW
lstrcpyW
lstrcpynW
lstrcatW
GlobalAlloc
GetSystemDirectoryW
GlobalFree
GetComments
GetCompanyName
GetFileDescription
GetFileVersion
GetInternalName
GetLegalCopyright
GetLegalTrademarks
GetOSUserinterfaceLanguage
GetOriginalFilename
GetPrivateBuild
GetProductName
GetProductVersion
GetSpecialBuild
GetUserDefined
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=13, id=1, productName=Unmarked objects,
count=2, id=113, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, productName=Unmarked objects (old),
count=1, id=120, productName=VS2005 build 50727, version=50727,
$PLUGINSDIR/System.dll
- IMPHASH 039bcbc605477e8e87ec550c2e60e748
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- TLSH T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
10024
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary
user32
wsprintfW
ole32
CLSIDFromString
StringFromGUID2
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
963B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=1, productName=Unmarked objects,
count=6, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=4, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/UAC.dll
- IMPHASH c4a726be6ec458c19b16bf3893cf4bc1
- SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
- MD5 a88baad3461d2e9928a15753b1d93fd7
- SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
- SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
- SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
- TLSH T1CC526C5421D84BBFD24156383ADB776346B9FB316C62818FC6A349CB6871693A93E302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetLastError
lstrcmpiW
GetCurrentThreadId
GetProcAddress
GetCommandLineW
UnmapViewOfFile
WaitForSingleObject
GetCurrentProcessId
SetEvent
GetVersionExW
SetCurrentDirectoryW
MapViewOfFile
Sleep
OpenProcess
GetExitCodeProcess
GetExitCodeThread
CreateThread
CreateFileMappingW
CreateEventW
lstrlenW
GlobalAlloc
CreateProcessW
GetLastError
FormatMessageW
LocalFree
GlobalFree
CloseHandle
GetModuleFileNameW
lstrcatW
GetPrivateProfileIntW
GetPrivateProfileStringW
DuplicateHandle
LoadLibraryA
user32
SetWindowsHookExW
DispatchMessageW
TranslateMessage
IsDialogMessageW
PeekMessageW
MsgWaitForMultipleObjects
DefWindowProcW
PostMessageW
SetForegroundWindow
CreateWindowExW
GetWindowThreadProcessId
CallWindowProcW
SetWindowPos
GetWindowRect
UnhookWindowsHookEx
GetClassNameW
CallNextHookEx
CharNextW
DialogBoxParamW
MessageBoxW
EndDialog
SetWindowLongW
LoadImageW
GetWindowLongW
EnableWindow
ShowWindow
wsprintfW
LoadStringW
GetDlgItem
SendMessageW
DestroyWindow
advapi32
GetUserNameW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
LookupPrivilegeValueW
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
OpenThreadToken
AdjustTokenPrivileges
OpenProcessToken
shell32
ShellExecuteExW
ole32
CoInitialize
_
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=79, id=1, productName=Unmarked objects,
count=11, id=93, version=2179,
count=3, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/execDos.dll
- IMPHASH a5d239ed12c9442d63c73cb9ff7cad0e
- SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
- MD5 0deb397ca1e716bb7b15e1754e52b2ac
- SHA1 fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
- SHA512 507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
- SSDEEP 96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
- TLSH T153C1E73AF2E409B3C2A806343EA6A42B17F9D02B071409B7876321CC6CD0DB8FE74256
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
6324
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFree
Sleep
lstrcatW
lstrcmpiW
TerminateProcess
ReadFile
GetExitCodeProcess
PeekNamedPipe
CreateFileW
FlushFileBuffers
WriteFile
lstrlenW
CloseHandle
CreateProcessW
DuplicateHandle
GetCurrentProcess
CreatePipe
GetProcAddress
GetModuleHandleW
GlobalAlloc
GetExitCodeThread
WaitForSingleObject
CreateThread
lstrcpyW
lstrcpynW
user32
wsprintfW
GetClassNameW
GetDlgItem
FindWindowExW
SendMessageW
exec
isdone
wait
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
334B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=32, id=1, productName=Unmarked objects,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
$PLUGINSDIR/newadvsplash.dll
- IMPHASH 7efb019e000b6e0291c32d00fe622590
- SHA256 0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06
- MD5 55a723e125afbc9b3a41d46f41749068
- SHA1 01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c
- SHA512 559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c
- SSDEEP 96:/VV0Rwtvrm2nQujIvP9dir3UniV/zRzVR3rN3k8Jd18tsPcaqhx:/VV0KtC2yH9d83BzVR53kEQFaq
- TLSH T17702C73972C169F3D26B05F82D526B2E0FEEA035135650228B33A4DA3DA0353FD26747
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6913
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
CloseHandle
WaitForSingleObject
GetProcAddress
lstrlenW
CreateThread
GetCurrentThreadId
Sleep
lstrcpyW
lstrcmpiW
GlobalAlloc
GlobalFree
lstrcpynW
user32
DefWindowProcW
DestroyWindow
IsWindowVisible
UnregisterClassW
EnumDisplaySettingsW
SendMessageW
wsprintfW
SystemParametersInfoW
EndPaint
SetWindowPos
LoadCursorW
RegisterClassW
CreateWindowExW
IsWindow
GetMessageW
SetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
SetWindowLongW
GetClientRect
TranslateMessage
DispatchMessageW
PostMessageW
SetWindowRgn
BeginPaint
gdi32
CombineRgn
GetObjectW
CreateCompatibleDC
SelectObject
GetDIBits
CreateRectRgn
DeleteObject
winmm
timeSetEvent
PlaySoundW
timeKillEvent
oleaut32
OleLoadPicturePath
msvcrt
_lseek
memset
memcmp
_read
memcpy
_wopen
_close
wcstol
hwnd
play
show
stop
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
318B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
596B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=3, id=19, version=8022,
count=57, id=1, productName=Unmarked objects,
count=9, id=19, version=8034,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
$PLUGINSDIR/newtextreplace.dll
- IMPHASH 42624ab02b71999959eb0f4168f609bb
- SHA256 156b9b583399faf13c4d46b89339fb0f7f38dc847ac2d7872178d8e3998b9734
- MD5 b5358341df2cb171876a5f201e31a834
- SHA1 df34750ea5504274be5ff8ddd306b49e302d04f9
- SHA512 821dc42e24fa2d44a1d4d16b26c3da2688dac0fa44a266e38da2aff706c91440d83a87abc74131930e6c38a44a0c5e627db2d045375fde147e0edd3276f4b014
- SSDEEP 192:GGhRfigbU26niqo9m+9k15AA1NrW0QfaDx3nxNLr6s+:GIwgSnhv/IaDx3n6X
- TLSH T11832965F729645F6EA2259B00FCFF67B8E90C005402B4F6CB79A896CB933E84710D195
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4288
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
AddAtomA
CloseHandle
CopyFileW
CreateFileW
FindAtomA
GetAtomNameA
GetFileAttributesW
GetFileSize
GlobalAlloc
GlobalFree
MultiByteToWideChar
ReadFile
SetFileAttributesW
SetFilePointer
WideCharToMultiByte
WriteFile
lstrcmpiW
lstrcpyW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW
msvcrt
__dllonexit
_assert
_errno
abort
fflush
free
malloc
memset
user32
CharUpperA
wsprintfW
_FillReadBuffer
_FindInFile
_FreeReadBuffer
_ReplaceInFile
_Unload
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
$PLUGINSDIR/nsExec.dll
- IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
- SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
- MD5 132e6153717a7f9710dcea4536f364cd
- SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
- SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
- SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
- TLSH T1A4C1E5B656D909F3E41D00B83E31241F43FEE5260B7A03719E8B2AC61CD2AB6FD58791
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpyW
MultiByteToWideChar
lstrlenA
lstrcmpiW
lstrlenW
ExitProcess
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
lstrcpynW
GetCommandLineW
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
GetModuleHandleW
GetTickCount
GetStartupInfoW
CreatePipe
GetVersionExW
GlobalLock
DeleteFileW
lstrcatW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CopyFileW
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
GetProcAddress
PeekNamedPipe
GetCurrentProcess
user32
CharPrevW
CharNextW
SendMessageW
FindWindowExW
wsprintfW
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
454B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=46, id=1, productName=Unmarked objects,
count=3, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/registry.dll
- IMPHASH f450890bf454de37198f435d5832e67d
- SHA256 acb79c55b3b9c460d032a6f3aaf6c642bf8c1d450e23279d091cc0c6ca510973
- MD5 2880bf3bbbc8dcaeb4367df8a30f01a8
- SHA1 cb5c65eae4ae923514a67c95ada2d33b0c3f2118
- SHA512 ca978702ce7aa04f8d9781a819a57974f9627e969138e23e81e0792ff8356037c300bb27a37a9b5c756220a7788a583c8e40cc23125bcbe48849561b159c4fa3
- SSDEEP 768:HsKZwhFkGOr0Ga4+8DFFHR4mmw5+64fuKwX13:HLKmGOr0Ga4+8DFFHRrmw5+m
- TLSH T117D20980D64091A5E4F678FEB7D2633B462D6BB00553A09713F33E57AD68704BB2392E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19271
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyW
FindClose
FindFirstFileW
lstrcmpW
GetFileSize
SetFilePointer
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
WriteFile
CloseHandle
lstrlenW
lstrcpynW
lstrcmpiW
lstrcatW
GlobalAlloc
ReadFile
GlobalFree
user32
wsprintfW
CharUpperW
SendMessageW
FindWindowExW
GetDlgItem
advapi32
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumValueW
RegDeleteValueW
RegQueryValueExW
RegCloseKey
_Close
_CopyKey
_CopyValue
_CreateKey
_DeleteKey
_DeleteKeyEmpty
_DeleteValue
_Find
_HexToStr
_HexToStrUTF16LE
_KeyExists
_MoveKey
_MoveValue
_Open
_Read
_ReadExtra
_RestoreKey
_SaveKey
_StrToHex
_StrToHexUTF16LE
_Unload
_Write
_WriteExtra
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
356KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=1, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=19, version=8034,
count=33, id=1, productName=Unmarked objects,
count=1, id=21, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,