04d1ffad25e9541cf1c0d2a054aba4b2cd2ca03c764cbf62bf8900cb92a38221

Sharing

Copy URL

Twitter E-mail

General

Target

04d1ffad25e9541cf1c0d2a054aba4b2cd2ca03c764cbf62bf8900cb92a38221
Size

26.0MB
MD5

b787375c18ed250e4c1df7e068ffa66a
SHA1

a60810c5416d38597ab62eb6ff3a46926a299b19
SHA256

04d1ffad25e9541cf1c0d2a054aba4b2cd2ca03c764cbf62bf8900cb92a38221
SHA512

9d1b06b9afbe22a8d2ab4e51f46b075b7adf2e16c6bf0b0a470627bdbdd60dcc099648307110e23afb17d7caa832c0eec2616e306e0bf98bee48cb34270179de
SSDEEP

786432:Ue3UtIfD/qKHQjzA1dHZhJuPutC2LU/GpEFZy7CkHg:UntIr/Twg1tTTLQFuC+g

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/TheWorldPortable/Application/6.2.0.128/plugins/npAliSecCtrl.dll	acprotect
static1/unpack001/TheWorldPortable/Application/6.2.0.128/plugins/npaliedit.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/TheWorldPortable/Application/6.2.0.128/plugins/npAliSecCtrl.dll	upx
static1/unpack001/TheWorldPortable/Application/6.2.0.128/plugins/npaliedit.dll	upx

Files

04d1ffad25e9541cf1c0d2a054aba4b2cd2ca03c764cbf62bf8900cb92a38221
.rar
TheWorldPortable/Application/6.2.0.128/Locales/en-us.pak
TheWorldPortable/Application/6.2.0.128/Locales/zh-cn.pak
TheWorldPortable/Application/6.2.0.128/chrome.dll
.dll windows x86

6e5c28d547ec6ccd369016933d4f74dd

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

19:9d:f8:9e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:51:1c:86:3b:fa:13
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

01/07/2013, 10:20

Not After

04/10/2016, 09:41

Subject

CN=北京世界星辉科技有限责任公司,O=北京世界星辉科技有限责任公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c13737570706f727440746865776f726c642e636e

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

aa:2f:dc:13:ae:c5:c1:42:22:82:44:dd:df:e2:ac:ee:93:c4:80:f6
Signer

Actual PE Digest

aa:2f:dc:13:ae:c5:c1:42:22:82:44:dd:df:e2:ac:ee:93:c4:80:f6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=北京世界星辉科技有限责任公司,O=北京世界星辉科技有限责任公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c13737570706f727440746865776f726c642e636e

17/04/2014, 09:46
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileExA
ExitThread
FindFirstFileExW
SetFileAttributesA
PeekNamedPipe
CompareStringW
MulDiv
GetOverlappedResult
GetSystemPowerStatus
LoadLibraryW
SetErrorMode
LoadLibraryA
HeapDestroy
InterlockedPopEntrySList
GetProcessHeap
InterlockedPushEntrySList
DefineDosDeviceW
SetThreadExecutionState
GlobalGetAtomNameW
OpenThread
GetThreadTimes
GetTempFileNameA
GetSystemDirectoryA
GetPrivateProfileStringW
GlobalSize
GetNamedPipeInfo
CreateNamedPipeW
ConnectNamedPipe
WTSGetActiveConsoleSessionId
VerifyVersionInfoW
VerSetConditionMask
GetUserDefaultUILanguage
AreFileApisANSI
GetDiskFreeSpaceW
LockFileEx
GetFileAttributesA
UnlockFileEx
GetFullPathNameW
GetDiskFreeSpaceA
GetVolumeInformationA
GetLogicalDrives
GlobalMemoryStatus
GetComputerNameA
GetTempPathA
SetEnvironmentVariableA
GetSystemTime
CreateFileMappingA
CreateSemaphoreA
DeleteFileA
MoveFileA
ReleaseSemaphore
GetDriveTypeA
LockFile
UnlockFile
GetFullPathNameA
GetThreadLocale
InitializeCriticalSection
GetNumberFormatW
GetCurrencyFormatW
GetTimeZoneInformation
GetTimeFormatW
GetDateFormatW
GetComputerNameExW
GetFileSizeEx
CancelIo
Process32NextW
Process32FirstW
FileTimeToLocalFileTime
GetShortPathNameW
GetFileTime
LockResource
GlobalAlloc
UnregisterWaitEx
RegisterWaitForSingleObject
GetFileInformationByHandle
SetFileTime
SetFilePointerEx
GetWindowsDirectoryW
GetSystemDirectoryW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetModuleHandleExA
CreateThread
SetThreadPriority
lstrcmpiA
lstrcmpA
GetUserDefaultLangID
VirtualQueryEx
GlobalMemoryStatusEx
GetProcessTimes
AssignProcessToJobObject
AllocConsole
SetPriorityClass
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
GetProcAddress
GetModuleHandleW
ExitProcess
GetCurrentThreadId
GetCommandLineA
IsProcessorFeaturePresent
GetLastError
SetConsoleCtrlHandler
InterlockedIncrement
InterlockedDecrement
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
InterlockedExchange
GetLocaleInfoW
WriteFile
GetStdHandle
GetModuleFileNameW
Sleep
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
SetStdHandle
WriteConsoleW
MultiByteToWideChar
LCMapStringW
GetStringTypeW
CreateFileW
CloseHandle
FlushFileBuffers
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InterlockedCompareExchange
CreateEventW
CreateMutexW
WaitForSingleObject
GetExitCodeProcess
GetProcessId
DuplicateHandle
GetLongPathNameW
GetTempPathW
Module32FirstW
CreateToolhelp32Snapshot
Module32NextW
ExpandEnvironmentStringsW
GetGeoInfoW
GetUserGeoID
FormatMessageW
LocalFree
OutputDebugStringW
lstrlenW
RaiseException
lstrcmpiW
QueueUserWorkItem
lstrcpyW
GetFileSize
VirtualFree
VirtualAlloc
DeleteFileW
GetCommandLineW
SetEvent
IsProcessInJob
QueryInformationJobObject
OpenEventW
ReleaseMutex
FindVolumeClose
GetDriveTypeW
GetVolumePathNameW
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
QueryDosDeviceW
DeviceIoControl
GetDiskFreeSpaceExW
FindFirstVolumeW
GetVolumeNameForVolumeMountPointW
GetVolumeInformationW
FreeConsole
AttachConsole
GetConsoleDisplayMode
InterlockedExchangeAdd
GlobalLock
GlobalUnlock
GlobalFree
FindResourceW
LoadResource
LoadLibraryExW
SizeofResource
GetModuleHandleA
FlushInstructionCache
GetThreadContext
VirtualQuery
VirtualProtect
SuspendThread
ResumeThread
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapSize
HeapSetInformation
GetEnvironmentVariableA
GetSystemInfo
FindClose
SwitchToThread
GetVersionExW
Module32First
Module32Next
CreateFileA
SetEndOfFile
CreateProcessW
FormatMessageA
OutputDebugStringA
GetEnvironmentVariableW
TryEnterCriticalSection
GetModuleHandleExW
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
QueryPerformanceFrequency
SetEnvironmentVariableW
RtlCaptureStackBackTrace
GetTempFileNameW
MapViewOfFile
UnmapViewOfFile
MoveFileExW
GetLogicalDriveStringsW
CreateDirectoryW
CopyFileW
GetFileAttributesW
ReplaceFileW
ReadFile
GetCurrentDirectoryW
MoveFileW
CreateFileMappingW
SetCurrentDirectoryW
RemoveDirectoryW
GetFileAttributesExW
LocalAlloc
GetNativeSystemInfo
OpenProcess
OpenFileMappingW
FindFirstChangeNotificationW
FindCloseChangeNotification
FindFirstFileW
FindNextFileW
ResetEvent
WaitForMultipleObjects

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

netapi32

Netbios

wtsapi32

WTSRegisterSessionNotification
WTSFreeMemory
WTSUnRegisterSessionNotification
WTSQueryUserToken
WTSQuerySessionInformationW

gdiplus

GdipDeleteGraphics
GdipSetSmoothingMode
GdipCreateFromHDC
GdipSetPenStartCap
GdipDrawLineI
GdipCreatePen1
GdiplusStartup
GdipDeletePen
GdipSetPenEndCap

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

usp10

ScriptLayout
ScriptStringOut
ScriptCPtoX
ScriptXtoCP
ScriptStringFree
ScriptGetFontProperties
ScriptPlace
ScriptStringAnalyse
ScriptItemize
ScriptFreeCache
ScriptShape

psapi

GetModuleFileNameExW
QueryWorkingSet
GetProcessMemoryInfo
GetMappedFileNameW

winmm

waveInAddBuffer
waveInMessage
waveInStart
waveInReset
waveInOpen
waveInUnprepareHeader
waveInClose
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutReset
waveOutClose
waveOutWrite
waveOutOpen
waveOutRestart
timeBeginPeriod
waveOutPause
waveInPrepareHeader
waveInGetNumDevs
waveOutGetNumDevs
timeGetTime
timeEndPeriod

shlwapi

SHDeleteKeyW
SHStrDupW
SHGetValueA
PathFileExistsW
SHSetValueA
SHGetValueW
SHDeleteEmptyKeyW
SHCopyKeyW
PathIsUNCW
UrlCreateFromPathW
PathRemoveExtensionW
PathFindExtensionW
PathFindFileNameW
PathFileExistsA
PathIsUNCA
StrStrNIW
UrlCreateFromPathA

user32

PostThreadMessageW
FillRect
GetWindowRect
IntersectRect
EqualRect
MonitorFromRect
DestroyIcon
OpenInputDesktop
CloseDesktop
SystemParametersInfoW
GetLastInputInfo
GetUserObjectInformationW
RegisterDeviceNotificationW
UnregisterDeviceNotification
IsWindow
GetWindowThreadProcessId
EnumThreadWindows
DestroyWindow
UnregisterClassW
RegisterClassExW
GetWindowLongW
SetWindowLongW
CreateWindowExW
DefWindowProcW
LoadIconW
wsprintfW
OpenWindowStationA
SendMessageTimeoutW
MessageBoxW
SetForegroundWindow
GetParent
GetForegroundWindow
GetAncestor
IsWindowVisible
MsgWaitForMultipleObjects
TranslateMessage
PeekMessageW
DispatchMessageW
SetWindowPos
GetGuiResources
AllowSetForegroundWindow
GetProcessWindowStation
CloseWindowStation
CharNextW
SetProcessWindowStation
GetWindow
MapWindowPoints
SetLayeredWindowAttributes
EnumChildWindows
EnumWindows
SetParent
GetKeyState
IsZoomed
GetActiveWindow
IsChild
SendMessageW
ClientToScreen
MonitorFromWindow
ReleaseDC
GetDC
SetRectEmpty
IsRectEmpty
GetMessagePos
GetMessageTime
CopyRect
SetWindowTextW
EnableWindow
GetSystemMetrics
ReleaseCapture
UnhookWindowsHookEx
SetWindowsHookExW
ShowWindow
RedrawWindow
GetWindowRgn
EnableMenuItem
InvalidateRect
UnionRect
FlashWindowEx
OffsetRect
GetWindowPlacement
GetCapture
GetUpdateRect
BeginPaint
SetFocus
GetClientRect
IsWindowEnabled
CallNextHookEx
LoadCursorW
TrackMouseEvent
SetCapture
IsIconic
GetWindowDC
ScreenToClient
GetSystemMenu
SetWindowRgn
UpdateLayeredWindow
SetCursor
SetWindowPlacement
EndPaint
AdjustWindowRectEx
ActivateKeyboardLayout
CallWindowProcW
UpdateWindow
GetCaretPos
GetWindowTextW
GetKeyboardLayout
GetDoubleClickTime
GetClassInfoExW
GetFocus
NotifyWinEvent
GetWindowTextLengthW
PostMessageW
CharUpperW
WaitForInputIdle
GetMonitorInfoW
FindWindowW
FindWindowExW
MsgWaitForMultipleObjectsEx
CallMsgFilterW
GetQueueStatus
WaitMessage
KillTimer
PostQuitMessage
SetTimer
SetClipboardData
OpenClipboard
EmptyClipboard
GetClipboardData
SetRect
IsClipboardFormatAvailable
CloseClipboard
MoveWindow
GetWindowInfo
MonitorFromPoint
GetSysColor
GetIconInfo
CreateIconIndirect
DrawIconEx
LoadImageW
MapVirtualKeyW
RegisterClipboardFormatW
GetClipboardSequenceNumber
WindowFromPoint
GetMessageExtraInfo
GetClassNameW
TrackPopupMenu
GetCursorPos
EnumDisplayMonitors
GetKeyboardLayoutList
SetCaretPos
CreateCaret
DestroyCaret
GetKeyboardState
keybd_event
GetPropW
LoadStringW
SetPropW
RegisterWindowMessageW
LoadAcceleratorsW
CopyAcceleratorTableW
GetAsyncKeyState
SetMenuItemInfoW
GetMenuItemCount
InsertMenuItemW
GetMenuItemInfoW
EndDeferWindowPos
BeginDeferWindowPos
DeferWindowPos
PtInRect
ShowCaret
HideCaret
MessageBeep
GetClassLongW
SetScrollInfo
IsHungAppWindow
SendNotifyMessageW
EnumDisplaySettingsW
ScrollWindowEx
ClipCursor
SendMessageCallbackW
EndDialog
RemovePropW
DestroyMenu
EndMenu
GetMenuInfo
SetMenuInfo
CreatePopupMenu
GetMenuState
DrawTextExW
GetSubMenu
RegisterRawInputDevices
DefRawInputProc
GetRawInputData
SetCursorPos
ShowCursor
GetClipCursor
RealChildWindowFromPoint
GetUpdateRgn
ScrollDC
AttachThreadInput
DrawFrameControl
FrameRect
GetSysColorBrush
InflateRect
DrawFocusRect
DrawEdge
InvertRect
UnregisterClassA
GetDesktopWindow

gdi32

StretchDIBits
SetWorldTransform
GetStockObject
CloseEnhMetaFile
CreateEnhMetaFileW
GdiComment
CancelDC
DeleteDC
GetDeviceCaps
SetAbortProc
CreateDCW
StartDocW
EndDoc
GetBkColor
GetICMProfileW
Rectangle
SaveDC
ModifyWorldTransform
LineTo
StretchBlt
PatBlt
SetICMMode
GetRegionData
PtInRegion
MoveToEx
RestoreDC
CreatePolygonRgn
SetRectRgn
CombineRgn
SetDIBitsToDevice
CreateCompatibleBitmap
CreateBitmap
SetDIBits
GetTextExtentPoint32W
CreateFontW
StrokePath
ExtCreatePen
GetCurrentObject
SetMiterLimit
CreatePen
GetStretchBltMode
GetTextColor
StrokeAndFillPath
BeginPath
AbortPath
SetBrushOrgEx
SetDCBrushColor
SetBkColor
SetArcDirection
SelectClipRgn
EndPath
SetDCPenColor
SetPolyFillMode
SetStretchBltMode
PolyBezier
SetROP2
PathToRegion
GdiAlphaBlend
GetObjectW
SetTextColor
GdiFlush
RemoveFontMemResourceEx
SetBkMode
ExtTextOutW
GetOutlineTextMetricsW
GetTextExtentPointI
GetFontUnicodeRanges
GetCharABCWidthsW
AddFontMemResourceEx
GetTextFaceW
EnumFontFamiliesExW
GetGlyphOutlineW
SetTextAlign
GetFontData
GetGlyphIndicesW
CreateSolidBrush
RectInRegion
ExcludeClipRect
GetRgnBox
CreateRectRgnIndirect
CreateRectRgn
EqualRgn
GetTextMetricsW
SetMapMode
CreateFontIndirectW
EndPage
BitBlt
GetEnhMetaFileW
SetGraphicsMode
DeleteEnhMetaFile
ExtEscape
EnumEnhMetaFile
GetEnhMetaFileBits
StartPage
CreateDIBSection
GetEnhMetaFileHeader
DeleteObject
SelectObject
GetWorldTransform
CreateCompatibleDC
PlayEnhMetaFile
SetEnhMetaFileBits
PlayEnhMetaFileRecord

advapi32

GetFileSecurityW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
CryptDestroyKey
CryptGenKey
CryptAcquireContextW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
CreateProcessAsUserW
RegEnumValueW
RegNotifyChangeKeyValue
GetTraceEnableFlags
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetFileSecurityW
RegCreateKeyExW
GetUserNameW
CryptDestroyHash
CryptCreateHash
CryptSignHashW
CryptReleaseContext
CryptGetHashParam
CryptSetHashParam
RegOpenKeyExA
RegQueryValueExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
TraceEvent
GetTraceLoggerHandle

ole32

CoCreateGuid
CoSetProxyBlanket
OleInitialize
OleUninitialize
DoDragDrop
OleDuplicateData
RevokeDragDrop
CoCreateInstance
RegisterDragDrop
CoTaskMemFree
CoUninitialize
CLSIDFromProgID
StringFromGUID2
CoInitializeEx
CLSIDFromString
CoTaskMemRealloc
CoInitialize
ReleaseStgMedium
CoTaskMemAlloc
PropVariantClear

oleaut32

SafeArrayGetLBound
VariantInit
SafeArrayDestroy
SafeArrayUnlock
SafeArrayCreate
SystemTimeToVariantTime
SafeArrayRedim
VariantClear
SafeArrayGetUBound
VarUI4FromStr
SysAllocString
SafeArrayGetVartype
SafeArrayLock
SysFreeString

comctl32

InitCommonControlsEx

oleacc

LresultFromObject
AccessibleObjectFromWindow

secur32

DeleteSecurityContext
FreeContextBuffer
AcquireCredentialsHandleW
InitializeSecurityContextW
QuerySecurityPackageInfoW
FreeCredentialsHandle

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreateSequential

Exports

Exports

ChromeMain
RelaunchChromeBrowserWithNewCommandLineIfNeeded

Sections

.text
Size: 10.7MB - Virtual size: 10.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 113KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.unwante
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 583KB - Virtual size: 582KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TheWorldPortable/Application/6.2.0.128/chrome_100_percent.pak
.js
TheWorldPortable/Application/6.2.0.128/chrome_child.dll
.dll windows x86

ba9b28b4e03d921ea18084a1dd999839

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

19:9d:f8:9e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:51:1c:86:3b:fa:13
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

01/07/2013, 10:20

Not After

04/10/2016, 09:41

Subject

CN=北京世界星辉科技有限责任公司,O=北京世界星辉科技有限责任公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c13737570706f727440746865776f726c642e636e

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:ed:e5:2c:01:93:3b:2b:5b:36:d2:af:4f:a8:97:37:35:5a:34:99
Signer

Actual PE Digest

16:ed:e5:2c:01:93:3b:2b:5b:36:d2:af:4f:a8:97:37:35:5a:34:99

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=北京世界星辉科技有限责任公司,O=北京世界星辉科技有限责任公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c13737570706f727440746865776f726c642e636e

17/04/2014, 09:46
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathW
GetPrivateProfileIntW
GetFileTime
lstrlenW
RaiseException
OpenProcess
MoveFileExW
CreateDirectoryW
FindFirstFileExW
CopyFileW
FindClose
FindNextFileW
DeleteFileW
SetFileAttributesW
CompareFileTime
LoadLibraryExW
FindResourceExW
FindResourceW
LoadResource
SizeofResource
LockResource
CreateFileA
VirtualFree
VirtualAlloc
InitializeCriticalSection
GetLongPathNameW
lstrlenA
ReadProcessMemory
lstrcmpiA
VirtualProtect
WriteProcessMemory
FlushInstructionCache
TerminateThread
GetExitCodeThread
DuplicateHandle
SuspendThread
FindFirstFileW
VirtualQuery
GlobalLock
GlobalAlloc
GetVersionExW
GlobalUnlock
GlobalFree
LocalAlloc
RemoveDirectoryW
lstrcmpiW
GetPrivateProfileStringW
GetWindowsDirectoryW
FileTimeToLocalFileTime
LocalFree
WaitForSingleObject
SetEvent
SetThreadPriority
CreateEventW
ResumeThread
GlobalSize
DisableThreadLibraryCalls
SetCurrentDirectoryW
GetThreadContext
SetThreadContext
GetTempFileNameW
GetModuleHandleA
CreateProcessW
GetCommandLineW
CreateMutexW
FormatMessageA
OutputDebugStringA
ReleaseMutex
GetEnvironmentVariableW
InterlockedExchangeAdd
TryEnterCriticalSection
GetModuleHandleExW
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
ReadFile
FileTimeToSystemTime
QueryPerformanceFrequency
SetEnvironmentVariableW
RtlCaptureStackBackTrace
MapViewOfFile
UnmapViewOfFile
GetFileAttributesW
GetCurrentDirectoryW
CreateFileMappingW
QueryDosDeviceW
GetFileAttributesExW
SetEndOfFile
GetFileInformationByHandle
GetUserDefaultLangID
ExpandEnvironmentStringsW
GetNativeSystemInfo
ResetEvent
WaitForMultipleObjects
AllocConsole
AttachConsole
GetModuleHandleExA
HeapSetInformation
CreateThread
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
GetSystemDirectoryW
RegisterWaitForSingleObject
UnregisterWaitEx
CreateToolhelp32Snapshot
GetFullPathNameW
GetFullPathNameA
UnlockFile
LockFile
UnlockFileEx
FormatMessageW
GetFileAttributesA
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
GetDiskFreeSpaceA
GetSystemInfo
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
GetThreadLocale
GetTimeZoneInformation
GetDateFormatW
GetDriveTypeW
GetUserDefaultUILanguage
ConnectNamedPipe
CreateNamedPipeW
GetNamedPipeInfo
CancelIo
GetFileSizeEx
GetSystemDirectoryA
ReleaseSemaphore
CreateSemaphoreW
GetTempFileNameA
GetThreadTimes
OpenThread
CreateSemaphoreA
GlobalDeleteAtom
GlobalAddAtomW
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapSize
GetEnvironmentVariableA
SwitchToThread
Module32First
Module32Next
HeapDestroy
GetProcessHeap
InterlockedPushEntrySList
InterlockedPopEntrySList
GetFileSize
InterlockedCompareExchange
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FlushFileBuffers
CloseHandle
CreateFileW
GetStringTypeW
LCMapStringW
MultiByteToWideChar
WriteConsoleW
SetStdHandle
RtlUnwind
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
SetHandleCount
Sleep
GetModuleFileNameW
GetStdHandle
WriteFile
GetLocaleInfoW
InterlockedExchange
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentThread
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedDecrement
InterlockedIncrement
IsProcessorFeaturePresent
SetConsoleCtrlHandler
GetLastError
GetCommandLineA
GetCurrentThreadId
ExitProcess
GetModuleHandleW
GetProcAddress
GetCurrentProcess
TerminateProcess
DecodePointer
EncodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocalTime
GetNumberFormatW
GetCurrencyFormatW
GetTimeFormatW
GetVolumeInformationA
GetLogicalDrives
GlobalMemoryStatus
GetComputerNameA
CreateFileMappingA
ExitThread
CreateDirectoryA
GetDriveTypeA
FindFirstFileExA
PeekNamedPipe
SetEnvironmentVariableA
CompareStringW
DefineDosDeviceW
DeviceIoControl
GetOverlappedResult
TzSpecificLocalTimeToSystemTime
MoveFileA
SetFileAttributesA
LoadLibraryW
SetErrorMode

urlmon

CoInternetCombineUrl
CoInternetGetSession
URLDownloadToFileW
RegisterBindStatusCallback
RevokeBindStatusCallback

gdiplus

GdipSaveImageToFile
GdipLoadImageFromStream
GdipFree
GdipAlloc
GdipGetImageEncodersSize
GdipDisposeImage
GdipGetImageEncoders
GdiplusShutdown
GdipCloneImage
GdiplusStartup

wininet

HttpQueryInfoW
InternetSetOptionA
HttpAddRequestHeadersA
InternetQueryOptionA
GetUrlCacheEntryInfoW
DeleteUrlCacheEntryW
InternetCanonicalizeUrlW
HttpQueryInfoA
GetUrlCacheEntryInfoExW
InternetCreateUrlW
InternetCrackUrlW
DeleteUrlCacheEntryA

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ws2_32

recvfrom
sendto
shutdown
accept
inet_ntoa
inet_addr
htonl
ntohs
getservbyport
getservbyname
__WSAFDIsSet
WSASetLastError
gethostbyaddr
getsockopt
select
htons
recv
socket
gethostbyname
send
listen
WSACloseEvent
getpeername
connect
WSARecvFrom
getsockname
setsockopt
bind
WSAGetOverlappedResult
WSACreateEvent
WSAResetEvent
WSASendTo
WSAStartup
WSAGetLastError
WSASocketW
ioctlsocket
closesocket

usp10

ScriptShape
ScriptCPtoX
ScriptFreeCache
ScriptItemize
ScriptPlace
ScriptGetFontProperties
ScriptXtoCP
ScriptJustify

psapi

GetModuleInformation
GetProcessMemoryInfo
QueryWorkingSet

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

shlwapi

PathGetCharTypeW
PathMatchSpecW
PathIsURLW
UrlIsOpaqueW
StrCmpIW
StrStrW
UrlCombineW
PathFileExistsW
PathRemoveFileSpecW
PathIsRootW
SHDeleteValueW
SHGetValueA
SHGetValueW
StrStrIW
StrStrA
PathAppendW
SHRegGetPathW

gdi32

DeleteObject
CreateSolidBrush
CreateDCA
GetCurrentObject
CreateCompatibleDC
GetObjectW
GetFontData
GetStockObject
SetMiterLimit
SetStretchBltMode
CreateCompatibleBitmap
SelectObject
StretchBlt
CreateDIBSection
DeleteDC
GetBitmapBits
GetCharWidthI
EnumFontFamiliesW
EndPage
GetEnhMetaFileW
ExtEscape
GetEnhMetaFileBits
StartPage
GetEnhMetaFileHeader
GetWorldTransform
PlayEnhMetaFile
SetEnhMetaFileBits
SaveDC
PlayEnhMetaFileRecord
GdiComment
RestoreDC
DeleteEnhMetaFile
StrokeAndFillPath
GetTextColor
GetStretchBltMode
CreatePen
Rectangle
ExtCreatePen
StrokePath
EnumEnhMetaFile
CloseEnhMetaFile
CreateEnhMetaFileW
CreateFontW
GdiAlphaBlend
CreateBitmap
StretchDIBits
ModifyWorldTransform
BeginPath
AbortPath
SetBrushOrgEx
SetDCBrushColor
SetBkColor
SetArcDirection
SelectClipRgn
CreateRectRgnIndirect
EndPath
SetDCPenColor
SetPolyFillMode
CreateRectRgn
PolyBezier
SetROP2
PathToRegion
SetGraphicsMode
GetTextMetricsW
SetTextColor
CreateFontIndirectW
GdiFlush
RemoveFontMemResourceEx
SetBkMode
ExtTextOutW
GetOutlineTextMetricsW
GetTextExtentPointI
GetFontUnicodeRanges
GetCharABCWidthsW
AddFontMemResourceEx
GetTextFaceW
SetWorldTransform
EnumFontFamiliesExW
GetGlyphOutlineW
SetTextAlign
GetGlyphIndicesW
BitBlt
GetDeviceCaps
GetDIBits

winspool.drv

ord203
DeviceCapabilitiesW
ClosePrinter
EnumPrintersW
DocumentPropertiesW
OpenPrinterW
GetPrinterDriverW
GetPrinterW

advapi32

RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegCloseKey
RegOpenKeyW
RegQueryValueExW
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptAcquireContextA
CryptDeriveKey
RegEnumValueW
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent
CryptSignHashW
CryptGetHashParam
CryptSetHashParam
CryptReleaseContext
UnregisterTraceGuids
GetTraceEnableLevel
RegisterTraceGuidsW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExA
RegOpenKeyExA

ole32

OleSetContainedObject
GetHGlobalFromStream
OleCreate
StringFromGUID2
CoUninitialize
OleUninitialize
CoTaskMemAlloc
CoCreateGuid
StringFromCLSID
OleInitialize
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoMarshalInterface
OleDraw
CoGetMalloc
ReleaseStgMedium
CoTaskMemRealloc
CoInitializeEx
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance
PropVariantClear

oleaut32

VarUI4FromStr
VariantChangeType
VarBstrCat
SysStringLen
SafeArrayPutElement
SysAllocStringLen
VariantInit
SafeArrayCreate
SafeArrayDestroy
SafeArrayCreateVector
VariantClear
SysAllocString
SysFreeString

imm32

ImmDisableIME
ImmGetContext
ImmAssociateContextEx
ImmReleaseContext
ImmGetCompositionStringW
ImmSetOpenStatus
ImmSetCandidateWindow

crypt32

CertFreeCertificateContext
CryptUnprotectData
CryptHashCertificate

Exports

Exports

ChromeMain
_ChromeIE_SetIEXMode@4
_ChromeIE_wWinMain@16

Sections

.text
Size: 13.8MB - Virtual size: 13.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 244KB - Virtual size: 537KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.unwante
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 861KB - Virtual size: 860KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TheWorldPortable/Application/6.2.0.128/ffmpegsumo.dll
.dll windows x86

73a2dd64f04b133a53423c18b442f276

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

29:12:c7:0c:9a:2b:8a:3e:f6:f6:07:46:62:d6:8b:8d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

29/01/2014, 00:00

Not After

29/01/2016, 23:59

Subject

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing+OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:4b:e4:ac:41:a6:e6:81:1e:54:8e:f5:0d:28:95:5f:7c:85:69:61
Signer

Actual PE Digest

01:4b:e4:ac:41:a6:e6:81:1e:54:8e:f5:0d:28:95:5f:7c:85:69:61

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing+OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

22/10/2014, 04:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
GetModuleHandleW
GetProcAddress
EnterCriticalSection
InterlockedExchangeAdd
GetCurrentProcess
GetProcessAffinityMask
MultiByteToWideChar
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
Sleep
GetSystemTimeAsFileTime
InitializeCriticalSection
CloseHandle
CreateSemaphoreW
InterlockedCompareExchange
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
WideCharToMultiByte
EncodePointer
DecodePointer
CreateThread
GetCurrentThreadId
ExitThread
LoadLibraryExW
CreateFileW
GetFileType
GetCommandLineA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
ExitProcess
GetModuleHandleExW
HeapFree
SetStdHandle
WriteFile
GetConsoleCP
GetConsoleMode
HeapAlloc
GetProcessHeap
ReadFile
ReadConsoleW
SetFilePointerEx
HeapReAlloc
HeapSize
HeapQueryInformation
GetTimeZoneInformation
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetModuleFileNameW
RtlUnwind
WriteConsoleW
SetEnvironmentVariableA
FlushFileBuffers
OutputDebugStringW

advapi32

CryptReleaseContext
CryptAcquireContextW
CryptGenRandom

Exports

Exports

av_bitstream_filter_close
av_bitstream_filter_filter
av_bitstream_filter_init
av_buffer_create
av_buffer_get_opaque
av_dict_get
av_dict_set
av_dup_packet
av_frame_alloc
av_frame_free
av_frame_unref
av_free
av_free_packet
av_get_bytes_per_sample
av_image_check_size
av_image_fill_linesizes
av_index_search_timestamp
av_init_packet
av_lockmgr_register
av_log_set_level
av_malloc
av_new_packet
av_opt_get_int
av_packet_copy_props
av_packet_get_side_data
av_packet_split_side_data
av_rdft_calc
av_rdft_end
av_rdft_init
av_read_frame
av_register_all
av_register_bitstream_filter
av_rescale_q
av_samples_get_buffer_size
av_seek_frame
avcodec_align_dimensions
avcodec_alloc_context3
avcodec_close
avcodec_decode_audio4
avcodec_decode_video2
avcodec_fill_audio_frame
avcodec_find_decoder
avcodec_flush_buffers
avcodec_free_context
avcodec_free_frame
avcodec_get_frame_defaults
avcodec_get_name
avcodec_open2
avformat_alloc_context
avformat_close_input
avformat_find_stream_info
avformat_free_context
avformat_open_input
avio_alloc_context
avio_close
avpriv_ac3_channel_layout_tab
avpriv_mpa_bitrate_tab
avpriv_mpa_freq_tab
avpriv_mpeg4audio_sample_rates
avpriv_pix_fmt_bps_avi
avpriv_pix_fmt_bps_mov
ff_raw_pix_fmt_tags

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TheWorldPortable/Application/6.2.0.128/gcswf32.dll
.dll regsvr32 windows x86

a37b9d88b764d22279be2b0dec6eaedc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:ed:67:42:55:61:4b:f4:ed:3e:d4:23:cc:93:ca:7d
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Flash Player,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1f:7d:ff:66:ce:ab:15:8c:9e:42:e0:f9:de:5d:db:7a:b3:4d:93:0b
Signer

Actual PE Digest

1f:7d:ff:66:ce:ab:15:8c:9e:42:e0:f9:de:5d:db:7a:b3:4d:93:0b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Flash Player,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

24/09/2014, 21:27
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueA

winmm

mixerClose
waveInMessage
waveOutMessage
waveOutGetDevCapsA
waveInGetDevCapsA
mixerGetID
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
waveOutGetDevCapsW
waveInGetDevCapsW
waveOutGetNumDevs
waveInGetNumDevs
waveInStart
mixerGetControlDetailsA
waveInStop
waveInClose
waveInUnprepareHeader
waveInReset
waveInPrepareHeader
waveInOpen
timeSetEvent
timeKillEvent
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutReset
waveOutClose
waveOutOpen
waveOutGetPosition
timeGetTime
waveOutRestart
waveOutPause
waveInGetPosition
waveInAddBuffer
mixerSetControlDetails

wininet

HttpSendRequestA
InternetReadFile
InternetCloseHandle
InternetSetOptionA
HttpOpenRequestA
InternetConnectA
InternetOpenA
HttpQueryInfoA

crypt32

CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCompareCertificateName
CryptFindOIDInfo
CertRDNValueToStrW
CertFindRDNAttr
CryptDecodeObjectEx
CertNameToStrW
CertVerifyTimeValidity
CertVerifyRevocation
CertOpenStore
CertAddStoreToCollection
CryptVerifyMessageSignature
CryptGetMessageCertificates
CertCreateCertificateContext
CertVerifySubjectCertificateContext
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CertCompareCertificate

rpcrt4

RpcStringFreeA
UuidToStringA

oleaut32

VariantClear
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysAllocString
SysStringLen
SysFreeString
VariantInit

urlmon

CopyStgMedium

dsound

ord8
ord1

dinput8

DirectInput8Create

kernel32

GetSystemInfo
GetUserDefaultUILanguage
MoveFileExW
VirtualQuery
GetUserDefaultLangID
GetVersionExA
SetFilePointer
VerifyVersionInfoW
VerSetConditionMask
CreateThread
ReadFile
GetFileSize
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
GetTimeZoneInformation
ReleaseSemaphore
CreateSemaphoreW
DeviceIoControl
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
GetLongPathNameW
GetTempPathA
GetFileAttributesA
CreateMutexA
SetFilePointerEx
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
OutputDebugStringA
TlsSetValue
ReleaseMutex
CreateFileMappingA
GetExitCodeThread
DuplicateHandle
TerminateThread
CreateWaitableTimerW
SetThreadPriority
GetSystemDirectoryA
CompareFileTime
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
SwitchToThread
HeapReAlloc
GetCommandLineA
RtlUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetProcessAffinityMask
HeapSize
HeapFree
GetProcessHeap
HeapAlloc
EnumSystemLocalesW
IsValidLocale
GetUserDefaultLCID
GetTimeFormatW
GetDateFormatW
CompareStringW
GetCurrencyFormatW
GetNumberFormatW
VirtualProtect
SetSystemTime
DebugBreak
CreateSemaphoreA
VirtualFree
VirtualAlloc
GetVersion
CancelWaitableTimer
GlobalAlloc
CreateWaitableTimerA
CreateEventA
FlushFileBuffers
SetEndOfFile
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetNativeSystemInfo
RegisterWaitForSingleObject
UnregisterWaitEx
GlobalMemoryStatusEx
IsDebuggerPresent
FileTimeToSystemTime
TlsAlloc
TlsFree
GetSystemTimeAsFileTime
GetStdHandle
ResumeThread
GetModuleHandleExA
OpenProcess
CreateToolhelp32Snapshot
Thread32First
GetThreadTimes
Thread32Next
InitializeCriticalSectionAndSpinCount
FormatMessageA
CreateProcessW
CreateFileMappingW
CreateMutexW
GetNamedPipeInfo
CreateNamedPipeW
CancelIo
ConnectNamedPipe
InterlockedExchangeAdd
ExitProcess
TerminateProcess
GetConsoleMode
LCMapStringA
SetConsoleCtrlHandler
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
HeapDestroy
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetWaitableTimer
GlobalSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
EnumSystemLocalesA
CompareStringA
SetEnvironmentVariableA
LocalAlloc
lstrcpynW
GlobalMemoryStatus
FlushConsoleInputBuffer
lstrlenA
ReadConsoleInputA
SetConsoleMode
TlsGetValue
InitializeCriticalSection
GlobalLock
GlobalUnlock
UnmapViewOfFile
MapViewOfFile
GetProcessTimes
GlobalFree
GetEnvironmentVariableA
CreateDirectoryA
GetCurrentDirectoryA
GetTempFileNameA
CreateFileA
WriteFile
DeleteFileA
GetCurrentProcessId
GetModuleHandleA
CreateProcessA
WideCharToMultiByte
CreateDirectoryW
GetFileAttributesW
CreateFileW
GetFileSizeEx
GetSystemTime
SystemTimeToFileTime
FindFirstFileW
RemoveDirectoryW
DeleteFileW
FindNextFileW
FindClose
GetModuleFileNameA
FindResourceA
SizeofResource
LoadResource
LockResource
OpenFile
_lwrite
_lclose
FreeResource
GetModuleFileNameW
lstrlenW
SetLastError
GetCurrentProcess
FlushInstructionCache
RaiseException
LCMapStringW
GetTickCount
GetCurrentThreadId
GetLocaleInfoW
TryEnterCriticalSection
LoadLibraryW
GetVersionExW
LoadLibraryA
GetProcAddress
WaitForMultipleObjects
GetLastError
FreeLibrary
WaitForSingleObject
ResetEvent
CloseHandle
CreateEventW
SetEvent
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
ExpandEnvironmentStringsW
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetConsoleCP

user32

GetMonitorInfoA
MonitorFromRect
EnumDisplayMonitors
RegisterWindowMessageA
PostMessageA
SetWindowLongA
GetWindowLongA
DefWindowProcA
LoadIconA
LoadCursorA
RegisterClassExA
UnregisterClassW
CallMsgFilterW
MsgWaitForMultipleObjectsEx
WaitMessage
MsgWaitForMultipleObjects
GetClassNameA
CallNextHookEx
GetUpdateRect
ValidateRect
RemovePropW
SetWindowsHookExW
GetUserObjectInformationW
SetActiveWindow
SetParent
UpdateWindow
GetAncestor
IsIconic
ShowWindowAsync
MapWindowPoints
GetWindowTextW
GetWindowPlacement
IsZoomed
GetSystemMenu
FlashWindowEx
GetActiveWindow
MoveWindow
SetCaretPos
CreateCaret
ShowCaret
DestroyCaret
EnumDisplayDevicesW
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
GetProcessWindowStation
wsprintfW
GetDesktopWindow
MonitorFromWindow
EnumDisplaySettingsW
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
RemoveMenu
SetMenuItemInfoW
GetMenuItemInfoW
InsertMenuItemW
GetForegroundWindow
SetRect
EnumDisplayDevicesA
CreatePopupMenu
TrackPopupMenu
DestroyMenu
DrawMenuBar
GetMenuInfo
CreateMenu
SetMenuInfo
MapVirtualKeyW
CharUpperW
CharLowerW
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CloseWindow
OffsetRect
CreateWindowExW
ShowWindow
SetWindowPlacement
GetWindow
GetWindowTextLengthW
DestroyWindow
GetDoubleClickTime
DeleteMenu
UnhookWindowsHookEx
WaitForInputIdle
MessageBoxA
DialogBoxParamW
SetWindowTextA
RedrawWindow
DialogBoxIndirectParamW
SetWindowTextW
SendMessageTimeoutW
CreateIconIndirect
GetMonitorInfoW
SetRectEmpty
GetCursor
DestroyIcon
LoadImageW
GetPropW
SetPropW
PtInRect
InflateRect
GetClipboardFormatNameA
RegisterClipboardFormatA
SetWindowPos
RegisterClassA
CreateWindowExA
SetCapture
ReleaseCapture
SetCursorPos
GetSubMenu
GetCapture
SystemParametersInfoW
ScreenToClient
GetMessageTime
GetCursorPos
WindowFromPoint
LoadIconW
RegisterClassW
PeekMessageW
GetQueueStatus
KillTimer
SetTimer
IsWindowVisible
PostMessageW
GetFocus
GetParent
GetWindowThreadProcessId
AttachThreadInput
GetDlgItem
IsWindow
EnableWindow
SendMessageW
InvalidateRect
GetKeyState
ReleaseDC
LoadStringW
MessageBoxW
SetCursor
EnableMenuItem
CheckMenuItem
FillRect
GetDC
BeginPaint
GetClientRect
EndPaint
GetSystemMetrics
EndDialog
UnregisterClassA
SetFocus
GetWindowInfo
CopyRect
RegisterClassExW
CallWindowProcW
PostQuitMessage
LoadCursorW
GetClassInfoExW
SetWindowLongW
DefWindowProcW
ClientToScreen
SendInput
ActivateKeyboardLayout
GetKeyboardLayout
GetWindowLongW
GetWindowRect
UpdateLayeredWindow

gdi32

EnumFontFamiliesExW
CreateDCW
GetFontData
RestoreDC
SaveDC
SelectClipPath
PolyBezierTo
SetPolyFillMode
EndPath
BeginPath
EndPage
StartPage
FillPath
ExtCreatePen
StrokePath
EndDoc
StartDocW
CreatePalette
GetWorldTransform
SetGraphicsMode
SetWorldTransform
GetTextCharacterExtra
DPtoLP
EnumFontFamiliesA
GetCurrentObject
CreatePen
MoveToEx
LineTo
SetTextCharacterExtra
GetBkColor
SelectClipRgn
GetTextColor
GetBkMode
GetTextAlign
SetBkMode
SetTextAlign
CreateRectRgn
GetClipRgn
IntersectClipRect
CreateFontIndirectA
SetTextColor
GetTextMetricsW
GetTextExtentPoint32W
ExtTextOutA
GetTextExtentPoint32A
CreateFontIndirectW
CreateBitmap
SetPixel
CreateDCA
GetICMProfileA
SelectPalette
RealizePalette
RectVisible
LPtoDP
StretchDIBits
GetStockObject
Rectangle
GetDeviceCaps
GetSystemPaletteEntries
GetClipBox
CreateSolidBrush
EnumFontFamiliesW
GetStretchBltMode
CreateCompatibleBitmap
SetStretchBltMode
SetBkColor
ExtTextOutW
BitBlt
StretchBlt
GdiAlphaBlend
CreateDIBSection
GetObjectW
SelectObject
DeleteObject
GdiFlush
DeleteDC
CreateCompatibleDC

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
PrintDlgW

advapi32

CryptDecrypt
CryptSetKeyParam
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptAcquireContextA
CryptCreateHash
RegisterEventSourceA
ReportEventA
DeregisterEventSource
IsValidSid
CryptImportKey
CryptGenKey
CryptDestroyKey
CryptExportKey
CryptEncrypt
RegOpenKeyA
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegCreateKeyExA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegDeleteValueA
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyA
RegQueryValueExW

shell32

SHGetFolderPathW
SHGetFolderPathA
SHGetPathFromIDListW
SHBrowseForFolderW
SHAppBarMessage
SHGetFolderLocation
SHGetSettings
ord165
ShellExecuteW
SHGetDiskFreeSpaceExW
SHGetSpecialFolderPathW
SHFileOperationW

ole32

OleGetClipboard
OleInitialize
CoUninitialize
CoSetProxyBlanket
CoInitializeEx
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
PropVariantClear
CoFreeUnusedLibraries
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
OleUninitialize
ReleaseStgMedium
CreateBindCtx
MkParseDisplayName
CoInitialize

ws2_32

WSAAsyncSelect
closesocket
WSACleanup
WSAStartup
WSASocketA
ntohl
select
gethostname
connect
WSAGetLastError
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
WSAAddressToStringA
bind
sendto
setsockopt
recv
send
ntohs
getsockname
WSAIoctl
socket
ioctlsocket
WSASocketW
htons
WSACloseEvent
gethostbyname
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
recvfrom
inet_addr

shlwapi

StrStrIW
StrRStrIW
UrlCanonicalizeW
AssocQueryStringW
PathRemoveFileSpecA

mscms

OpenColorProfileW
CreateColorTransformW
CloseColorProfile
TranslateBitmapBits
DeleteColorTransform

iphlpapi

GetAdaptersAddresses

winspool.drv

GetPrinterW
ClosePrinter
OpenPrinterW

Exports

Exports

AdobeCPGetAPI
BrokerMainW
DllRegisterServer
DllUnregisterServer
FlashPlayer_15_0_0_189_FlashPlayer
Flash_DisableLocalSecurity
Flash_EnforceLocalSecurity
IAEModule_AEModule_PutKernel
IAEModule_IAEKernel_LoadModule
IAEModule_IAEKernel_UnloadModule
Java_ShockwaveFlash_CurrentFrame_stub
Java_ShockwaveFlash_FlashVersion_stub
Java_ShockwaveFlash_FrameLoaded_stub
Java_ShockwaveFlash_GetVariable_stub
Java_ShockwaveFlash_GotoFrame_stub
Java_ShockwaveFlash_IsPlaying_stub
Java_ShockwaveFlash_LoadMovie_stub
Java_ShockwaveFlash_Pan_stub
Java_ShockwaveFlash_PercentLoaded_stub
Java_ShockwaveFlash_Play_stub
Java_ShockwaveFlash_SetVariable_stub
Java_ShockwaveFlash_SetZoomRect_stub
Java_ShockwaveFlash_StopPlay_stub
Java_ShockwaveFlash_TCallFrame_stub
Java_ShockwaveFlash_TCallLabel_stub
Java_ShockwaveFlash_TCurrentFrame_stub
Java_ShockwaveFlash_TCurrentLabel_stub
Java_ShockwaveFlash_TGetProperty_stub
Java_ShockwaveFlash_TGotoFrame_stub
Java_ShockwaveFlash_TGotoLabel_stub
Java_ShockwaveFlash_TPlay_stub
Java_ShockwaveFlash_TSetProperty_stub
Java_ShockwaveFlash_TStopPlay_stub
Java_ShockwaveFlash_TotalFrames_stub
Java_ShockwaveFlash_Zoom_stub
NP_Acrobat_GetEntryPoints
NP_Acrobat_Initialize
NP_GetEntryPoints
NP_Initialize
NP_SetBrokerClient
NP_SetNPAPIHostProxy
NP_Shutdown
native_ShockwaveFlash_CurrentFrame
native_ShockwaveFlash_FlashVersion
native_ShockwaveFlash_FrameLoaded
native_ShockwaveFlash_GetVariable
native_ShockwaveFlash_GotoFrame
native_ShockwaveFlash_IsPlaying
native_ShockwaveFlash_LoadMovie
native_ShockwaveFlash_Pan
native_ShockwaveFlash_PercentLoaded
native_ShockwaveFlash_Play
native_ShockwaveFlash_SetVariable
native_ShockwaveFlash_SetZoomRect
native_ShockwaveFlash_StopPlay
native_ShockwaveFlash_TCallFrame
native_ShockwaveFlash_TCallLabel
native_ShockwaveFlash_TCurrentFrame
native_ShockwaveFlash_TCurrentLabel
native_ShockwaveFlash_TGetProperty
native_ShockwaveFlash_TGotoFrame
native_ShockwaveFlash_TGotoLabel
native_ShockwaveFlash_TPlay
native_ShockwaveFlash_TSetProperty
native_ShockwaveFlash_TStopPlay
native_ShockwaveFlash_TotalFrames
native_ShockwaveFlash_Zoom
register_ShockwaveFlash
unregister_ShockwaveFlash
unuse_ShockwaveFlash
unuse_netscape_plugin_Plugin
use_ShockwaveFlash
use_netscape_plugin_Plugin

Sections

.text
Size: 11.4MB - Virtual size: 11.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 801KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 586KB - Virtual size: 585KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TheWorldPortable/Application/6.2.0.128/icudt.dll
.dll windows x86

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

19:9d:f8:9e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:51:1c:86:3b:fa:13
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

01/07/2013, 10:20

Not After

04/10/2016, 09:41

Subject

CN=北京世界星辉科技有限责任公司,O=北京世界星辉科技有限责任公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c13737570706f727440746865776f726c642e636e

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:d7:95:3a:c3:b7:58:52:e7:21:73:3f:44:49:d7:d8:68:40:6d:89
Signer

Actual PE Digest

65:d7:95:3a:c3:b7:58:52:e7:21:73:3f:44:49:d7:d8:68:40:6d:89

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=北京世界星辉科技有限责任公司,O=北京世界星辉科技有限责任公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c13737570706f727440746865776f726c642e636e

17/04/2014, 09:46
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

icudt46_dat

Sections

.rdata
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TheWorldPortable/Application/6.2.0.128/ieswitcher
TheWorldPortable/Application/6.2.0.128/ieswitcher-journal
TheWorldPortable/Application/6.2.0.128/plugins/Bak/敬告.txt
TheWorldPortable/Application/6.2.0.128/plugins/np115upload.dll
.dll windows x86

c885ba32c6dbb2238e87640375b18052

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:a8:81:79:c1:49:1a:88:6c:4a:07:6c:ae:f4:dc:81
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

12/08/2013, 00:00

Not After

11/10/2015, 23:59

Subject

CN=广东一一五科技有限公司,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=运营中心,O=广东一一五科技有限公司,L=东莞,ST=广东,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

be:01:8c:7e:24:64:18:db:75:f7:73:2d:76:ad:30:af:85:ed:27:cd
Signer

Actual PE Digest

be:01:8c:7e:24:64:18:db:75:f7:73:2d:76:ad:30:af:85:ed:27:cd

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=广东一一五科技有限公司,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=运营中心,O=广东一一五科技有限公司,L=东莞,ST=广东,C=CN

20/08/2014, 08:50
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

zlibwapi

ord135
ord82
ord83
ord84
ord130

kernel32

GetDriveTypeA
GetTempPathW
GetFileAttributesW
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
GetFileAttributesA
GetModuleFileNameA
GetCurrentThreadId
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
Sleep
CreateMutexW
CloseHandle
WaitForSingleObject
ReleaseMutex
FindClose
FileTimeToDosDateTime
FileTimeToLocalFileTime
FindFirstFileA
QueryPerformanceCounter
CreateEventW
SetEvent
GetConsoleOutputCP
WriteConsoleA
CreateFileW
SetEndOfFile
GetTimeZoneInformation
GetProcessHeap
CreateFileA
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetStdHandle
FlushFileBuffers
HeapReAlloc
VirtualAlloc
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
LoadLibraryW
GetCurrentDirectoryA
HeapSize
GetModuleHandleA
GetCurrentProcessId
VirtualFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
RaiseException
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedCompareExchange
GetLocaleInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RtlUnwind
SetEnvironmentVariableA
FileTimeToSystemTime
GetDriveTypeW
FindFirstFileW
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
GetLocalTime
DeleteFileW
MoveFileW
CreateDirectoryW
ExitThread
CreateThread
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetFullPathNameW
FindNextFileW
ReadFile
SetFilePointer
GetModuleHandleW
GetProcAddress
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
GetTimeFormatA
GetDateFormatA
CompareStringA
CompareStringW
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
WriteFile
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings

user32

MessageBoxA
PostMessageW
DefWindowProcW
SetWindowLongW

comdlg32

GetOpenFileNameW

shell32

SHGetPathFromIDListW
ShellExecuteA
ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHGetFolderPathA
SHBrowseForFolderW

ws2_32

closesocket
send
sendto
shutdown
inet_addr
setsockopt
WSAStartup
socket
recvfrom
recv
ioctlsocket
WSAGetLastError
__WSAFDIsSet
select
connect
htons
gethostbyname
getsockname
getpeername
getsockopt

iphlpapi

GetAdaptersInfo

Exports

Exports

NP_GetEntryPoints
NP_GetMIMEDescription
NP_Initialize
NP_Shutdown

Sections

.text
Size: 815KB - Virtual size: 814KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TheWorldPortable/Application/6.2.0.128/plugins/np360upload.dll
.dll regsvr32 windows x86

4a303404b6fbc586646616a464199c7b

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11/03/2013, 00:00

Not After

10/03/2016, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:9f:da:ed:70:84:9b:8c:cc:05:cc:85:7b:d8:e4:36:09:cf:0c:a5
Signer

Actual PE Digest

27:9f:da:ed:70:84:9b:8c:cc:05:cc:85:7b:d8:e4:36:09:cf:0c:a5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

28/04/2014, 07:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SuspendThread
ResumeThread
FindFirstFileW
GetModuleFileNameW
FlushFileBuffers
SetLastError
FindClose
FindNextFileW
FreeLibrary
LoadLibraryW
GetProcAddress
Sleep
GetModuleHandleW
DeviceIoControl
GetCurrentProcessId
GetThreadLocale
RaiseException
lstrcpyA
GlobalFree
GlobalAlloc
GetCurrentDirectoryW
GetFileAttributesExW
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
GetCurrentThreadId
WaitForSingleObject
GetTickCount
DeleteFileW
DeleteCriticalSection
GetLocalTime
EnterCriticalSection
MoveFileW
GetFileSizeEx
GetFileSize
LeaveCriticalSection
InitializeCriticalSection
WriteFile
DeleteAtom
FindAtomW
ReleaseMutex
AddAtomW
OpenThread
GetAtomNameW
CreateMutexW
GetSystemTime
FormatMessageW
OutputDebugStringW
SetFilePointerEx
LocalFileTimeToFileTime
lstrcmpiA
lstrcmpA
SetFilePointer
CreateFileW
ReadFile
SetThreadLocale
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateFileA
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
GetModuleHandleA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
InterlockedDecrement
InterlockedIncrement
CloseHandle
SetEvent
CreateEventA
LockResource
GetLastError
SizeofResource
LoadResource
GetUserDefaultLCID
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapCreate
FindResourceW
FindResourceExW
GetModuleFileNameA
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
LoadLibraryExW
ReleaseSemaphore
GetCurrentProcess
GetSystemTimeAsFileTime
MulDiv
FlushInstructionCache
lstrcmpiW
DuplicateHandle
CreateSemaphoreA
InterlockedExchange
TlsAlloc
TlsFree
TlsGetValue
SetWaitableTimer
InterlockedCompareExchange
TlsSetValue
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
SystemTimeToFileTime
OpenEventA
GetProcessHeap
HeapAlloc
ResetEvent
HeapFree
CreateWaitableTimerW
FormatMessageA
LocalFree
HeapDestroy
HeapReAlloc
HeapSize
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetFileAttributesW
ExitProcess
GetCommandLineA

user32

GetClientRect
SystemParametersInfoW
GetDlgItem
SetWindowPos
CallWindowProcW
EqualRect
ReleaseDC
UnionRect
IntersectRect
OffsetRect
RegisterClassExW
GetClassInfoExW
PtInRect
SetFocus
GetFocus
GetKeyState
IsChild
SetForegroundWindow
SetWindowRgn
DestroyWindow
SetCursor
GetWindowRect
UnregisterClassA
FindWindowExW
SendMessageW
EnableWindow
SetWindowTextW
MoveWindow
GetForegroundWindow
PostThreadMessageW
EndPaint
PostQuitMessage
LoadCursorW
DefWindowProcW
MessageBoxW
PostMessageW
CreateWindowExW
ScreenToClient
PeekMessageW
SetWindowLongW
GetWindowTextW
GetWindowLongW
InvalidateRect
IsWindow
ShowWindow
GetActiveWindow
KillTimer
SetTimer
CharNextW
BeginPaint
EnumWindows
GetDC

gdi32

CreateRectRgnIndirect
TextOutW
GetStockObject
RestoreDC
SaveDC
SetMapMode
CreateDCW
GetDeviceCaps
DeleteDC
LPtoDP
SetViewportOrgEx
SetWindowOrgEx
SetTextAlign

shell32

SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
SHBrowseForFolderW
DragFinish
DragQueryFileW
DragAcceptFiles
ShellExecuteW

oleaut32

SysFreeString
RegisterTypeLi
UnRegisterTypeLi
SafeArrayCopy
SafeArrayGetUBound
SysStringByteLen
SafeArrayGetVartype
SafeArrayLock
SafeArrayRedim
VariantChangeType
SafeArrayCreate
SafeArrayUnlock
SafeArrayDestroy
SysAllocStringByteLen
VariantCopy
VariantCopyInd
SafeArrayGetLBound
LoadRegTypeLi
VarUI4FromStr
OleCreatePropertyFrame
VariantInit
LoadTypeLi
VariantClear
SysStringLen
SysAllocStringLen
SysAllocString

comdlg32

GetOpenFileNameW
CommDlgExtendedError

advapi32

RegQueryInfoKeyW
RegEnumKeyExA
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW

shlwapi

PathRemoveFileSpecW
PathIsRootW
PathFileExistsW
PathCombineW
SHGetValueA
SHSetValueA
SHGetValueW

ws2_32

WSAStartup
WSACleanup

netapi32

Netbios

ole32

StringFromGUID2
CoTaskMemFree
CreateOleAdviseHolder
OleRegGetMiscStatus
CoTaskMemAlloc
CoCreateInstance
OleRegEnumVerbs
CoTaskMemRealloc
OleRegGetUserType

wininet

InternetQueryOptionW

urlmon

CreateURLMonikerEx
CreateAsyncBindCtx
IsValidURL

psapi

EnumProcessModules

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 215KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TheWorldPortable/Application/6.2.0.128/plugins/npAliSecCtrl.dll
.dll regsvr32 windows x86

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

16:3e:81:d2:9a:21:58:8e:19:62:7a:69:00:a5:6a:7c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2013, 00:00

Not After

24/08/2014, 23:59

Subject

CN=Alipay.com Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Operations Department,O=Alipay.com Co.\,Ltd,L=hangzhou,ST=zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:fe:15:1b:d6:20:3e:e0:8b:47:8e:9a:fb:a1:bf:52:26:02:90:c5
Signer

Actual PE Digest

70:fe:15:1b:d6:20:3e:e0:8b:47:8e:9a:fb:a1:bf:52:26:02:90:c5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Alipay.com Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Operations Department,O=Alipay.com Co.\,Ltd,L=hangzhou,ST=zhejiang,C=CN

28/10/2013, 08:36
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

UPX0
Size: - Virtual size: 468KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 306KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TheWorldPortable/Application/6.2.0.128/plugins/npUploader.dll
.dll windows x86

a9cdbbe084599f80ba2ac7dac910b903

Code Sign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

11:21:df:76:75:aa:a0:8d:1b:49:a8:3a:48:0f:14:85:5d:24
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

22/02/2012, 09:18

Not After

22/02/2015, 09:18

Subject

CN=Baidu (China) Co.\, Ltd.,O=Baidu (China) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
SetEvent
OutputDebugStringW
GetTickCount
GetSystemTimeAsFileTime
WriteFile
InitializeCriticalSection
TlsSetValue
LeaveCriticalSection
FileTimeToSystemTime
CreateFileW
GetLastError
EnterCriticalSection
CreateFileMappingW
GetExitCodeThread
CreateEventW
WaitForMultipleObjects
QueryPerformanceFrequency
DeleteCriticalSection
GetCurrentThreadId
ReleaseMutex
TlsAlloc
CloseHandle
WriteFileEx
GetCurrentProcessId
TlsFree
CreateThread
ExpandEnvironmentStringsW
FindFirstFileW
FindClose
FindResourceExW
FindResourceW
LoadResource
SizeofResource
LockResource
OutputDebugStringA
TerminateThread
Sleep
CreateDirectoryW
GetModuleHandleW
GlobalAlloc
WideCharToMultiByte
GetVolumeInformationA
GetModuleFileNameW
GlobalFree
DeviceIoControl
GetTempPathW
FindNextFileW
DeleteFileW
SetEndOfFile
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
QueryPerformanceCounter
UnmapViewOfFile
MapViewOfFile
TlsGetValue
SetFilePointer
CreateMutexW
GetEnvironmentVariableW
SetStdHandle
GetModuleHandleA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetStringTypeW
SetEnvironmentVariableA
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetProcessHeap
HeapReAlloc
VirtualAlloc
lstrcatW
lstrlenW
MultiByteToWideChar
lstrcpynW
CompareStringW
CompareStringA
ReadFile
FreeLibrary
LoadLibraryW
IsBadCodePtr
GetProcAddress
ResetEvent
GetVersionExW
OpenMutexW
lstrlenA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapFree
HeapAlloc
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
SetLastError
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree

user32

SendMessageW
MessageBoxW
wsprintfW
WindowFromPoint
GetCursorPos

comdlg32

GetOpenFileNameW

advapi32

RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegNotifyChangeKeyValue

shell32

SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderLocation

ole32

CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateGuid

wininet

InternetOpenW
InternetOpenUrlW
InternetSetOptionW
HttpQueryInfoW
InternetCloseHandle
InternetReadFile
InternetConnectW
HttpAddRequestHeadersW
HttpOpenRequestW
HttpSendRequestExW
InternetWriteFile
HttpEndRequestW
HttpSendRequestA

iphlpapi

NotifyAddrChange
GetAdaptersInfo
NotifyRouteChange

ws2_32

WSAGetLastError

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 446KB - Virtual size: 446KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TheWorldPortable/Application/6.2.0.128/plugins/npactivex.dll
.dll regsvr32 windows x86

bf33495dcd96ae5c34a0dd16ea4bce72

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/01/2013, 00:00

Not After

16/02/2016, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:e5:78:ad:31:b0:c6:f7:a3:d4:c4:26:d1:a3:e3:08:a6:ae:3f:1a
Signer

Actual PE Digest

06:e5:78:ad:31:b0:c6:f7:a3:d4:c4:26:d1:a3:e3:08:a6:ae:3f:1a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

13/08/2014, 08:36
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
OutputDebugStringA
GetLastError
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
EnterCriticalSection
RaiseException
DeleteCriticalSection
MultiByteToWideChar
GetModuleFileNameW
EncodePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
DecodePointer
HeapFree
HeapAlloc
HeapDestroy

advapi32

RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyW
RegQueryValueExW

shell32

ShellExecuteW

ole32

CoCreateInstance
CLSIDFromProgID

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocStringLen
SysStringLen
SysAllocString

shlwapi

SHDeleteKeyW

msvcr100

_vscprintf
vsprintf_s
memcpy_s
memmove_s
wcslen
strcpy_s
strnlen
wcsnlen
wcscmp
free
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
strlen
printf
??2@YAPAXI@Z
_purecall
??3@YAXPAX@Z
_CxxThrowException
memset
__CxxFrameHandler3

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TheWorldPortable/Application/6.2.0.128/plugins/npalidcp.dll
.dll windows x86

4cab4106a8e2d7d25af2597cab7a0a38

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

16:3e:81:d2:9a:21:58:8e:19:62:7a:69:00:a5:6a:7c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2013, 00:00

Not After

24/08/2014, 23:59

Subject

CN=Alipay.com Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Operations Department,O=Alipay.com Co.\,Ltd,L=hangzhou,ST=zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:45:a8:c2:48:54:d3:c1:14:03:41:8d:00:54:c2:5c:1d:09:bc:70
Signer

Actual PE Digest

43:45:a8:c2:48:54:d3:c1:14:03:41:8d:00:54:c2:5c:1d:09:bc:70

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Alipay.com Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Operations Department,O=Alipay.com Co.\,Ltd,L=hangzhou,ST=zhejiang,C=CN

28/10/2013, 08:36
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
SizeofResource
MultiByteToWideChar
LockResource
GetLastError
HeapFree
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
RaiseException
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
FindResourceExA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
WriteFile
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
InitializeCriticalSection
GetProcessHeap
LoadResource
GetEnvironmentStringsW
FindResourceA

user32

SetWindowLongA
DefWindowProcA

advapi32

RegOpenKeyExA
RegCloseKey

ole32

CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

SysAllocStringLen
SysStringByteLen
SysFreeString
SysAllocStringByteLen

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TheWorldPortable/Application/6.2.0.128/plugins/npaliedit.dll
.dll regsvr32 windows x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:99:06:35:8e:2a:07:ac:b5:76:1c:04:70:ac:6f:44
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/04/2011, 23:59

Subject

CN=Alipay.com Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alipay.com Co.\,Ltd,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:b5:9c:5c:2e:b9:44:9c:a5:1d:21:c4:ac:51:da:12:51:9e:ad:fb
Signer

Actual PE Digest

03:b5:9c:5c:2e:b9:44:9c:a5:1d:21:c4:ac:51:da:12:51:9e:ad:fb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Alipay.com Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alipay.com Co.\,Ltd,L=Hangzhou,ST=Zhejiang,C=CN

01/04/2010, 09:24
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

DllRegisterServer
DllUnregisterServer
NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

UPX0
Size: - Virtual size: 376KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TheWorldPortable/Application/6.2.0.128/plugins/nptxftnWebKit.dll
.dll windows x86

f72619357f1f0c16b97042f9ee90041b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/01/2013, 00:00

Not After

16/02/2016, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9a:76:56:6e:6d:c0:3d:83:ab:9a:65:9b:f4:96:82:f8:5e:b6:a3:29
Signer

Actual PE Digest

9a:76:56:6e:6d:c0:3d:83:ab:9a:65:9b:f4:96:82:f8:5e:b6:a3:29

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

05/03/2014, 03:10
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

nspr4

PR_NewLogModule
PR_GetOSError
PR_GetError
PR_GetFileInfo
PR_DestroyCondVar
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_MillisecondsToInterval
PR_IntervalNow
PR_WaitCondVar
PR_IntervalToMilliseconds
PR_NewCondVar
PR_Unlock
PR_Lock
PR_DestroyLock
PR_NewLock
PR_GetCurrentThread
PR_CreateThread
PR_JoinThread
PR_NewTCPSocket
PR_Connect
PR_GetHostByName
PR_EnumerateHostEnt
PR_Shutdown
PR_SetSocketOption
PR_GetSocketOption
PR_Recv
PR_Send
PR_Now
PR_GetFileInfo64
PR_Sleep
PR_Seek64
PR_htonl
PR_htons
PR_ntohl
PR_Open
PR_Close
PR_GetOpenFileInfo64
PR_Read
PR_LogPrint

plc4

PL_strlen
PL_strcpy
PL_strnlen

kernel32

InitializeCriticalSection
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetTimeZoneInformation
SetStdHandle
FreeLibrary
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoW
LoadLibraryA
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
ReadFile
ExitProcess
HeapSize
IsValidCodePage
GetOEMCP
HeapReAlloc
VirtualAlloc
FatalAppExitA
VirtualFree
HeapCreate
CloseHandle
CreateFileA
WideCharToMultiByte
GetACP
MultiByteToWideChar
Sleep
FindClose
FindFirstFileA
CreateThread
HeapDestroy
GetModuleFileNameA
GetStdHandle
WriteFile
GetCurrentThread
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
GetModuleHandleA
GetCPInfo
LCMapStringW
LCMapStringA
GetProcessHeap
HeapAlloc
GetVersionExA
GetCommandLineA
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
SetEnvironmentVariableA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
GetCurrentThreadId

user32

ShowWindow
SetWindowPos
GetFocus
IsWindowEnabled
EnableWindow
CallMsgFilterA
IsWindow
SetFocus
MessageBoxA
GetParent
SetPropA
RemovePropA
SendMessageA
GetPropA
GetDesktopWindow
GetWindowRect

comdlg32

GetOpenFileNameA

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TheWorldPortable/Application/6.2.0.128/plugins/npxunlei.dll
.dll windows x86

9290dca8117c7c3c34f238e585fb7a40

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0c:ff:7b:32:9c:ff:7f:3b:8d:2d:54:2a:b2:58:26:ba
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/09/2013, 00:00

Not After

23/06/2015, 23:59

Subject

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Operate,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:93:14:f3:da:d9:57:16:f2:90:ce:95:d5:1e:82:40:02:8b:37:1d
Signer

Actual PE Digest

4b:93:14:f3:da:d9:57:16:f2:90:ce:95:d5:1e:82:40:02:8b:37:1d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Operate,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN

11/08/2014, 09:04
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocaleInfoA
GetThreadLocale
GetVersionExW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetACP
SetStdHandle
CloseHandle
GetSystemInfo
VirtualProtect
LCMapStringW
InterlockedExchange
LCMapStringA
SetFilePointer
FlushFileBuffers
GetStringTypeW
ExitProcess
RtlUnwind
HeapFree
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
SetUnhandledExceptionFilter
VirtualQuery
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
GetOEMCP
GetCPInfo
GetStringTypeA

user32

SetWindowLongW
DefWindowProcW
EndPaint
BeginPaint
GetClientRect
FrameRect
GetWindowLongW

gdi32

GetStockObject

ole32

CoInitialize
CLSIDFromProgID
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString
SysAllocString

shlwapi

StrCpyNW

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TheWorldPortable/Application/6.2.0.128/resources.pak
.js
TheWorldPortable/Application/TheWorld.exe
.exe windows x86

4b9d708940aa9fa37788f45ee815afe6

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

19:9d:f8:9e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:51:1c:86:3b:fa:13
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

01/07/2013, 10:20

Not After

04/10/2016, 09:41

Subject

CN=北京世界星辉科技有限责任公司,O=北京世界星辉科技有限责任公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c13737570706f727440746865776f726c642e636e

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:c4:55:b5:aa:47:03:41:ee:cd:fe:5b:67:6b:c0:bf:67:35:be:fa
Signer

Actual PE Digest

0b:c4:55:b5:aa:47:03:41:ee:cd:fe:5b:67:6b:c0:bf:67:35:be:fa

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=北京世界星辉科技有限责任公司,O=北京世界星辉科技有限责任公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c13737570706f727440746865776f726c642e636e

17/04/2014, 09:46
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

shlwapi

PathRemoveFileSpecW
SHGetValueA

kernel32

GetCurrentProcessId
VirtualProtect
InterlockedExchangeAdd
VirtualAllocEx
GetLastError
GetFullPathNameW
GetTempPathW
TerminateProcess
Sleep
VirtualFreeEx
CreateRemoteThread
GetTickCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcess
SetUnhandledExceptionFilter
CreateProcessW
CloseHandle
CreateFileW
GetVersionExW
VirtualQuery
GetFileSize
LocalFree
GetModuleHandleA
FormatMessageW
SetCurrentDirectoryW
GetModuleFileNameW
LoadLibraryExW
SetEnvironmentVariableA
LocalAlloc
FreeLibrary
InterlockedExchange
LoadLibraryA
RaiseException
UnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
ExitProcess
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
WriteFile
GetStdHandle
GetLocaleInfoW
InterlockedIncrement
InterlockedDecrement
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
WideCharToMultiByte
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
RtlUnwind
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
FlushFileBuffers
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
OutputDebugStringA
GetDriveTypeW
GetProcAddress
WaitForSingleObject
GetExitCodeProcess
CreateEventW
GetUserDefaultUILanguage
DuplicateHandle
FindResourceW
LoadResource
SizeofResource
LockResource
VirtualFree
ReadFile
VirtualAlloc
GetSystemInfo
GetUserDefaultLangID
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateMutexW
ReleaseMutex
lstrlenW
ExpandEnvironmentStringsW
GetProcessTimes
OpenProcess
GetProcessId
GetNativeSystemInfo
MapViewOfFile
CompareStringW
GetFileAttributesW
GetCurrentDirectoryW
GetLongPathNameW
CreateFileMappingW
QueryDosDeviceW
SetInformationJobObject
SetHandleInformation
AssignProcessToJobObject
ResumeThread
QueryPerformanceFrequency
GetSystemDirectoryW
GetWindowsDirectoryW
CreateThread
SetEndOfFile
GetModuleHandleExW
RegisterWaitForSingleObject
UnregisterWaitEx
CreateToolhelp32Snapshot
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
SetEvent
ResetEvent
WaitForMultipleObjects
GetThreadContext
RtlCaptureContext
VirtualQueryEx
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
SuspendThread
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
VirtualProtectEx
WriteProcessMemory
TerminateJobObject
GetProcessHandleCount
SignalObjectAndWait
CreateJobObjectW
CreateNamedPipeW
OpenEventW
SearchPathW
DebugBreak
ReadProcessMemory
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapSize
SwitchToThread
Module32First
Module32Next
GetEnvironmentVariableA
LoadLibraryW
GetCommandLineW
GetProcessHeap
GetTimeZoneInformation
CreateDirectoryW

advapi32

GetTokenInformation
OpenProcessToken
RegEnumKeyExW
RegQueryInfoKeyW
ConvertSidToStringSidW
CreateProcessAsUserW
RegDisablePredefinedCache
RevertToSelf
SetThreadToken
SetTokenInformation
ConvertStringSidToSidW
GetLengthSid
CopySid
CreateWellKnownSid
CreateRestrictedToken
EqualSid
DuplicateToken
LookupPrivilegeValueW
DuplicateTokenEx
GetSecurityInfo
SetEntriesInAclW
RegSetValueExA
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW

user32

MessageBoxW
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CreateWindowStationW
GetProcessWindowStation
wsprintfW
GetWindowThreadProcessId
AllowSetForegroundWindow
IsWindow
SendMessageTimeoutW
CharUpperW
FindWindowExW
CloseDesktop
CloseWindowStation
GetUserObjectInformationW

userenv

GetProfileType

winmm

timeGetTime

Exports

Exports

ClearCrashKeyValueImpl
CrashForException
DumpProcess
DumpProcessWithoutCrash
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
SetClientId
SetCrashKeyValueImpl
SetExperimentList3

Sections

.text
Size: 368KB - Virtual size: 367KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TheWorldPortable/TheWorld6-Set.exe
.exe windows x86

bbaee7abf2d1791bc23f1a6c6d164f09

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

midiStreamOut
midiOutPrepareHeader
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
waveOutPause
waveOutReset
waveOutClose
waveOutGetNumDevs
waveOutOpen
midiOutUnprepareHeader
midiStreamOpen
midiStreamStop
midiOutReset
midiStreamClose
midiStreamRestart
midiStreamProperty

ws2_32

WSAAsyncSelect
closesocket
recvfrom
ioctlsocket
inet_ntoa
recv
WSACleanup
accept
getpeername

kernel32

SetLastError
GetTimeZoneInformation
GetVersion
GetACP
HeapSize
RaiseException
GetLocalTime
GetSystemTime
GetStartupInfoA
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
lstrcpynA
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetFileSize
SetFilePointer
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
ReadFile
GetLastError
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
WinExec
lstrcpyA
FindNextFileA
InterlockedExchange
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetVersionExA
WritePrivateProfileStringA
CreateThread
CreateEventA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileA
FindClose
GetFileAttributesA
DeleteFileA
CopyFileA
CreateDirectoryA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
WaitForSingleObject
CloseHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
RtlUnwind

user32

GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
DeleteMenu
GetSystemMenu
DefWindowProcA
GetClassInfoA
IsZoomed
PostQuitMessage
CopyAcceleratorTableA
GetKeyState
TranslateAcceleratorA
IsWindowEnabled
ShowWindow
SystemParametersInfoA
LoadImageA
EnumDisplaySettingsA
ClientToScreen
EnableMenuItem
GetSubMenu
GetDlgCtrlID
CreateAcceleratorTableA
CreateMenu
ModifyMenuA
AppendMenuA
GetMessagePos
CreatePopupMenu
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
SetRect
InflateRect
IntersectRect
GetSysColorBrush
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
IsRectEmpty
ReleaseDC
IsChild
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
GetFocus
GetParent
GetTopWindow
PostMessageA
IsWindow
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBoxA
GetCursorPos
GetSystemMetrics
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
DrawIconEx
CreateIconFromResource
CreateIconFromResourceEx
RegisterClipboardFormatA
SetRectEmpty
DispatchMessageA
GetMessageA
DrawFocusRect
DrawEdge
DrawFrameControl
TranslateMessage
LoadIconA
GetForegroundWindow
GetDesktopWindow
GetClassNameA
GetDlgItem
FindWindowExA
GetWindowTextA
ScreenToClient
UnregisterClassA
WindowFromPoint
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetLastActivePopup
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
GetMenuItemID
GetMenuItemCount
RegisterClassA
GetScrollPos
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
LoadStringA

gdi32

Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetViewportExtEx
ExtSelectClipRgn
CreateSolidBrush
GetStockObject
CreateFontIndirectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetTextMetricsA
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
CreateRectRgnIndirect
SetBkColor
LineTo
MoveToEx
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
FillRgn
CreateRectRgn
CombineRgn
PatBlt
CreatePen
GetObjectA
SelectObject
CreateBitmap
CreateDCA
CreateCompatibleBitmap
GetPolyFillMode
GetStretchBltMode
GetROP2
GetBkColor
GetBkMode
GetTextColor
CreateRoundRectRgn
CreateEllipticRgn
PathToRegion
EndPath
BeginPath
GetWindowOrgEx
GetViewportOrgEx
GetWindowExtEx
GetDIBits
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
RealizePalette
SelectPalette
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
DeleteObject
SelectClipRgn
CreatePolygonRgn
GetCurrentObject
GetClipRgn
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
SetStretchBltMode

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegOpenKeyExA
RegSetValueExA
RegQueryValueA
RegCreateKeyExA
RegCloseKey

shell32

ShellExecuteA
Shell_NotifyIconA

ole32

CLSIDFromString
OleUninitialize
OleInitialize

oleaut32

LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi

comctl32

ord17
ImageList_Destroy

comdlg32

ChooseFontA
ChooseColorA
GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA

Sections

.text
Size: 516KB - Virtual size: 514KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TheWorldPortable/User Data/Default/Preferences
TheWorldPortable/User Data/Default/User StyleSheets/Custom.css
TheWorldPortable/User Data/Default/Web Data
TheWorldPortable/User Data/Local State
TheWorldPortable/User Data/abpfiles/TheWorld6_AD_Rule_AutoUpdate.exe
.exe windows x86

41163620bc3651289c2f5b556c4b3011

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
DllFunctionCall
_adj_fpatan
__vbaStrR8
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
ord607
ord608
__vbaFPException
__vbaStrVarVal
__vbaVarCat
_CIlog
__vbaNew2
__vbaR8Str
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaStrToAnsi
__vbaFpI4
ord617
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TheWorldPortable/User Data/abpfiles/TheWorld6_AD_Rule_AutoUpdate.ini
TheWorldPortable/User Data/abpfiles/kill.video.ad.txt
TheWorldPortable/User Data/abpfiles/winxp_win7设置、删除开机启动（请以管理员身份运行）.bat
TheWorldPortable/User Data/abpfiles/xwhycadblock.txt
TheWorldPortable/当客软件园.url
.url

Sharing

General

Malware Config

Signatures

Files

6e5c28d547ec6ccd369016933d4f74dd

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

19:9d:f8:9eCertificate

Key Usages

12:51:1c:86:3b:fa:13Certificate

Extended Key Usages

Key Usages

3dCertificate

Key Usages

aa:2f:dc:13:ae:c5:c1:42:22:82:44:dd:df:e2:ac:ee:93:c4:80:f6Signer

Signature Validations

Verification

17/04/2014, 09:46 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

userenv

netapi32

wtsapi32

gdiplus

version

usp10

psapi

winmm

shlwapi

user32

gdi32

advapi32

ole32

oleaut32

comctl32

oleacc

secur32

rpcrt4

Exports

Exports

Sections

.text Size: 10.7MB - Virtual size: 10.7MB

.rdata Size: 3.0MB - Virtual size: 3.0MB

.data Size: 113KB - Virtual size: 324KB

.tls Size: 512B - Virtual size: 2B

.unwante Size: 512B - Virtual size: 32B

.rsrc Size: 155KB - Virtual size: 154KB

.reloc Size: 583KB - Virtual size: 582KB

ba9b28b4e03d921ea18084a1dd999839

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

19:9d:f8:9eCertificate

Key Usages

12:51:1c:86:3b:fa:13Certificate

Extended Key Usages

Key Usages

3dCertificate

Key Usages

16:ed:e5:2c:01:93:3b:2b:5b:36:d2:af:4f:a8:97:37:35:5a:34:99Signer

Signature Validations

Verification

17/04/2014, 09:46 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

urlmon

gdiplus

wininet

version

ws2_32

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

19:9d:f8:9e
Certificate

12:51:1c:86:3b:fa:13
Certificate

3d
Certificate

aa:2f:dc:13:ae:c5:c1:42:22:82:44:dd:df:e2:ac:ee:93:c4:80:f6
Signer

17/04/2014, 09:46
Valid: false

.text
Size: 10.7MB - Virtual size: 10.7MB

.rdata
Size: 3.0MB - Virtual size: 3.0MB

.data
Size: 113KB - Virtual size: 324KB

.tls
Size: 512B - Virtual size: 2B

.unwante
Size: 512B - Virtual size: 32B

.rsrc
Size: 155KB - Virtual size: 154KB

.reloc
Size: 583KB - Virtual size: 582KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

19:9d:f8:9e
Certificate

12:51:1c:86:3b:fa:13
Certificate

3d
Certificate

16:ed:e5:2c:01:93:3b:2b:5b:36:d2:af:4f:a8:97:37:35:5a:34:99
Signer

17/04/2014, 09:46
Valid: false

.text
Size: 13.8MB - Virtual size: 13.8MB

.rdata
Size: 3.2MB - Virtual size: 3.2MB

.data
Size: 244KB - Virtual size: 537KB

.tls
Size: 512B - Virtual size: 2B

.unwante
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 861KB - Virtual size: 860KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

29:12:c7:0c:9a:2b:8a:3e:f6:f6:07:46:62:d6:8b:8d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

01:4b:e4:ac:41:a6:e6:81:1e:54:8e:f5:0d:28:95:5f:7c:85:69:61
Signer

22/10/2014, 04:04
Valid: false

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 364KB - Virtual size: 363KB

.data
Size: 16KB - Virtual size: 1.2MB

.rodata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 37KB - Virtual size: 37KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

50:ed:67:42:55:61:4b:f4:ed:3e:d4:23:cc:93:ca:7d
Certificate

1f:7d:ff:66:ce:ab:15:8c:9e:42:e0:f9:de:5d:db:7a:b3:4d:93:0b
Signer