256b2b603195d3c4a30c4c4ebd0db38859d0d0b2435d96005119b8f63fa6f410

resource	yara_rule
static1/unpack002/91vpn(3.5.4)/91vpn/appface.dll	acprotect

resource	yara_rule
static1/unpack002/91vpn(3.5.4)/91vpn/appface.dll	upx
static1/unpack001/ͨͷQQӺ V.4.4 ʽ /ͨͷQQӺ V.4.4 ʽ .exe	upx

.zip

ͨͷQQӺ V.4.4 ʽ /1.bmp

ͨͷQQӺ V.4.4 ʽ /91vpn(3.5.4).zip

.zip

91vpn(3.5.4)/91vpn/91vpn.exe

.exe windows x86

a5b233c8ba692e0bbbee30240a6cf25e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

4a:60:70:45:7b:c7:f5:96:89:aa:76:3c:da:65:09:8e
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

25-09-2013 00:00

Not After

24-11-2014 23:59

Subject

CN=Shanghai Tianchen Wangluo Keji Co.\,Ltd.,OU=VPN,O=Shanghai Tianchen Wangluo Keji Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b8:3d:5c:43:12:50:26:13:c6:e5:d3:0d:ea:04:8c:5e:d5:20:28:ef
Signer

Actual PE Digest

b8:3d:5c:43:12:50:26:13:c6:e5:d3:0d:ea:04:8c:5e:d5:20:28:ef

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Shanghai Tianchen Wangluo Keji Co.\,Ltd.,OU=VPN,O=Shanghai Tianchen Wangluo Keji Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN

22-11-2013 15:09
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

SetIpForwardEntry

GetIpForwardTable

DeleteIpForwardEntry

CreateIpForwardEntry

GetBestRoute

GetBestInterface

rasapi32

RasDeleteEntryA

RasGetConnectionStatistics

RasValidateEntryNameA

RasSetEntryPropertiesA

RasHangUpA

RasGetConnectStatusA

RasGetErrorStringA

RasGetProjectionInfoA

httpproxy

?GetUserNameA@ProxyHelper@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?GetVersion@ProxyHelper@@QAEHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?GetMagic@ProxyHelper@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?GetUserInfo@ProxyHelper@@QAEHAAUUserInfo@@@Z

?GetDailupInfo@ProxyHelper@@QAEHHAAUDialupInfo@@AAUVPErrorInfo@@@Z

?ReleaseDialupInfo@ProxyHelper@@QAEHH@Z

?ShakeHands@ProxyHelper@@QAEHABULiveInfo@@AAUVPErrorInfo@@@Z

?SignIn@ProxyHelper@@QAEHABUUserIdentity@@AAUVPErrorInfo@@@Z

?SignOut@ProxyHelper@@QAEHXZ

?GetOnlineRatio@ProxyHelper@@QAEHAAV?$vector@UServerOnlineRatio@@V?$allocator@UServerOnlineRatio@@@std@@@std@@@Z

?GetLocalVpnServers@ProxyHelper@@QAEHAAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$vector@UServerInfo@@V?$allocator@UServerInfo@@@std@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$vector@UServerInfo@@V?$allocator@UServerInfo@@@std@@@2@@std@@@2@@std@@@Z

?GetVpnServers@ProxyHelper@@QAEHAAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$vector@UServerInfo@@V?$allocator@UServerInfo@@@std@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$vector@UServerInfo@@V?$allocator@UServerInfo@@@std@@@2@@std@@@2@@std@@@Z

?Instance@ProxyHelper@@SAAAV1@XZ

vpnutil

?Detach@Filter@CryptoPP@@UAEXPAVBufferedTransformation@2@@Z

?ChannelCreatePutSpace@BufferedTransformation@CryptoPP@@UAEPAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAI@Z

?Initialize@BufferedTransformation@CryptoPP@@UAEXABVNameValuePairs@2@H@Z

?ChannelPutModifiable2@BufferedTransformation@CryptoPP@@UAEIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAEIH_N@Z

?ChannelPut2@BufferedTransformation@CryptoPP@@UAEIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBEIH_N@Z

?NumberOfMessages@BufferedTransformation@CryptoPP@@UBEIXZ

?IsItemExist@GlobalCache@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?IsAppExiting@VPNUTIL@@YAHXZ

?WaitForStop@CMyThread@@QAEXXZ

?GetReconnectInterval@CClientCfg@@QAEHXZ

?GetReconnectAttempts@CClientCfg@@QAEHXZ

?IsAutoReconnect@CClientCfg@@QAE_NXZ

?Save@CClientCfg@@QAE_NXZ

?SetFavoriteServer@CClientCfg@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?SetFavoriteArea@CClientCfg@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?GetConfigItem@GlobalCache@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@@Z

?SetConfigItem@GlobalCache@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z

?SetConfigItem@GlobalCache@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z

?IsL2TPSupport@VPNUTIL@@YA_NXZ

?GetConfigItem@GlobalCache@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAH@Z

??1ServerInfo@@QAE@XZ

?SetCurrConfigLanguage@CMultiLanguage@@QAE_NW4enumUILanguageConstants@@@Z

?GetValue@GlobalCache@@QAEPAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?SetValue@GlobalCache@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAX@Z

?setAppExiting@VPNUTIL@@YAXXZ

?SetMainWndHandle@VPNUTIL@@YAXPAUHWND__@@@Z

??MCVersion@@QAE_NABU0@@Z

??0CVersion@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?GetVersion@CClientCfg@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?GetClientCfg@GlobalCache@@QAEPAVCClientCfg@@XZ

?Instance@CMultiLanguage@@SAAAV1@XZ

?ConfigUILanguage@CMultiLanguage@@QAE_NXZ

?AttachedTransformation@Filter@CryptoPP@@UAEPAVBufferedTransformation@2@XZ

?DEFAULT_CHANNEL@CryptoPP@@3V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@B

?Flush@BufferedTransformation@CryptoPP@@UAE_N_NH0@Z

?MessageSeriesEnd@BufferedTransformation@CryptoPP@@UAE_NH_N@Z

?ChannelFlush@BufferedTransformation@CryptoPP@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NH1@Z

?ChannelMessageSeriesEnd@BufferedTransformation@CryptoPP@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N@Z

?GetMaxWaitObjectCount@BufferedTransformation@CryptoPP@@UBEIXZ

?GetWaitObjects@BufferedTransformation@CryptoPP@@UAEXAAVWaitObjectContainer@2@ABVCallStack@2@@Z

?IsolatedInitialize@HexEncoder@CryptoPP@@UAEXABVNameValuePairs@2@@Z

??0HashFilter@CryptoPP@@QAE@AAVHashTransformation@1@PAVBufferedTransformation@1@_NHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@3@Z

?AnyRetrievable@BufferedTransformation@CryptoPP@@UBE_NXZ

?AnyMessages@BufferedTransformation@CryptoPP@@UBE_NXZ

?Skip@BufferedTransformation@CryptoPP@@UAE_K_K@Z

?TotalBytesRetrievable@BufferedTransformation@CryptoPP@@UBE_KXZ

?GetNextMessage@BufferedTransformation@CryptoPP@@UAE_NXZ

?SkipMessages@BufferedTransformation@CryptoPP@@UAEII@Z

?SkipAll@BufferedTransformation@CryptoPP@@UAEXXZ

?SetRetrievalChannel@BufferedTransformation@CryptoPP@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?Attach@BufferedTransformation@CryptoPP@@UAEXPAV12@@Z

?Put2@HashFilter@CryptoPP@@UAEIPBEIH_N@Z

?IsolatedInitialize@HashFilter@CryptoPP@@UAEXABVNameValuePairs@2@@Z

?Initialize@Filter@CryptoPP@@UAEXABVNameValuePairs@2@H@Z

?Flush@Filter@CryptoPP@@UAE_N_NH0@Z

?MessageSeriesEnd@Filter@CryptoPP@@UAE_NH_N@Z

?MaxRetrievable@BufferedTransformation@CryptoPP@@UBE_KXZ

?Get@BufferedTransformation@CryptoPP@@UAEIPAEI@Z

?Get@BufferedTransformation@CryptoPP@@UAEIAAE@Z

?Peek@BufferedTransformation@CryptoPP@@UBEIPAEI@Z

?Peek@BufferedTransformation@CryptoPP@@UBEIAAE@Z

?TransferTo2@Filter@CryptoPP@@UAEIAAVBufferedTransformation@2@AA_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z

?CopyRangeTo2@Filter@CryptoPP@@UBEIAAVBufferedTransformation@2@AA_K_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z

?AttachedTransformation@Filter@CryptoPP@@UBEPBVBufferedTransformation@2@XZ

?NewDefaultAttachment@Filter@CryptoPP@@MBEPAVBufferedTransformation@2@XZ

?IsolatedFlush@ProxyFilter@CryptoPP@@UAE_N_N0@Z

?NextPutMultiple@ProxyFilter@CryptoPP@@UAEXPBEI@Z

?NextPutModifiable@ProxyFilter@CryptoPP@@UAEXPAEI@Z

?Put2@?$StringSinkTemplate@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@CryptoPP@@UAEIPBEIH_N@Z

?IsolatedInitialize@?$StringSinkTemplate@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@CryptoPP@@UAEXABVNameValuePairs@2@@Z

??0?$StringSinkTemplate@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@CryptoPP@@QAE@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?IsolatedFlush@?$Bufferless@VFilter@CryptoPP@@@CryptoPP@@UAE_N_N0@Z

?IsolatedFlush@?$Bufferless@VSink@CryptoPP@@@CryptoPP@@UAE_N_N0@Z

??1HashFilter@CryptoPP@@UAE@XZ

??1?$StringSinkTemplate@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@CryptoPP@@UAE@XZ

??1SHA1@CryptoPP@@UAE@XZ

??0SHA1@CryptoPP@@QAE@XZ

??1HexEncoder@CryptoPP@@UAE@XZ

??0HexEncoder@CryptoPP@@QAE@PAVBufferedTransformation@1@_NHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2@Z

??1StringSource@CryptoPP@@UAE@XZ

??0StringSource@CryptoPP@@QAE@PBD_NPAVBufferedTransformation@1@@Z

?LastPut@SimpleProxyFilter@CryptoPP@@UAEXPBEI@Z

?FirstPut@SimpleProxyFilter@CryptoPP@@UAEXPBE@Z

?CreatePutSpace@HashFilter@CryptoPP@@UAEPAEAAI@Z

?AlgorithmName@HashFilter@CryptoPP@@UBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?NextPut@FilterWithBufferedInput@CryptoPP@@MAEHPBEI@Z

?FlushDerived@FilterWithBufferedInput@CryptoPP@@MAEXXZ

?NextPutSingle@FilterWithBufferedInput@CryptoPP@@MAEXPBE@Z

?InitializeDerived@FilterWithBufferedInput@CryptoPP@@MAEXABVNameValuePairs@2@@Z

?InitializeDerivedAndReturnNewSizes@FilterWithBufferedInput@CryptoPP@@MAEXABVNameValuePairs@2@AAI11@Z

?PutModifiable2@FilterWithBufferedInput@CryptoPP@@UAEIPAEIH_N@Z

?Put2@FilterWithBufferedInput@CryptoPP@@UAEIPBEIH_N@Z

?ShouldPropagateMessageSeriesEnd@Filter@CryptoPP@@MBE_NXZ

?ShouldPropagateMessageEnd@Filter@CryptoPP@@MBE_NXZ

?GetDefaultServer@CLoginServers@@QAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?Connect@VPNUTIL@@YAKKKKKKK_N@Z

??8ServerInfo@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

??4ServerOnlineRatio@@QAEAAU0@ABU0@@Z

??1ServerOnlineRatio@@QAE@XZ

??0ServerOnlineRatio@@QAE@ABU0@@Z

??0ServerOnlineRatio@@QAE@XZ

?GetPingTestWorkers@CClientCfg@@QBEHXZ

?GetPingTestTimes@CClientCfg@@QBEHXZ

?Instance@GlobalCache@@SAAAV1@XZ

?SetClientCfg@GlobalCache@@QAEXPAVCClientCfg@@@Z

?Parse@CClientCfg@@QAE_NXZ

??0CClientCfg@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?StartThread@CMyThread@@QAE_NPAX@Z

?GetExeDirectory@VPNUTIL@@YA_NAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z

??1CMyThread@@UAE@XZ

??0CMyThread@@QAE@XZ

?Instance@CLoginServers@@SAAAV1@XZ

?GetAllServers@CLoginServers@@QAEXAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z

?Instance@Logger@@SAAAV1@XZ

?Trace@Logger@@QAAXPBDZZ

?GetFavoriteServer@CClientCfg@@QAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?GetFavoriteArea@CClientCfg@@QAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?PingUsingICMP@CPing@@QBEHPBDAAUCPingReply@@EKGEH@Z

??0CPingReply@@QAE@XZ

??1CPing@@QAE@XZ

??0CPing@@QAE@XZ

?SetVpnType@CClientCfg@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?SetReconnectInterval@CClientCfg@@QAEXH@Z

?SetReconnectAttempts@CClientCfg@@QAEXH@Z

?SetAutoReconnect@CClientCfg@@QAEX_N@Z

?GetVpnType@CClientCfg@@QAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?GetCurrConfigLanguage@CMultiLanguage@@QAE?AW4enumUILanguageConstants@@XZ

??4ServerInfo@@QAEAAU0@ABU0@@Z

??0ServerInfo@@QAE@ABU0@@Z

??0ServerInfo@@QAE@XZ

?Clone@Clonable@CryptoPP@@UBEPAV12@XZ

?AlgorithmName@Algorithm@CryptoPP@@UBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?CreatePutSpace@BufferedTransformation@CryptoPP@@UAEPAEAAI@Z

?CanModifyInput@BufferedTransformation@CryptoPP@@UBE_NXZ

?PutModifiable2@BufferedTransformation@CryptoPP@@UAEIPAEIH_N@Z

?IsolatedMessageSeriesEnd@BufferedTransformation@CryptoPP@@UAE_N_N@Z

?SetAutoSignalPropagation@BufferedTransformation@CryptoPP@@UAEXH@Z

?GetAutoSignalPropagation@BufferedTransformation@CryptoPP@@UBEHXZ

?GetNextMessageSeries@BufferedTransformation@CryptoPP@@UAE_NXZ

?NumberOfMessagesInThisSeries@BufferedTransformation@CryptoPP@@UBEIXZ

?NumberOfMessageSeries@BufferedTransformation@CryptoPP@@UBEIXZ

?Attachable@BufferedTransformation@CryptoPP@@UAE_NXZ

?AttachedTransformation@BufferedTransformation@CryptoPP@@UAEPAV12@XZ

?AttachedTransformation@BufferedTransformation@CryptoPP@@UBEPBV12@XZ

?Detach@BufferedTransformation@CryptoPP@@UAEXPAV12@@Z

?TransferTo2@Sink@CryptoPP@@UAEIAAVBufferedTransformation@2@AA_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z

?CopyRangeTo2@Sink@CryptoPP@@UBEIAAVBufferedTransformation@2@AA_K_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z

?Attachable@Filter@CryptoPP@@UAE_NXZ

appface

ord2

ord1

mfc100

ord3618

ord3676

ord8486

ord13299

ord7073

ord13301

ord11421

ord11420

ord2163

ord4724

ord13767

ord11726

ord7510

ord7584

ord2872

ord7266

ord1900

ord1929

ord895

ord1292

ord3744

ord5534

ord12535

ord2881

ord2878

ord7349

ord2417

ord14059

ord14061

ord14060

ord14058

ord14062

ord14045

ord13972

ord13973

ord8228

ord11025

ord3395

ord10883

ord13294

ord8070

ord11154

ord6217

ord9994

ord8351

ord2847

ord12644

ord11190

ord11188

ord1496

ord1503

ord1509

ord1507

ord1514

ord4373

ord4410

ord4381

ord4393

ord4389

ord4385

ord4415

ord4406

ord4377

ord4419

ord4398

ord4364

ord4368

ord4401

ord3991

ord13980

ord3984

ord2661

ord13302

ord7074

ord13300

ord6128

ord10672

ord12482

ord5253

ord2338

ord11060

ord3484

ord2945

ord2944

ord2846

ord11103

ord5123

ord5302

ord9286

ord5858

ord1012

ord1939

ord385

ord946

ord1982

ord4283

ord9449

ord5837

ord5776

ord948

ord12868

ord6680

ord3755

ord2838

ord8231

ord11184

ord6090

ord1263

ord3429

ord2613

ord7861

ord3741

ord2744

ord8224

ord5784

ord919

ord457

ord1004

ord3738

ord2742

ord8222

ord5777

ord915

ord3254

ord9475

ord4344

ord7581

ord4498

ord3390

ord788

ord1210

ord10030

ord1313

ord8137

ord11882

ord11806

ord11439

ord5175

ord4282

ord8235

ord6010

ord5805

ord8305

ord8330

ord11108

ord2416

ord12531

ord5532

ord2752

ord2973

ord2974

ord10360

ord10007

ord11067

ord6316

ord845

ord1246

ord2067

ord2063

ord5788

ord1269

ord871

ord851

ord13167

ord6628

ord1316

ord5830

ord5821

ord968

ord5444

ord6694

ord12344

ord5007

ord2611

ord7863

ord3746

ord5875

ord3475

ord2187

ord13095

ord5204

ord4785

ord310

ord2151

ord305

ord5242

ord2626

ord6572

ord812

ord1227

ord6809

ord7933

ord9992

ord11150

ord10013

ord8139

ord8076

ord10213

ord10300

ord9571

ord10148

ord10879

ord10882

ord10880

ord10881

ord2770

ord4343

ord12440

ord6573

ord824

ord1230

ord1639

ord6810

ord9501

ord4345

ord12068

ord4340

ord4341

ord8320

ord2660

ord8348

ord11151

ord2820

ord3636

ord2250

ord6601

ord6836

ord6213

ord2184

ord12128

ord2025

ord721

ord1172

ord12743

ord3373

ord13219

ord12962

ord2156

ord11627

ord11153

ord11787

ord5098

ord9281

ord6112

ord3620

ord1890

ord7141

ord1288

ord888

ord6835

ord9399

ord2138

ord8304

ord7357

ord4772

ord6888

ord6898

ord6897

ord4606

ord4774

ord4625

ord4881

ord8439

ord5095

ord4903

ord4622

ord901

ord316

ord266

ord265

ord1294

ord1296

ord7091

ord1732

ord14075

ord10922

ord13181

ord11413

ord7144

ord13483

ord13480

ord13485

ord13482

ord13484

ord13481

ord3409

ord5238

ord11172

ord4078

ord11180

ord3970

ord7355

ord1485

ord2088

ord3439

ord6970

msvcr100

_setmbcp

_controlfp_s

_invoke_watson

_except_handler4_common

?_type_info_dtor_internal_method@type_info@@QAEXXZ

_crt_debugger_hook

__set_app_type

_fmode

_commode

__setusermatherr

_configthreadlocale

_initterm_e

_initterm

_acmdln

exit

_ismbblead

_XcptFilter

_exit

_cexit

__getmainargs

_amsg_exit

?terminate@@YAXXZ

_onexit

_lock

__dllonexit

_unlock

sprintf

_mbsrchr

_mbsicmp

_mbstok

strerror

_time64

srand

strncpy

rand

_stricmp

_mbsnbcpy

_snprintf

_purecall

_itoa

?what@exception@std@@UBEPBDXZ

??0exception@std@@QAE@ABV01@@Z

memmove

??1exception@std@@UAE@XZ

??0exception@std@@QAE@ABQBD@Z

_CxxThrowException

__CxxFrameHandler3

memcpy

memset

kernel32

CloseHandle

CreateSemaphoreA

GetLastError

DeleteFileA

MoveFileExA

WinExec

Sleep

InitializeCriticalSectionAndSpinCount

LeaveCriticalSection

GetSystemTimeAsFileTime

GetCurrentProcessId

GetCurrentThreadId

GetTickCount

QueryPerformanceCounter

IsDebuggerPresent

SetUnhandledExceptionFilter

UnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

GetStartupInfoW

HeapSetInformation

InterlockedCompareExchange

DecodePointer

EncodePointer

LocalUnlock

LocalFree

LocalLock

LocalAlloc

MultiByteToWideChar

GlobalUnlock

GlobalLock

GlobalAlloc

GetModuleFileNameA

MulDiv

GetTempFileNameA

GetTempPathA

EnterCriticalSection

lstrcpynA

lstrcpyA

lstrlenA

GetModuleHandleA

GetProcAddress

InterlockedExchange

DeleteCriticalSection

user32

AppendMenuA

IsIconic

GetSystemMetrics

GetClientRect

DrawIcon

GetWindowRect

PostMessageA

SendMessageA

EnableWindow

SetTimer

GetMessageA

DestroyIcon

GetSystemMenu

RegisterWindowMessageA

KillTimer

LoadImageA

InvalidateRect

UpdateWindow

GetCursorPos

LoadMenuW

GetSubMenu

CheckMenuItem

SendNotifyMessageA

DestroyWindow

PostQuitMessage

WaitMessage

DispatchMessageA

TranslateMessage

IsDialogMessageA

PeekMessageA

CreateDialogIndirectParamA

GetWindow

GetAsyncKeyState

CloseClipboard

SetClipboardData

GetWindowDC

ReleaseDC

GetParent

LoadCursorA

SetCursor

SetRect

GetActiveWindow

GetLastActivePopup

MessageBoxA

BeginPaint

GetWindowLongA

EndPaint

GetSysColor

GetDialogBaseUnits

LoadStringA

SystemParametersInfoA

DrawTextA

LoadIconA

GetDlgItem

FillRect

SetWindowLongA

IsWindow

GetClassNameA

EnableMenuItem

CheckDlgButton

SetFocus

SetWindowPos

SetForegroundWindow

MoveWindow

SetWindowTextA

WinHelpA

GetWindowTextA

RedrawWindow

OpenClipboard

EmptyClipboard

LoadIconW

gdi32

GetTextExtentPoint32A

CreateFontIndirectA

GetStockObject

CreateSolidBrush

CreateDCA

SelectObject

DeleteDC

SetBkColor

DeleteObject

SetTextColor

advapi32

RegQueryValueExA

RegSetValueExA

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

shell32

ShellExecuteA

Shell_NotifyIconA

comctl32

ord17

wsock32

inet_addr

WSAStartup

ioctlsocket

msvcp100

?_Xout_of_range@std@@YAXPBD@Z

??1_Container_base12@std@@QAE@XZ

?_Xlength_error@std@@YAXPBD@Z

ws2_32

getaddrinfo

Sections

.text
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

91vpn(3.5.4)/91vpn/app.txt

91vpn(3.5.4)/91vpn/appface.dll

.dll windows x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

0c:33:6a:82:7f:95:01:d6:67:3b:43:2d:17:af:f6:7f
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

10-08-2010 00:00

Not After

10-08-2011 23:59

Subject

CN=\ Shanghai Tianchen Wangluo Keji Co.\,Ltd.,OU=VPN,O=\ Shanghai Tianchen Wangluo Keji Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

a0:87:3f:28:dc:9f:74:4f:49:22:1f:32:31:b4:a6:63:82:26:07:6b
Signer

Actual PE Digest

a0:87:3f:28:dc:9f:74:4f:49:22:1f:32:31:b4:a6:63:82:26:07:6b

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=\ Shanghai Tianchen Wangluo Keji Co.\,Ltd.,OU=VPN,O=\ Shanghai Tianchen Wangluo Keji Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN

01-09-2010 13:12
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

Exports

BkCreate

BkDelete

BkDraw

SkinRemove

SkinStart

SkinStartW

SkinThread

SkinWindowSet

SkinWindowSetEx

SkinWindowSetExW

Sections

UPX0
Size: - Virtual size: 476KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

UPX1
Size: 267KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

91vpn(3.5.4)/91vpn/cache.dat

91vpn(3.5.4)/91vpn/encrypt.mdb

91vpn(3.5.4)/91vpn/httpproxy.dll

.dll windows x86

c8542246c73dfcbc2b20e14b2a576db2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

48:06:8a:d0:22:01:51:71:70:d4:cc:08:c1:17:31:ad
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

23-08-2012 00:00

Not After

22-10-2013 23:59

Subject

CN=Shanghai Tianchen Wangluo Keji Co.\,Ltd.,OU=VPN,O=Shanghai Tianchen Wangluo Keji Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d3:a1:aa:df:20:20:99:f2:63:d7:4a:4d:fc:38:bf:da:93:52:fe:14
Signer

Actual PE Digest

d3:a1:aa:df:20:20:99:f2:63:d7:4a:4d:fc:38:bf:da:93:52:fe:14

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Shanghai Tianchen Wangluo Keji Co.\,Ltd.,OU=VPN,O=Shanghai Tianchen Wangluo Keji Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN

01-02-2013 15:30
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

Imports

vpnutil

?begin@?$vector@VProfileSection@@V?$allocator@VProfileSection@@@std@@@std@@QAE?AV?$_Vector_iterator@V?$_Vector_val@VProfileSection@@V?$allocator@VProfileSection@@@std@@@std@@@2@XZ

?end@?$vector@VProfileSection@@V?$allocator@VProfileSection@@@std@@@std@@QAE?AV?$_Vector_iterator@V?$_Vector_val@VProfileSection@@V?$allocator@VProfileSection@@@std@@@std@@@2@XZ

?GetItemInt@ProfileSection@@QBE?BHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

??1CProfileFile@@QAE@XZ

?GetCurrServer@CLoginServers@@QAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAH@Z

??0CProfileFile@@QAE@XZ

??0ServerInfo@@QAE@ABU0@@Z

??0ServerOnlineRatio@@QAE@ABU0@@Z

??1ServerInfo@@QAE@XZ

??1ServerOnlineRatio@@QAE@XZ

?GetCurrConfigLanguageTag@CMultiLanguage@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?Instance@CMultiLanguage@@SAAAV1@XZ

?begin@?$vector@VProfileSection@@V?$allocator@VProfileSection@@@std@@@std@@QBE?AV?$_Vector_const_iterator@V?$_Vector_val@VProfileSection@@V?$allocator@VProfileSection@@@std@@@std@@@2@XZ

?end@?$vector@VProfileSection@@V?$allocator@VProfileSection@@@std@@@std@@QBE?AV?$_Vector_const_iterator@V?$_Vector_val@VProfileSection@@V?$allocator@VProfileSection@@@std@@@std@@@2@XZ

?IsItemExist@ProfileSection@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?Instance@Logger@@SAAAV1@XZ

?GetDftMac@VPNUTIL@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?GetVersion@CClientCfg@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?GetClientCfg@GlobalCache@@QAEPAVCClientCfg@@XZ

?GetMachineId@VPNUTIL@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?end@?$vector@UProfileItem@@V?$allocator@UProfileItem@@@std@@@std@@QBE?AV?$_Vector_const_iterator@V?$_Vector_val@UProfileItem@@V?$allocator@UProfileItem@@@std@@@std@@@2@XZ

?begin@?$vector@UProfileItem@@V?$allocator@UProfileItem@@@std@@@std@@QBE?AV?$_Vector_const_iterator@V?$_Vector_val@UProfileItem@@V?$allocator@UProfileItem@@@std@@@std@@@2@XZ

?GetSetionName@ProfileSection@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

??0ServerOnlineRatio@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z

?Parse@CLoginServers@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z

?SetDefaultServer@CLoginServers@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z

?SetConfigItem@GlobalCache@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z

?SetConfigItem@GlobalCache@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z

?SetValue@GlobalCache@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAX@Z

??0ServerInfo@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z

?GetItem@ProfileSection@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z

?GetConfigItem@GlobalCache@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAH@Z

?Load@CProfileFile@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

??8ProfileSection@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?Instance@CLoginServers@@SAAAV1@XZ

?GetNextServer@CLoginServers@@QAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAH@Z

?GetExeDirectory@VPNUTIL@@YA_NAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z

?StaticAlgorithmName@?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@UTwofish_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?StaticAlgorithmName@ECB_OneWay@CryptoPP@@SAPBDXZ

??0CMemBZ2Decompress@@QAE@PAEIAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z

?Decompress@CBZ2Decompress@@QAEIXZ

??1CMemBZ2Decompress@@UAE@XZ

?Instance@GlobalCache@@SAAAV1@XZ

?GetConfigItem@GlobalCache@@QAEHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@@Z

?URLEncode@VPNUTIL@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z

??1Base64Decoder@CryptoPP@@UAE@XZ

?InputBufferIsEmpty@?$Unflushable@VFilter@CryptoPP@@@CryptoPP@@MBE_NXZ

?ChannelFlush@?$Unflushable@VFilter@CryptoPP@@@CryptoPP@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NH1@Z

?Flush@?$Unflushable@VFilter@CryptoPP@@@CryptoPP@@UAE_N_NH0@Z

?IsolatedFlush@?$Unflushable@VFilter@CryptoPP@@@CryptoPP@@UAE_N_N0@Z

?IsolatedInitialize@Base64Decoder@CryptoPP@@UAEXABVNameValuePairs@2@@Z

?Put2@BaseN_Decoder@CryptoPP@@UAEIPBEIH_N@Z

??0Base64Decoder@CryptoPP@@QAE@PAVBufferedTransformation@1@@Z

??1StreamTransformationFilter@CryptoPP@@UAE@XZ

??1HashFilter@CryptoPP@@UAE@XZ

??1?$StringSinkTemplate@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@CryptoPP@@UAE@XZ

??1Base64Encoder@CryptoPP@@UAE@XZ

??1HexEncoder@CryptoPP@@UAE@XZ

?LastPut@StreamTransformationFilter@CryptoPP@@MAEXPBEI@Z

?NextPutModifiable@StreamTransformationFilter@CryptoPP@@MAEXPAEI@Z

?NextPutMultiple@StreamTransformationFilter@CryptoPP@@MAEXPBEI@Z

?FirstPut@StreamTransformationFilter@CryptoPP@@MAEXPBE@Z

?InitializeDerivedAndReturnNewSizes@StreamTransformationFilter@CryptoPP@@MAEXABVNameValuePairs@2@AAI11@Z

?IsolatedFlush@FilterWithBufferedInput@CryptoPP@@UAE_N_N0@Z

?IsolatedInitialize@FilterWithBufferedInput@CryptoPP@@UAEXABVNameValuePairs@2@@Z

?AlgorithmName@StreamTransformationFilter@CryptoPP@@UBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

?IsolatedInitialize@Base64Encoder@CryptoPP@@UAEXABVNameValuePairs@2@@Z