d104b27e0e623a466d9d302bde42e607f755b866edf41eef616612382a059dc9

Sharing

Copy URL Twitter E-mail

General

Target

d104b27e0e623a466d9d302bde42e607f755b866edf41eef616612382a059dc9
Size

7.1MB
MD5

7297d1665ae8768ee769067a2efa7ad8
SHA1

79aa25acf788b08adb55f675f97d1b3b0ecf2125
SHA256

d104b27e0e623a466d9d302bde42e607f755b866edf41eef616612382a059dc9
SHA512

8969cc5b70a56e6fde9a052b9e7e37661e1d85f0fdb37f8c78654016f6e6ea3b5e9753d18e44671efa8f79a58a6b2ece9f4476fa0a8e399f6a9e945bb03a5d0a
SSDEEP

196608:06G1ttKb7a4/TxjKjIH6/d0WGoORrpOFE4JhUuxPvlS4/:062tUnBjKjIHZWuVQE4JxxnlN/

Score

1^/10

Malware Config

Signatures

Files

d104b27e0e623a466d9d302bde42e607f755b866edf41eef616612382a059dc9
.zip
360FileBrowser.exe
.exe windows x86

25891920ef54bbbfe5ca4376cce425bd

Code Sign

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:d2:0e:42:e8:81:06:c1:a2:71:33:c8:cb:9f:1c:ed:4a:d1:4a:21:7a:6f:51:84:38:18:fc:6d:a7:27:01:b6
Signer

Actual PE Digest

42:d2:0e:42:e8:81:06:c1:a2:71:33:c8:cb:9f:1c:ed:4a:d1:4a:21:7a:6f:51:84:38:18:fc:6d:a7:27:01:b6

Digest Algorithm

sha256

PE Digest Matches

true

d0:29:8a:9d:8a:e0:be:60:e0:4e:3a:b3:31:67:c3:61:2e:9a:54:c0
Signer

Actual PE Digest

d0:29:8a:9d:8a:e0:be:60:e0:4e:3a:b3:31:67:c3:61:2e:9a:54:c0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualFree
ResumeThread
GetThreadContext
SetThreadContext
SuspendThread
FlushInstructionCache
VirtualProtect
VirtualQuery
CreateEventW
WaitForMultipleObjects
ResetEvent
WaitForSingleObject
SetEvent
GetCurrentProcessId
DeviceIoControl
OpenProcess
SetLastError
GetCurrentThread
GetLocalTime
GetCurrentThreadId
GlobalAlloc
GetTickCount
ExpandEnvironmentStringsW
ReadFile
FindFirstFileA
FindNextFileA
FindFirstFileW
FindNextFileW
FindClose
lstrlenA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WideCharToMultiByte
GetTempPathW
GetTempFileNameW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateFileW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LCMapStringA
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
GetModuleFileNameA
GetStdHandle
FatalAppExitA
HeapCreate
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
DeleteFileA
GetStartupInfoA
GetCommandLineA
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
TlsFree
TlsAlloc
SetNamedPipeHandleState
WriteFile
GetSystemDirectoryW
LoadLibraryW
DeleteFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetCommandLineW
CreateProcessW
CloseHandle
GetModuleFileNameW
MultiByteToWideChar
GetWindowsDirectoryW
InterlockedCompareExchange
Sleep
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetLastError
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
LoadLibraryExW
FreeResource
FreeLibrary
GetSystemWindowsDirectoryW
GetModuleHandleW
GetProcAddress
GetCurrentProcess
lstrlenW
FindResourceExW
FindResourceW
LoadResource
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
CreateMutexW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
CreateFileA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
ExitProcess
SetFileTime
GetCurrentDirectoryW
CreateDirectoryW
DosDateTimeToFileTime
SystemTimeToFileTime
DuplicateHandle
GetFileType
SetFilePointer
GetFileSize
MulDiv
SetCurrentDirectoryW
LockResource
SizeofResource
DeleteCriticalSection
RaiseException
InitializeCriticalSection
GetLocaleInfoW

user32

FindWindowExW
MoveWindow
IsWindowVisible
GetParent
GetActiveWindow
SetForegroundWindow
CreateAcceleratorTableW
InvalidateRgn
GetSysColor
GetCursorPos
SetCaretPos
ShowCaret
HideCaret
CreateCaret
EqualRect
SetRect
CharPrevW
DrawTextW
CopyRect
GetWindowDC
GetWindowTextLengthW
MonitorFromWindow
GetMonitorInfoW
GetWindow
EnableWindow
SendMessageTimeoutW
GetMessageW
SetFocus
TranslateMessage
DispatchMessageW
PostQuitMessage
ScreenToClient
GetWindowLongW
SetWindowLongW
GetClientRect
SetWindowPos
PostMessageW
ShowWindow
MessageBoxW
FindWindowW
GetWindowThreadProcessId
ClientToScreen
AllowSetForegroundWindow
DestroyWindow
IsWindow
IsChild
GetDC
UpdateLayeredWindow
ReleaseDC
MapVirtualKeyW
MonitorFromRect
SetCapture
GetWindowTextW
GetCapture
ReleaseCapture
IntersectRect
DrawIconEx
DestroyIcon
GetWindowRgn
SetPropW
SystemParametersInfoW
LoadCursorW
SetCursor
RegisterWindowMessageW
ReplyMessage
SetClipboardViewer
LoadIconW
ChangeClipboardChain
UnregisterHotKey
RegisterHotKey
GetMenuItemCount
GetSubMenu
SendNotifyMessageW
GetKeyState
GetDoubleClickTime
BeginPaint
FillRect
EndPaint
UpdateWindow
GetDesktopWindow
MapWindowPoints
KillTimer
SetWindowTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
DestroyMenu
GetWindowPlacement
SetWindowPlacement
PtInRect
RegisterClipboardFormatW
SendMessageW
GetWindowRect
OffsetRect
SetWindowRgn
IsZoomed
SetTimer
IsIconic
wsprintfW
InflateRect
UnionRect
DefWindowProcW
IsWindowEnabled
LoadImageW
GetSystemMetrics
RemovePropW
CallWindowProcW
GetPropW
AdjustWindowRectEx
GetMenu
wvsprintfW
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
InvalidateRect
IsRectEmpty
GetUpdateRect
CharNextW

gdi32

CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteDC
CreateRectRgn
PtInRegion
CreateSolidBrush
CreateRoundRectRgn
DeleteObject
GdiFlush
GetTextMetricsW
CreateFontIndirectW
GetObjectW
GetStockObject
CreatePen
SetWindowOrgEx
Rectangle
RestoreDC
BitBlt
SaveDC
CreateCompatibleBitmap
GetDeviceCaps
SetTextColor
GetTextColor
SetViewportOrgEx
SetBkMode
GetTextExtentPoint32W
SelectClipRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
CombineRgn
StretchBlt
SetStretchBltMode
ExtTextOutW
SetBkColor
LineTo
MoveToEx
RoundRect
TextOutW
GetCharABCWidthsW

advapi32

RegEnumValueA
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
ControlService
RegOpenKeyW
RegEnumKeyExA
RegQueryInfoKeyA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
GetTokenInformation
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW

shell32

ord727
SHGetFileInfoW
SHGetDesktopFolder
SHGetSpecialFolderPathW
ord165
ord23
SHGetFolderLocation
ShellExecuteExW
SHBindToParent
SHGetSpecialFolderPathA
ord155
ord17
ord18
SHGetPathFromIDListW
ord152
ord102
Shell_NotifyIconW
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHParseDisplayName
ord680
SHOpenFolderAndSelectItems
ShellExecuteW
ord21

ole32

OleGetClipboard
OleSetClipboard
RevokeDragDrop
OleFlushClipboard
RegisterDragDrop
CoInitializeEx
OleInitialize
OleUninitialize
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
DoDragDrop
ReleaseStgMedium
OleLockRunning
CLSIDFromProgID
CLSIDFromString

oleaut32

VariantInit
VariantClear
SysFreeString
SysStringLen
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr

shlwapi

PathCombineW
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
StrChrW
StrStrIW
StrCmpIW
StrRetToStrW
SHGetValueW
SHDeleteKeyW
PathUnquoteSpacesW
SHDeleteValueW
PathFileExistsA
SHGetValueA
PathCombineA
PathAppendA
ord219
StrCmpNIW
StrRetToBufW
ord174
PathFindExtensionW
PathAppendW
PathIsDirectoryW

msimg32

AlphaBlend

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

gdiplus

GdipAlloc
GdipCreatePen1
GdipDeletePen
GdipDeleteGraphics
GdipCreateSolidFill
GdipCreateFromHDC
GdipFree
GdiplusStartup
GdipDeleteBrush
GdipSetTextRenderingHint
GdipCreateFont
GdipDrawString
GdipReleaseDC
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCloneBrush
GdipFillRectangleI
GdipDrawRectangleI

psapi

GetModuleFileNameExW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

comctl32

_TrackMouseEvent
ord17

Sections

.text
Size: 875KB - Virtual size: 875KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 466KB - Virtual size: 465KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360FileBrowser64.exe
.exe windows x64

b4af695cd5bc3c511098fd4eeb5afde8

Code Sign

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:2e:ea:23:8e:5f:4d:5f:e7:d5:86:b6:5a:5e:bc:75:40:90:12:a5:a5:c1:e7:df:52:51:1f:78:21:03:35:2f
Signer

Actual PE Digest

47:2e:ea:23:8e:5f:4d:5f:e7:d5:86:b6:5a:5e:bc:75:40:90:12:a5:a5:c1:e7:df:52:51:1f:78:21:03:35:2f

Digest Algorithm

sha256

PE Digest Matches

true

68:bb:29:39:32:bb:9c:4e:2c:eb:38:0e:77:07:9e:a3:3b:00:b9:b1
Signer

Actual PE Digest

68:bb:29:39:32:bb:9c:4e:2c:eb:38:0e:77:07:9e:a3:3b:00:b9:b1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetThreadContext
GetThreadContext
SuspendThread
ResumeThread
VirtualFree
VirtualAlloc
FlushInstructionCache
VirtualProtect
VirtualQuery
CreateEventW
WaitForMultipleObjects
ResetEvent
WaitForSingleObject
SetEvent
GetCurrentProcessId
DeviceIoControl
OpenProcess
SetLastError
GetCurrentThread
GetLocalTime
GetCurrentThreadId
GlobalAlloc
GetTickCount
ExpandEnvironmentStringsW
ReadFile
FindFirstFileA
FindNextFileA
FindFirstFileW
FindNextFileW
FindClose
lstrlenA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WideCharToMultiByte
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetPrivateProfileStringW
GetDateFormatA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LCMapStringA
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
DeleteFileW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetConsoleCtrlHandler
FatalAppExitA
GetModuleFileNameA
GetStdHandle
HeapCreate
HeapSetInformation
LCMapStringW
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
DecodePointer
EncodePointer
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
DeleteFileA
GetStartupInfoA
GetCommandLineA
CreateThread
ExitThread
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
GetTempPathW
GetTempFileNameW
CreateFileW
SetNamedPipeHandleState
WriteFile
CreateProcessW
GetSystemDirectoryW
GetCurrentProcess
CloseHandle
LoadLibraryW
GetCommandLineW
GetModuleFileNameW
MultiByteToWideChar
GetWindowsDirectoryW
Sleep
lstrcmpiW
GetLastError
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
LoadLibraryExW
FreeResource
FreeLibrary
GetModuleHandleW
GetProcAddress
GetSystemWindowsDirectoryW
lstrlenW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
CreateMutexW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
CreateFileA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
ExitProcess
SetFileTime
GetCurrentDirectoryW
CreateDirectoryW
DosDateTimeToFileTime
SystemTimeToFileTime
DuplicateHandle
GetFileType
SetFilePointer
GetFileSize
MulDiv
SetCurrentDirectoryW
FreeEnvironmentStringsW
WritePrivateProfileStringW
InitializeCriticalSection
GetTimeFormatA
RaiseException

user32

SetForegroundWindow
IsWindowVisible
FindWindowExW
GetParent
GetActiveWindow
GetCursorPos
IsIconic
CreateAcceleratorTableW
InvalidateRgn
GetSysColor
ClientToScreen
SetCaretPos
ShowCaret
HideCaret
CreateCaret
EqualRect
SetRect
CharPrevW
DrawTextW
CopyRect
GetWindowDC
GetWindowTextLengthW
MonitorFromWindow
GetMonitorInfoW
GetWindow
EnableWindow
IsWindow
GetMessageW
SetFocus
TranslateMessage
DispatchMessageW
PostQuitMessage
ScreenToClient
GetWindowLongW
SetWindowLongW
GetClientRect
SetWindowPos
PostMessageW
ShowWindow
MessageBoxW
FindWindowW
GetWindowThreadProcessId
AllowSetForegroundWindow
SendMessageTimeoutW
DestroyWindow
CharNextW
MoveWindow
GetDC
UpdateLayeredWindow
ReleaseDC
MapVirtualKeyW
MonitorFromRect
SetCapture
IsChild
GetCapture
ReleaseCapture
IntersectRect
DrawIconEx
DestroyIcon
GetWindowLongPtrW
SetWindowLongPtrW
GetWindowRgn
SetPropW
SystemParametersInfoW
LoadCursorW
SetCursor
RegisterWindowMessageW
ReplyMessage
SetClipboardViewer
LoadIconW
ChangeClipboardChain
UnregisterHotKey
RegisterHotKey
GetMenuItemCount
GetSubMenu
SendNotifyMessageW
GetKeyState
GetDoubleClickTime
BeginPaint
FillRect
EndPaint
UpdateWindow
GetDesktopWindow
MapWindowPoints
KillTimer
SetWindowTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
DestroyMenu
GetWindowPlacement
SetWindowPlacement
PtInRect
RegisterClipboardFormatW
SendMessageW
GetWindowRect
OffsetRect
SetWindowRgn
IsZoomed
SetTimer
wsprintfW
InflateRect
UnionRect
DefWindowProcW
IsWindowEnabled
LoadImageW
GetSystemMetrics
RemovePropW
CallWindowProcW
GetPropW
AdjustWindowRectEx
GetMenu
wvsprintfW
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
InvalidateRect
IsRectEmpty
GetUpdateRect
GetWindowTextW

gdi32

Rectangle
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteDC
CreateRectRgn
PtInRegion
CreateSolidBrush
CreateRoundRectRgn
DeleteObject
GetTextMetricsW
CreateFontIndirectW
GetObjectW
GetStockObject
CreatePen
SetWindowOrgEx
RestoreDC
BitBlt
SaveDC
CreateCompatibleBitmap
GetDeviceCaps
SetTextColor
GetTextColor
SetViewportOrgEx
SetBkMode
GetTextExtentPoint32W
SelectClipRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
CombineRgn
StretchBlt
SetStretchBltMode
ExtTextOutW
SetBkColor
LineTo
MoveToEx
RoundRect
TextOutW
GetCharABCWidthsW
GdiFlush

advapi32

RegOpenKeyExA
RegCreateKeyExW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
ControlService
RegOpenKeyW
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegCloseKey
RegQueryValueExA
OpenProcessToken
GetTokenInformation
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW

shell32

SHBrowseForFolderW
SHGetSpecialFolderLocation
Shell_NotifyIconW
ord102
ord152
SHGetPathFromIDListW
ord18
ord17
ord155
SHGetSpecialFolderPathA
SHBindToParent
ShellExecuteExW
ord680
SHOpenFolderAndSelectItems
ord165
SHGetSpecialFolderPathW
ord21
ord23
SHParseDisplayName
SHGetFolderLocation
ord727
SHGetFileInfoW
SHGetDesktopFolder
ShellExecuteW

ole32

DoDragDrop
OleGetClipboard
OleSetClipboard
ReleaseStgMedium
RevokeDragDrop
OleFlushClipboard
RegisterDragDrop
CoInitializeEx
OleInitialize
OleUninitialize
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
OleLockRunning
CLSIDFromProgID
CLSIDFromString

oleaut32

SysStringLen
LoadTypeLi
VariantClear
VariantInit
VarUI4FromStr
SysFreeString
LoadRegTypeLi

shlwapi

StrCmpIW
PathIsDirectoryW
SHGetValueW
PathFindExtensionW
ord174
StrRetToBufW
StrCmpNIW
ord219
PathAppendA
PathCombineA
SHGetValueA
PathFileExistsA
PathRemoveFileSpecW
SHDeleteValueW
PathUnquoteSpacesW
PathCombineW
PathAppendW
PathFindFileNameW
StrChrW
SHDeleteKeyW
StrStrIW
StrRetToStrW
PathFileExistsW

msimg32

AlphaBlend

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

gdiplus

GdipDeleteBrush
GdipCreatePen1
GdipAlloc
GdipDeleteGraphics
GdipCreateSolidFill
GdipCreateFromHDC
GdipDrawRectangleI
GdipFillRectangleI
GdipCloneBrush
GdipFree
GdiplusStartup
GdipDeletePen
GdipSetTextRenderingHint
GdipCreateFont
GdipDrawString
GdipReleaseDC
GdipSetStringFormatLineAlign
GdipCreateStringFormat
GdipDeleteFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteStringFormat
GdipSetStringFormatAlign

psapi

GetModuleFileNameExW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

comctl32

ord17
_TrackMouseEvent

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 374KB - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

.rsrc
Size: 465KB - Virtual size: 465KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360FileBrowser_BlackTheme.ui
.zip
360FileBrowser_Theme.ui
.zip
360FileService.exe
.exe windows x86

732915165328506a373a3659ab5aea6a

Code Sign

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:55:12:04:1f:2a:8d:6b:73:2a:60:21:6f:dd:5b:4b:e2:14:f6:f8:22:e0:50:9d:55:5a:91:63:23:1c:f2:4f
Signer

Actual PE Digest

43:55:12:04:1f:2a:8d:6b:73:2a:60:21:6f:dd:5b:4b:e2:14:f6:f8:22:e0:50:9d:55:5a:91:63:23:1c:f2:4f

Digest Algorithm

sha256

PE Digest Matches

true

ff:5d:66:d6:73:77:29:50:b2:d6:cf:fe:6b:93:c8:dd:ff:2f:4b:84
Signer

Actual PE Digest

ff:5d:66:d6:73:77:29:50:b2:d6:cf:fe:6b:93:c8:dd:ff:2f:4b:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
DeviceIoControl
DeleteCriticalSection
GetCurrentProcessId
GetModuleFileNameW
Sleep
InitializeCriticalSection
LoadLibraryExW
OpenEventW
WaitForMultipleObjects
CreateEventW
EnterCriticalSection
GetLastError
DisconnectNamedPipe
GetOverlappedResult
ReadFile
LeaveCriticalSection
WriteFile
CreateNamedPipeW
ConnectNamedPipe
SetEvent
FreeLibrary
GetWindowsDirectoryW
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetProcAddress
OpenProcess
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleHandleW
GetCurrentProcess
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
GetFileSizeEx
SetLastError
CreateMutexW
TlsGetValue
HeapAlloc
HeapFree
WaitForSingleObject
OutputDebugStringW
GetProcessHeap
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
GetCurrentThreadId
ReleaseMutex
TlsAlloc
TlsFree
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
VirtualAlloc
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
RaiseException

advapi32

RegQueryValueExW
GetTokenInformation
RegQueryValueExA
RegEnumKeyExW
ControlService
ReportEventW
RegisterServiceCtrlHandlerW
SetServiceStatus
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
DeregisterEventSource
OpenServiceW
StartServiceCtrlDispatcherW
OpenSCManagerW
DeleteService
CloseServiceHandle
RegisterEventSourceW
CreateServiceW
RegCloseKey
RegOpenKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
OpenProcessToken

ole32

CoUninitialize
CoInitializeEx

shlwapi

StrCmpIW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360FileUninst.exe
.exe windows x86

8ed0d60e647789f063655d9d00f44e34

Code Sign

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

88:53:bc:f1:89:65:3a:90:7d:92:94:8e:94:3d:20:ed:5f:88:58:b5:25:7f:1f:4a:67:7f:2d:e4:d1:cf:14:8a
Signer

Actual PE Digest

88:53:bc:f1:89:65:3a:90:7d:92:94:8e:94:3d:20:ed:5f:88:58:b5:25:7f:1f:4a:67:7f:2d:e4:d1:cf:14:8a

Digest Algorithm

sha256

PE Digest Matches

true

10:5c:05:84:aa:5c:b3:e6:e7:f1:31:10:15:33:63:56:5c:fe:b4:58
Signer

Actual PE Digest

10:5c:05:84:aa:5c:b3:e6:e7:f1:31:10:15:33:63:56:5c:fe:b4:58

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyFileW
TerminateProcess
CreateEventW
WaitForMultipleObjects
ResetEvent
SetEvent
GetCurrentProcessId
DeviceIoControl
WriteFile
CreateFileW
GetLastError
FindFirstFileA
FindNextFileA
lstrlenA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindFirstFileW
FindNextFileW
DeleteFileW
FindClose
InterlockedCompareExchange
GetShortPathNameW
SetPriorityClass
ResumeThread
CreateProcessW
GetVersionExW
GetSystemDirectoryW
LoadLibraryW
LoadLibraryExW
FreeResource
FreeLibrary
GetSystemWindowsDirectoryW
lstrlenW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
GetProcAddress
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
OpenProcess
WaitForSingleObject
CloseHandle
Sleep
RemoveDirectoryW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
LoadLibraryA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetACP
GetModuleHandleA
VirtualAlloc
FatalAppExitA
VirtualFree
HeapCreate
GetModuleFileNameA
GetStdHandle
GetCurrentThread
GetCPInfo
CreateDirectoryW
GetModuleFileNameW
FindResourceExW
FindResourceW
LCMapStringW
LCMapStringA
DeleteFileA
LoadResource
LockResource
SizeofResource
SetCurrentDirectoryW
GetTickCount
MulDiv
ReadFile
GetFileSize
OutputDebugStringW
SetFilePointer
GetFileType
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
GetCurrentDirectoryW
SetFileTime
ExitProcess
RaiseException
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
CreateFileA
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetEndOfFile
SetFilePointerEx
GetFileSizeEx
SetLastError
CreateMutexW
TlsGetValue
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
GetCurrentThreadId
ReleaseMutex
TlsAlloc
TlsFree
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetCommandLineA
GetStartupInfoA

user32

GetWindowLongW
PostQuitMessage
DispatchMessageW
SetWindowPos
ScreenToClient
GetClientRect
ShowWindow
SetWindowLongW
SetWindowTextW
wsprintfW
OffsetRect
InflateRect
UnionRect
DefWindowProcW
SystemParametersInfoW
LoadImageW
GetSystemMetrics
GetWindow
CallWindowProcW
GetPropW
SetPropW
AdjustWindowRectEx
GetMenu
SetCursor
LoadCursorW
wvsprintfW
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
GetKeyState
GetDC
InvalidateRect
FindWindowW
KillTimer
SetCapture
ReleaseCapture
PtInRect
ReleaseDC
GetFocus
GetCapture
MapWindowPoints
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
GetCursorPos
CharNextW
IntersectRect
FillRect
DrawTextW
CharPrevW
SetRect
GetWindowTextW
GetWindowTextLengthW
CreateCaret
HideCaret
ShowCaret
SetCaretPos
ClientToScreen
GetSysColor
GetMonitorInfoW
MonitorFromWindow
InvalidateRgn
CreateAcceleratorTableW
EnableWindow
IsWindow
GetMessageW
SetFocus
RemovePropW
SetTimer
PostMessageW
DestroyWindow
GetParent
GetWindowRect
MoveWindow
GetWindowRgn
IsWindowVisible
IsZoomed
IsIconic
SendMessageW
TranslateMessage

gdi32

GetTextMetricsW
CreateFontIndirectW
CreatePen
GetObjectW
GetStockObject
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteDC
CreateRectRgn
PtInRegion
DeleteObject
Rectangle
RestoreDC
BitBlt
SaveDC
CreateCompatibleBitmap
GetDeviceCaps
SelectClipRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
CombineRgn
CreateRoundRectRgn
StretchBlt
SetStretchBltMode
SetWindowOrgEx
GdiFlush
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
SetBkMode
SetTextColor
RoundRect
MoveToEx
LineTo
CreateSolidBrush
SetBkColor
ExtTextOutW

advapi32

AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
RegOpenKeyExW
GetTokenInformation
OpenProcessToken
RegEnumKeyExW
LookupPrivilegeValueW
RegCreateKeyExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
ControlService
RegOpenKeyW
RegDeleteValueW
RegEnumKeyExA
RegQueryInfoKeyA

shell32

ord21
SHBindToParent
ord23
SHParseDisplayName
SHGetFileInfoW
SHGetFolderLocation
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ord165
SHGetDesktopFolder
ord680

ole32

CoUninitialize
OleUninitialize
OleInitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoInitialize
OleLockRunning
CLSIDFromProgID
CLSIDFromString

oleaut32

SysFreeString

shlwapi

PathFileExistsA
StrCmpW
PathRemoveFileSpecW
PathRemoveBackslashW
StrRetToStrW
SHDeleteKeyW
PathAppendW
PathCombineW
StrCmpIW
StrStrIW
PathFileExistsW
PathFindFileNameW
SHGetValueA
PathCombineA
StrCmpNIW
PathIsDirectoryW
SHGetValueW
PathAppendA

psapi

GetModuleFileNameExW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

crypt32

CryptStringToBinaryA
CertGetNameStringW
CryptBinaryToStringA

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

comctl32

ord17
_TrackMouseEvent

Sections

.text
Size: 766KB - Virtual size: 765KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360FileUpdate.exe
.exe windows x86

f6e3dcf07e8115e1d26a50b0c511bd38

Code Sign

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a0:2a:a2:a4:eb:ee:5e:bb:8e:82:83:24:5a:e3:a8:30:37:e9:f3:07:4a:fd:17:0a:5d:e1:b2:36:c0:62:2b:59
Signer

Actual PE Digest

a0:2a:a2:a4:eb:ee:5e:bb:8e:82:83:24:5a:e3:a8:30:37:e9:f3:07:4a:fd:17:0a:5d:e1:b2:36:c0:62:2b:59

Digest Algorithm

sha256

PE Digest Matches

true

f3:e3:ea:49:37:19:ec:46:85:ab:73:6d:a5:21:26:2c:9a:9f:52:f1
Signer

Actual PE Digest

f3:e3:ea:49:37:19:ec:46:85:ab:73:6d:a5:21:26:2c:9a:9f:52:f1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
CreateMutexW
CloseHandle
Sleep
InterlockedCompareExchange
GetCurrentProcess
FlushInstructionCache
SetLastError
CreateDirectoryW
CreateFileW
WriteFile
GetTickCount
FreeResource
LockResource
GetSystemWindowsDirectoryW
GetVersionExW
FindResourceExW
lstrlenA
GetCommandLineW
DeviceIoControl
GetCurrentProcessId
WideCharToMultiByte
DuplicateHandle
SetEvent
CreateEventW
WaitForSingleObject
WaitForMultipleObjects
ResetEvent
UnhandledExceptionFilter
TerminateProcess
TlsFree
TlsAlloc
ReleaseMutex
InterlockedIncrement
InterlockedDecrement
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetLastError
EnterCriticalSection
RaiseException
LeaveCriticalSection
lstrcmpiW
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
HeapWalk
HeapLock
OpenThread
GetStdHandle
HeapCreate
ExitProcess
GetCPInfo
GetModuleHandleW
lstrlenW
LCMapStringW
LCMapStringA
RtlUnwind
GetStartupInfoW
FreeLibrary
GetProcAddress
FlushFileBuffers
LoadLibraryW
CreateThread
ExitThread
IsDebuggerPresent
InterlockedExchange
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapDestroy
HeapReAlloc
HeapSize
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
ReadFile
GetFileSizeEx
TlsGetValue
OutputDebugStringW
TlsSetValue
HeapUnlock
SetUnhandledExceptionFilter

user32

TranslateMessage
GetMessageW
PeekMessageW
ShowWindow
UnregisterClassA
DefWindowProcW
DestroyWindow
RegisterClassExW
GetClassInfoExW
LoadCursorW
SetWindowLongW
CreateWindowExW
PostMessageW
CharNextW
DispatchMessageW
CallWindowProcW
GetWindowLongW
PostQuitMessage
SendMessageW
GetSystemMetrics
LoadImageW
RegisterWindowMessageW
IsWindow

advapi32

RegDeleteValueW
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW

shell32

SHGetSpecialFolderPathW

ole32

CoInitializeEx
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize
CoInitializeSecurity
CoTaskMemFree

oleaut32

VarUI4FromStr

shlwapi

StrCmpIW
PathCombineW
StrStrIW
PathRemoveFileSpecW
PathAppendW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

Sections

.text
Size: 281KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MiniUI.dll
.dll windows x86

f986ff25a78e0c855385d1734a1726e9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

89:db:40:ac:47:25:ba:46:d0:07:a5:a1:8e:3b:40:a1:9b:78:fb:53:ac:18:d3:b4:4d:36:7a:50:6a:39:ea:3f
Signer

Actual PE Digest

89:db:40:ac:47:25:ba:46:d0:07:a5:a1:8e:3b:40:a1:9b:78:fb:53:ac:18:d3:b4:4d:36:7a:50:6a:39:ea:3f

Digest Algorithm

sha256

PE Digest Matches

true

3e:c8:da:ce:6d:e9:49:ce:87:a9:e1:ef:96:3c:b3:9b:11:30:58:0c
Signer

Actual PE Digest

3e:c8:da:ce:6d:e9:49:ce:87:a9:e1:ef:96:3c:b3:9b:11:30:58:0c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleHandleA
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
SetStdHandle
LCMapStringW
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
HeapDestroy
HeapCreate
GetModuleFileNameA
GetStdHandle
HeapSize
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
GetCommandLineA
ExitProcess
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
TlsFree
DeleteAtom
FindAtomW
TlsAlloc
ReleaseMutex
AddAtomW
OpenThread
GetAtomNameW
TlsSetValue
TlsGetValue
CreateMutexW
GetSystemTime
LocalFree
FormatMessageW
GetFileSizeEx
ReadFile
WriteFile
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
LocalAlloc
HeapFree
GetProcessHeap
HeapAlloc
GetVersion
InterlockedExchange
GetFileTime
LoadLibraryExW
lstrcmpiW
FindResourceW
GetLastError
LoadResource
SizeofResource
LockResource
FreeResource
GlobalLock
GlobalUnlock
GlobalFree
CreateEventW
ResumeThread
Sleep
GlobalAlloc
SetEvent
WaitForSingleObject
ResetEvent
MulDiv
GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
GetSystemWindowsDirectoryW
GetStartupInfoW
OutputDebugStringW
DebugBreak
lstrlenA
GetTempPathW
GetTempFileNameW
DeleteFileW
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
CloseHandle
RaiseException
InterlockedDecrement
lstrlenW
EnterCriticalSection
LeaveCriticalSection
CreateProcessW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
DeleteCriticalSection
FreeLibrary
InitializeCriticalSection
LoadLibraryW
GetCurrentProcessId
CreateFileW
DeviceIoControl
IsValidCodePage

user32

SetWindowPos
MonitorFromWindow
CreateDialogParamW
EnableWindow
GetMessageTime
GetPropW
EnableScrollBar
SetTimer
ShowScrollBar
SetPropW
RemovePropW
GetSysColorBrush
DrawEdge
FrameRect
DrawFrameControl
GetParent
UnregisterClassA
KillTimer
SetDlgItemTextW
EndDialog
GetWindowThreadProcessId
DialogBoxParamW
LoadImageW
wsprintfW
MessageBoxW
SetScrollRange
SetWindowTextW
FindWindowW
MapWindowPoints
LoadBitmapW
WindowFromDC
GetWindowDC
GetMessagePos
GetActiveWindow
GetDC
ReleaseDC
SetWindowLongW
CharLowerW
GetCursor
PostMessageW
GetClientRect
InvalidateRect
ShowWindow
IsWindow
GetClassInfoExW
LoadCursorW
OffsetRect
LoadStringW
DestroyWindow
DrawTextW
SystemParametersInfoW
GetWindowTextLengthW
GetWindowTextW
DrawIconEx
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetSubMenu
ClientToScreen
TrackPopupMenu
MonitorFromPoint
GetMonitorInfoW
GetMenuItemCount
IsZoomed
GetMenuStringW
DestroyMenu
LoadMenuW
GetSystemMetrics
UpdateWindow
SetRectEmpty
GetFocus
EqualRect
SetFocus
SetScrollPos
SetScrollInfo
GetScrollRange
GetScrollPos
GetScrollInfo
CharNextW
wvsprintfW
SetCursor
IntersectRect
SetRect
FillRect
IsIconic
CopyIcon
SetWindowRgn
DestroyIcon
MoveWindow
EnumChildWindows
GetDlgItem
GetWindowRect
GetWindow
CharUpperW
GetComboBoxInfo
GetClassNameW
ReleaseCapture
GetNextDlgGroupItem
IsWindowEnabled
GetCursorPos
ScreenToClient
GetDlgCtrlID
CopyRect
InflateRect
PtInRect
IsRectEmpty
RedrawWindow
IsWindowVisible
SendMessageW
SetCapture
SetLayeredWindowAttributes
CreateWindowExW
RegisterClassExW
EndPaint
BeginPaint
CallWindowProcW
GetWindowLongW
DefWindowProcW

gdi32

SetTextColor
GetTextExtentPoint32W
SetBkMode
BitBlt
DeleteDC
DeleteObject
CreateCompatibleBitmap
SetViewportOrgEx
SelectObject
CreateCompatibleDC
SetBkColor
ExtTextOutW
GetCurrentObject
GetObjectW
StretchBlt
SetStretchBltMode
Rectangle
RoundRect
CreateEllipticRgn
CombineRgn
OffsetRgn
PatBlt
CreateDIBSection
PlayEnhMetaFile
SetWindowOrgEx
IntersectClipRect
CreateFontIndirectW
GetStockObject
GetObjectType
SaveDC
RestoreDC
OffsetViewportOrgEx
CreateRectRgn
CreateRoundRectRgn
GetDeviceCaps
CreateSolidBrush
SelectClipRgn
CreateDCW
GetViewportOrgEx
MoveToEx
LineTo
CreateDIBitmap
CreateFontW
CreatePen

advapi32

RegQueryValueExA
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW

ole32

CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
CoInitialize

oleaut32

VarBstrCmp
VariantCopy
SysAllocStringLen
VariantChangeType
VarUI4FromStr
OleLoadPicture
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
SysFreeString
SysStringLen
SysAllocString

shlwapi

SHSetValueW
SHGetValueW
wnsprintfW
PathRemoveExtensionW
PathFindExtensionW
PathAppendW
PathIsRelativeW
PathRemoveFileSpecW
PathCombineW
PathFileExistsW

comctl32

InitCommonControlsEx
_TrackMouseEvent
ImageList_Destroy

msimg32

GradientFill
AlphaBlend
TransparentBlt

gdiplus

GdipCloneImage
GdipLoadImageFromStream
GdipDisposeImage
GdipAlloc
GdipFree
GdipLoadImageFromStreamICM
GdiplusStartup

Exports

Exports

CreateBalloonManager
CreateDynamicScrollBar
CreateDynamicScrollBar2
CreateMessageBoxRender
CreateMiniUIBitmap
GetCompitibleMode
GetDPICompatible
GetMiniUI
GetMiniUI2
GetMiniUI3
GetMiniUI4
OnSkinChanged
SetCompitibleMode
SetMiniUIFlag

Sections

.text
Size: 621KB - Virtual size: 621KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Utils/360FeedBack.xml
Utils/360Feedback.exe
.exe windows x86

b68dca625621b3d31c676581c986dc3f

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

13:b7:74:ee:59:e3:5e:c6:06:26:16:89
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

28/02/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 002-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:6d:c6:cc:ab:c8:bb:ad:66:be:20:fb:2a:f7:f4:4e:ea:09:04:2a:19:73:47:be:66:50:9d:dc:71:b5:d2:d5
Signer

Actual PE Digest

7b:6d:c6:cc:ab:c8:bb:ad:66:be:20:fb:2a:f7:f4:4e:ea:09:04:2a:19:73:47:be:66:50:9d:dc:71:b5:d2:d5

Digest Algorithm

sha256

PE Digest Matches

true

4f:48:d9:81:65:9b:02:9c:b3:84:0f:bd:c9:c6:58:d8:f3:b3:bc:d4
Signer

Actual PE Digest

4f:48:d9:81:65:9b:02:9c:b3:84:0f:bd:c9:c6:58:d8:f3:b3:bc:d4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemInfo
GetModuleHandleA
SetFilePointer
ReadFile
GetStartupInfoW
CopyFileW
lstrcpynW
GetTickCount
WaitForSingleObject
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
LCMapStringA
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
HeapSize
GetStdHandle
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitProcess
Sleep
RtlUnwind
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
GetFileSizeEx
WriteFile
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExW
GetFileAttributesW
LocalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
MulDiv
GetCommandLineW
GetTempPathW
GetTempFileNameW
DeleteFileW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FindNextFileW
FindFirstFileW
FindClose
lstrlenA
SetLastError
lstrcmpiW
CreateProcessW
GetProcAddress
GetCurrentThreadId
CreateMutexW
GetModuleHandleW
GetLastError
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
lstrlenW
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess
FlushInstructionCache
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
WideCharToMultiByte
InterlockedExchange
GetCurrentProcessId
CreateFileW
DeviceIoControl
CloseHandle
GetModuleFileNameA

user32

IsRectEmpty
ReleaseCapture
TrackMouseEvent
InflateRect
GetClassInfoW
RegisterClassW
LoadStringW
ShowWindow
PostMessageW
UnregisterClassA
SetWindowLongW
GetCursorPos
SetCapture
SetRect
FillRect
SetForegroundWindow
IsIconic
FindWindowW
CharLowerW
GetSystemMetrics
LoadImageW
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
CharNextW
DestroyWindow
CreateDialogParamW
MessageBoxW
GetActiveWindow
DefWindowProcW
IsDialogMessageW
GetKeyState
SetActiveWindow
DialogBoxParamW
RegisterClassExW
EnableMenuItem
GetSubMenu
LoadMenuW
LoadCursorW
GetClassInfoExW
HideCaret
ClientToScreen
SetWindowTextW
GetWindow
MonitorFromWindow
GetMonitorInfoW
EndDialog
GetFocus
EnableWindow
GetWindowTextW
FindWindowExW
SetDlgItemTextW
SetFocus
MoveWindow
ScreenToClient
MapWindowPoints
GetDlgItem
IsWindowVisible
InvalidateRect
GetWindowRect
SetWindowPos
SetWindowRgn
KillTimer
SetTimer
SetLayeredWindowAttributes
CallWindowProcW
GetWindowLongW
EndPaint
BeginPaint
GetDC
ReleaseDC
PtInRect
IsWindow
DrawTextW
OffsetRect
GetParent
RedrawWindow
GetClientRect
CreateWindowExW
SendMessageW

gdi32

DeleteObject
CreateCompatibleBitmap
CreateRectRgn
CreateCompatibleDC
SetBkColor
ExtTextOutW
Rectangle
SetBkMode
EnumFontFamiliesW
CreateSolidBrush
SaveDC
RestoreDC
DeleteDC
CreateFontW
CreatePen
BitBlt
SetTextColor
CombineRgn
SelectObject
CreatePolygonRgn
GetStockObject
SetViewportOrgEx

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExA

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetSpecialFolderPathA
ShellExecuteW

ole32

CoTaskMemAlloc
CoInitialize
OleInitialize
CoUninitialize
OleUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc

oleaut32

SysStringLen
SysFreeString
VariantChangeType
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
SysAllocString

shlwapi

PathAppendA
PathCanonicalizeW
PathFindFileNameW
StrCmpW
StrCmpIW
PathCombineA
SHGetValueA
PathFileExistsA
SHGetValueW
PathAppendW
PathRemoveFileSpecW
PathCombineW
PathIsRelativeW
PathFileExistsW

comctl32

_TrackMouseEvent
InitCommonControlsEx

Sections

.text
Size: 294KB - Virtual size: 293KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Utils/360ScreenCapture.exe
.exe windows x86

13f8a8ee634cc599bcef22445ba028ac

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

28/01/2021, 11:08

Not After

01/03/2032, 11:08

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fb:6f:cb:97:14:2a:2e:a3:f5:8a:81:3e:39:04:b2:27:30:79:6f:ca:d6:77:db:2e:f3:cb:38:84:35:a5:0c:93
Signer

Actual PE Digest

fb:6f:cb:97:14:2a:2e:a3:f5:8a:81:3e:39:04:b2:27:30:79:6f:ca:d6:77:db:2e:f3:cb:38:84:35:a5:0c:93

Digest Algorithm

sha256

PE Digest Matches

true

68:1f:fe:b3:be:26:d0:47:b0:10:c3:9d:f1:e1:e0:ac:17:12:ad:4d
Signer

Actual PE Digest

68:1f:fe:b3:be:26:d0:47:b0:10:c3:9d:f1:e1:e0:ac:17:12:ad:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetStartupInfoA
GetFileType
SetHandleCount
SetFilePointer
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
Process32NextW
GetStartupInfoW
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
OutputDebugStringW
WaitForSingleObject
TlsGetValue
GetFileSizeEx
ReadFile
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
VirtualAlloc
DeleteFileW
GlobalLock
GlobalUnlock
TerminateProcess
GlobalAlloc
GlobalFree
LocalFree
WriteFile
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedCompareExchange
Sleep
FreeResource
GetSystemWindowsDirectoryW
GetVersionExW
CreateProcessW
CreateFileW
DeviceIoControl
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
InitializeCriticalSection
lstrlenW
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
CreateMutexW
OpenProcess
GetModuleHandleW
GetProcAddress
CreateToolhelp32Snapshot
LCMapStringW
Process32FirstW
CloseHandle
GetCurrentProcessId
GetCurrentProcess
FlushInstructionCache
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
RaiseException
GetLastError
GetCurrentThreadId
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
SetLastError
GetCommandLineW
LeaveCriticalSection
ExitProcess
EnterCriticalSection
lstrcpyW

user32

CloseClipboard
EmptyClipboard
GetClipboardData
OpenClipboard
ChangeClipboardChain
SendMessageW
SetClipboardViewer
SetWindowPos
GetSystemMetrics
GetWindowRect
GetParent
UnhookWindowsHookEx
GetWindowLongW
MessageBoxW
ShowWindow
CreateWindowExW
GetClassInfoExW
LoadCursorW
RegisterClassExW
DispatchMessageW
TranslateMessage
GetMessageW
DefWindowProcW
DestroyWindow
CharNextW
SetWindowLongW
CallNextHookEx
ReleaseDC
GetDC
InvalidateRect
FillRect
InflateRect
GetClientRect
GetDlgItem
BeginPaint
EndPaint
GetKeyState
CallWindowProcW
IsWindow
FindWindowExW
UnregisterClassA
IntersectRect
SetWindowsHookExW
EqualRect
SetFocus
SetWindowTextW
GetSysColorBrush
SetCursor
ReleaseCapture
ScreenToClient
DrawTextW
UpdateWindow
RedrawWindow
CreateDialogParamW
SetClipboardData
GetWindow
PtInRect
IsWindowVisible
IsRectEmpty
KillTimer
MoveWindow
SetTimer
GetCursorPos
CopyRect
GetAsyncKeyState
SetClassLongW
PostMessageW
GetWindowTextW
SetRect
wsprintfW

gdi32

SelectPalette
RealizePalette
Ellipse
Polygon
GetPixel
SetROP2
SetBkMode
SetTextColor
GetDIBits
CreateDCW
SaveDC
SetMapMode
SetViewportOrgEx
SetWindowOrgEx
MoveToEx
LineTo
RestoreDC
CreateDIBSection
CreateCompatibleBitmap
GetStockObject
CreateSolidBrush
CreatePen
Rectangle
EnumFontFamiliesExW
CreateFontW
EnumFontFamiliesW
CreateCompatibleDC
SelectObject
BitBlt
SetStretchBltMode
StretchBlt
DeleteDC
GetObjectW
DeleteObject
GetDeviceCaps

comdlg32

GetSaveFileNameW

advapi32

RegDeleteKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegQueryValueExA

shell32

ShellExecuteW
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemRealloc
CreateStreamOnHGlobal
RevokeDragDrop

oleaut32

VarUI4FromStr
SysAllocString
SysFreeString

shlwapi

PathAppendW
PathFileExistsW
PathAddBackslashW
PathFindFileNameW
PathFindExtensionW
PathCombineW
SHSetValueW
SHGetValueW
StrCmpIW
StrCmpW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipAlloc
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipSetClipPath
GdipDrawPath
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipAddPathRectangle
GdipAddPathLineI
GdipDeletePath
GdipCreatePath
GdipSetPenLineJoin
GdipSetPenEndCap
GdipSetPenStartCap
GdipDeletePen
GdipCreatePen1
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipCloneImage
GdipDisposeImage
GdipFree

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

GetModuleFileNameExW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

Sections

.text
Size: 474KB - Virtual size: 474KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Utils/360searchlite.exe
.exe windows x86

3d280f6b072090e59bbad89786eb1307

Code Sign

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f1:43:bb:7e:d5:cf:01:e3:74:5a:a2:b3:37:d1:9c:97:72:26:15:6a:fb:ab:0f:cd:58:3a:b0:ed:17:1c:0d:2d
Signer

Actual PE Digest

f1:43:bb:7e:d5:cf:01:e3:74:5a:a2:b3:37:d1:9c:97:72:26:15:6a:fb:ab:0f:cd:58:3a:b0:ed:17:1c:0d:2d

Digest Algorithm

sha256

PE Digest Matches

true

1b:42:ce:1d:c2:0e:b0:3a:b7:f8:23:fa:54:da:5f:4e:9e:78:df:1c
Signer

Actual PE Digest

1b:42:ce:1d:c2:0e:b0:3a:b7:f8:23:fa:54:da:5f:4e:9e:78:df:1c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
Sleep
SetEvent
MulDiv
QueryDosDeviceW
GetDriveTypeW
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetFileAttributesW
GetVolumeInformationW
CreateEventW
GetCommandLineW
WaitForMultipleObjects
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
DeviceIoControl
GetCurrentProcessId
CreateProcessW
InterlockedCompareExchange
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetErrorMode
ReadFile
lstrcpynW
GetFileSize
DeleteFileW
MapViewOfFileEx
lstrlenA
CreateIoCompletionPort
PostQueuedCompletionStatus
InterlockedExchange
GetQueuedCompletionStatus
ResetEvent
TerminateThread
GetExitCodeThread
GetNativeSystemInfo
GetACP
FormatMessageW
WritePrivateProfileStringW
MoveFileExW
SetFileAttributesW
ReleaseSemaphore
CreateThread
CreateSemaphoreW
SetFilePointerEx
lstrcpynA
GetTempPathW
SetThreadLocale
GetThreadLocale
GetWindowsDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryA
GetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
OutputDebugStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetVersionExW
GetFileType
SetHandleCount
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetModuleFileNameA
GetStdHandle
GetCurrentThread
IsValidCodePage
GetOEMCP
FatalAppExitA
HeapCreate
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoW
MoveFileA
ExitThread
ExitProcess
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
TlsGetValue
GetFileSizeEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
WriteFile
GetModuleHandleA
GetSystemInfo
LoadLibraryExW
MultiByteToWideChar
lstrcmpiW
GetVersion
InterlockedDecrement
InterlockedIncrement
lstrlenW
InitializeCriticalSection
SetCurrentDirectoryW
RaiseException
CreateMutexW
GetLastError
TerminateProcess
GetTickCount
GetModuleFileNameW
GetPrivateProfileIntW
GetPrivateProfileStringW
CreateFileW
SetFilePointer
SetLastError
GetCurrentThreadId
FreeLibrary
LoadLibraryW
GetCurrentProcess
FlushInstructionCache
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
GetStartupInfoA
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CloseHandle
WriteConsoleA

user32

EmptyClipboard
SetWindowLongW
UnregisterClassA
ShowWindow
GetClassInfoExW
LoadCursorW
DispatchMessageW
TranslateMessage
wsprintfW
MoveWindow
LoadImageW
DialogBoxParamW
EndDialog
LoadIconW
GetMessageW
PeekMessageW
DestroyWindow
RegisterClassExW
CreateWindowExW
MessageBoxW
SendMessageW
SwitchToThisWindow
SetForegroundWindow
BringWindowToTop
PostMessageW
IsIconic
IsWindowEnabled
FindWindowW
DefWindowProcW
CharNextW
GetActiveWindow
CreatePopupMenu
GetMenuItemID
InsertMenuW
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetMenuItemCount
GetMenuItemInfoW
GetMenuStringW
DeleteMenu
RegisterClipboardFormatW
OpenClipboard
GetKeyState
SetClipboardData
CloseClipboard
CallWindowProcW
GetWindowTextW
ScreenToClient
PtInRect
CopyRect
GetDC
ReleaseDC
LoadMenuW
GetSubMenu
GetCursorPos
TrackPopupMenu
DestroyMenu
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
IsWindow
SetFocus
KillTimer
SetTimer
IsWindowVisible
PostQuitMessage
ClientToScreen
GetWindowRect
SetWindowPos
IsZoomed
SetWindowTextW
GetWindowLongW
PrivateExtractIconsW
DestroyIcon

gdi32

DPtoLP
SelectObject
GetStockObject
CreateFontIndirectW
GetTextExtentPoint32W
DeleteObject
GetDeviceCaps

advapi32

RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetUserNameW
LookupAccountNameW
ConvertSidToStringSidW
GetUserNameA
LookupAccountNameA
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetTokenInformation
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
RegDeleteKeyW

shell32

CommandLineToArgvW
ExtractIconExW
ShellExecuteExW
SHGetFolderPathW
ord165
SHGetDesktopFolder
SHGetSpecialFolderPathW
SHOpenFolderAndSelectItems
ord190
SHGetFileInfoW
ord155
ShellExecuteW

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoInitializeEx
OleDuplicateData
ReleaseStgMedium
DoDragDrop
CLSIDFromString
CoTaskMemAlloc
CoInitialize
CoUninitialize

oleaut32

CreateErrorInfo
SysStringLen
DispCallFunc
VariantClear
SysStringByteLen
SysAllocStringByteLen
VariantInit
SetErrorInfo
VariantChangeType
GetErrorInfo
SysAllocString
SysFreeString
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi

shlwapi

PathFindExtensionW
UrlGetPartW
PathFileExistsW
PathAppendW
PathFindFileNameW
ord176
PathCombineW
SHGetValueW
PathUnquoteSpacesW
PathRemoveFileSpecW
SHSetValueW
StrCmpNIW
PathIsRelativeW
PathCanonicalizeW
StrCpyNW
PathAppendA

comctl32

ord410
ord413
InitCommonControlsEx

iphlpapi

GetAdaptersInfo
GetIpAddrTable

crypt32

CryptBinaryToStringW
CryptStringToBinaryW
CryptStringToBinaryA
CryptBinaryToStringA
CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

version

VerQueryValueW

wininet

InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetSetOptionW
InternetCrackUrlW
InternetSetFilePointer
InternetReadFile
InternetCloseHandle
HttpQueryInfoW

Sections

.text
Size: 879KB - Virtual size: 879KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Utils/SiteUIProxy.dll
.dll windows x86

4bf9a8492ec13d48fc1089cb2826c443

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:80:19:86:b3:ff:40:56:c1:c5:9c:77:fc:c1:f3:65:18:44:d7:cc:79:81:08:a9:d9:c9:40:23:fc:1a:69:32
Signer

Actual PE Digest

0f:80:19:86:b3:ff:40:56:c1:c5:9c:77:fc:c1:f3:65:18:44:d7:cc:79:81:08:a9:d9:c9:40:23:fc:1a:69:32

Digest Algorithm

sha256

PE Digest Matches

true

d9:e3:e7:61:65:3f:d4:68:8f:f5:e7:73:33:b1:3a:f1:7e:28:b9:3f
Signer

Actual PE Digest

d9:e3:e7:61:65:3f:d4:68:8f:f5:e7:73:33:b1:3a:f1:7e:28:b9:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
FlushInstructionCache
SetCurrentDirectoryW
GetLongPathNameW
GetPrivateProfileStringW
GetFileSizeEx
MulDiv
GetVersionExW
DeleteFileW
GetTempFileNameW
GetTempPathW
GetModuleFileNameW
InterlockedCompareExchange
LeaveCriticalSection
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
SetFilePointer
GetLocaleInfoA
SizeofResource
SetLastError
GetStringTypeW
GetStringTypeA
LCMapStringA
GetModuleHandleA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
LCMapStringW
HeapSize
GetModuleFileNameA
GetStdHandle
HeapDestroy
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
RtlUnwind
GetCommandLineA
lstrlenA
OutputDebugStringW
DebugBreak
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
DeleteCriticalSection
lstrcmpiW
DeviceIoControl
EnterCriticalSection
GetProcAddress
GetLastError
RaiseException
lstrlenW
MultiByteToWideChar
CreateFileW
LoadLibraryW
InitializeCriticalSection
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
LoadResource
FreeLibrary
ExitProcess
Sleep
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
TlsFree
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
WideCharToMultiByte
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
WaitForSingleObject
TlsGetValue
CreateMutexW
ReadFile
WriteFile
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
FindResourceW

user32

GetClassInfoExW
DefWindowProcW
CreateWindowExW
SetWindowLongW
GetWindowLongW
CallWindowProcW
ReleaseDC
GetDC
GetClientRect
EndPaint
BeginPaint
GetWindowRect
IsWindow
SetWindowPos
UnregisterClassA
RegisterClassExW
CopyRect
GetClassInfoW
RegisterClassW
MapWindowPoints
GetParent
CharNextW
LoadCursorW
CharUpperW
SetCursor
GetCursor
EqualRect
SendMessageW
InvalidateRect
PtInRect
DrawTextW
OffsetRect
DestroyWindow
PostMessageW
CharLowerW
MessageBoxW
LoadStringW
DialogBoxParamW
EndDialog
SetWindowTextW
GetActiveWindow
BringWindowToTop
GetWindow
MonitorFromWindow
GetMonitorInfoW

gdi32

GetDeviceCaps
CreateFontIndirectW
SetTextColor
SetBkColor
SetBkMode
GetTextExtentPoint32W
SelectObject

advapi32

RegQueryValueExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegQueryValueExA

shell32

ShellExecuteW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysStringLen
VariantChangeType
DispCallFunc
VariantInit
SysFreeString
SysStringByteLen
VarUI4FromStr
SysAllocStringByteLen
VariantClear
SysAllocString

shlwapi

PathFindFileNameW
PathFileExistsW
PathCombineW
PathRemoveFileSpecW
PathFindExtensionW
SHSetValueW
SHGetValueW
StrToInt64ExW
PathIsRelativeW
PathAppendW

gdiplus

GdipGetImageEncoders
GdipSaveImageToFile
GdipFree
GdipAlloc
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageEncodersSize
GdipDrawImageRectRectI
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipCreateImageAttributes
GdipSetImageAttributesColorMatrix
GdipDisposeImage

Exports

Exports

Get360Customizine
GetChangeSkinManager
GetMiniUICompatible
GetSiteUIProxy
GetSkinImage
GetSmartInitializer

Sections

.text
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

shared
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Utils/feedback.ui
.zip
Utils/search_file_type.json
config/config.xml
config/defaultskin/MiniUI.xml
config/defaultskin/defaultskin.ui
.zip
config/newui/themes/default/360searchlite/360searchlite.ui
.zip
config/newui/themes/default/default_theme.ui
.zip
config/newui/themes/default/theme.xml
config/newui/themes/default/theme_360searchlite.xml
dbgeng.dll
.dll windows x86

69168bd04fdcc0767068266d288a5f34

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:13:36:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:49:55:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:45

Not After

10/01/2013, 20:55

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:96:7d:b7:09:69:7e:b3:9d:eb:0d:93:51:4e:6c:05:09:70:e7:02:b6:8c:bc:60:29:95:5d:2a:8c:3b:10:9b
Signer

Actual PE Digest

bd:96:7d:b7:09:69:7e:b3:9d:eb:0d:93:51:4e:6c:05:09:70:e7:02:b6:8c:bc:60:29:95:5d:2a:8c:3b:10:9b

Digest Algorithm

sha256

PE Digest Matches

true

8c:bb:a7:47:b4:b3:bf:82:4d:92:fe:47:40:b5:ef:30:35:07:62:d9
Signer

Actual PE Digest

8c:bb:a7:47:b4:b3:bf:82:4d:92:fe:47:40:b5:ef:30:35:07:62:d9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

fclose
__doserrno
_wfopen
swscanf
wcsstr
wcsrchr
_wtoi
_wcsdup
ctime
free
malloc
_wgetenv
iswspace
memmove
_vsnprintf
_vsnwprintf
time
??3@YAXPAX@Z
_purecall
wcschr
iswalnum
towupper
towlower
wcsncmp
_wcsicmp
iswdigit
strchr
_lseeki64
_write
_isatty
__pioinfo
__badioinfo
ferror
wctomb
_itoa
_snprintf
_iob
__mb_cur_max
mbtowc
_fileno
isleadbyte
memset
memcpy
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler
_errno
isspace
fseek
feof
fgetws
ftell
_wcslwr
wcstoul
atol
iswprint
strrchr
printf
_strlwr
qsort
iswalpha
iswupper
calloc
atoi
getenv
sscanf
strncmp
_wsetlocale
isprint
iswxdigit
_wctime
_strnicmp
realloc
_wcsupr
_wcsnicmp
fprintf
_stricmp
??1type_info@@UAE@XZ
_strtoui64
_wcstoui64
??2@YAPAXI@Z
fgets
strstr
_vscwprintf
wcsncpy
_snwprintf
_spawnlp
frexp
ldexp
_itow
_memicmp
_wtol
strtoul
memcmp

dbghelp

SymFromTokenW
SymMatchStringW
SymGetSourceVarFromTokenW
SymGetSourceFileTokenW
SymSearchW
SymSetOptions
ImagehlpApiVersionEx
ImageNtHeader
SymQueryInlineTrace
SymAddrIncludeInlineTrace
SymGetLineFromNameW64
SymEnumSymbolsW
SymFromInlineContextW
SymFunctionTableAccess64
SymAddSymbolW
SymFromAddrW
SymFromIndexW
SymDeleteSymbolW
SymGetTypeInfo
SymLoadModule64
SymGetOptions
SymLoadModuleExW
SymAddSymbol
DbgHelpCreateUserDump
SymFromNameW
SymGetFileLineOffsets64
SymGetModuleInfoW64
SymSetSearchPathW
SymGetHomeDirectoryW
SymEnumTypesW
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymEnumTypesByNameW
SymEnumSymbolsExW
SymEnumSymbolsForAddrW
SymGetLineFromAddrW64
SymGetLineFromInlineContextW
SymNextW
SymPrevW
StackWalkEx
SymCompareInlineTrace
SymEnumSourceLinesW
SymEnumLinesW
SymGetSourceFileFromTokenW
SymMatchFileNameW
SymCleanup
SymRegisterFunctionEntryCallback64
SymRegisterCallbackW64
SymInitializeW
ImageRvaToVa
ImageDirectoryEntryToDataEx
dbghelp
FindExecutableImageExW
SymFindFileInPathW
SymGetTypeInfoEx
SymUnloadModule64
GetTimestampForLoadedLibrary
SymMatchStringA
SymGetTypeFromNameW
SymGetUnwindInfo

version

VerQueryValueA

advapi32

GetLengthSid
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
CheckTokenMembership
GetUserNameW
RegDeleteValueW
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
TraceEvent
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle

kernel32

CreateNamedPipeA
LocalAlloc
SystemTimeToFileTime
WaitCommEvent
GetCommTimeouts
SetCommMask
GetCommMask
CreateDirectoryW
ContinueDebugEvent
WaitForDebugEvent
CreateRemoteThread
GetProcessTimes
SetThreadContext
VirtualFreeEx
VirtualAllocEx
VirtualProtectEx
WriteProcessMemory
GetExitCodeProcess
SetEnvironmentVariableA
DebugActiveProcess
IsProcessorFeaturePresent
SetCommTimeouts
SetupComm
SetCommState
GetCommState
GetSystemDirectoryA
OpenEventW
OpenFileMappingW
PeekNamedPipe
WaitNamedPipeW
ConnectNamedPipe
CreateNamedPipeW
OpenProcess
FileTimeToDosDateTime
FileTimeToLocalFileTime
FindFirstFileA
GetTempFileNameA
GetTempPathA
LoadLibraryExA
GetComputerNameExW
GetFileTime
GetTempFileNameW
GetTimeZoneInformation
CreateEventA
VirtualProtect
DelayLoadFailureHook
GetThreadSelectorEntry
TerminateThread
lstrcmpiW
HeapCreate
HeapFree
HeapReAlloc
HeapDestroy
HeapAlloc
VirtualQueryEx
GetThreadTimes
GetThreadPriority
GetThreadContext
ResumeThread
SuspendThread
ReadProcessMemory
CreateFileMappingA
GetVersionExA
GetModuleHandleA
RtlUnwind
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetPriorityClass
CreateFileA
DebugBreak
CancelIo
GetOverlappedResult
WaitForMultipleObjects
GetLocalTime
DeviceIoControl
LockResource
LoadResource
SizeofResource
LocalFree
FileTimeToSystemTime
GetCommandLineW
MapViewOfFile
GetFileSize
SwitchToFiber
CreateFiber
ConvertThreadToFiber
DeleteFiber
FreeLibrary
SetErrorMode
RaiseException
SetLastError
DeleteFileA
UnmapViewOfFile
GetModuleFileNameA
ResetEvent
ReleaseMutex
QueryPerformanceCounter
QueryPerformanceFrequency
WriteFile
LoadLibraryA
ClearCommError
GetCommModemStatus
IsBadWritePtr
ReadFile
SetFilePointer
GetFileSizeEx
CreateThread
FindClose
DeleteCriticalSection
InterlockedExchange
InitializeCriticalSection
GetSystemInfo
InterlockedCompareExchange
GetCurrentThread
GetCurrentProcess
DuplicateHandle
CreateSemaphoreA
Sleep
GetCurrentProcessId
VirtualFree
VirtualAlloc
IsBadCodePtr
IsBadReadPtr
InterlockedIncrement
ReleaseSemaphore
InterlockedExchangeAdd
InterlockedDecrement
DisableThreadLibraryCalls
OutputDebugStringA
GetTickCount
CloseHandle
GetSystemTimeAsFileTime
SleepEx
WaitForSingleObjectEx
QueueUserAPC
SetEvent
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetLastError

ntdll

NtSetTimerResolution
RtlCompareMemory

rpcrt4

UuidCreate

Exports

Exports

DebugConnect
DebugConnectWide
DebugCreate
DebugCreateEx

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGER32C
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 137KB - Virtual size: 338KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGER32R
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dbghelp.dll
.dll windows x86

adf9759800fcd48cc981a4db72368f41

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:13:36:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:49:55:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:45

Not After

10/01/2013, 20:55

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f2:25:3e:53:48:53:ec:65:69:d3:68:7f:b0:6f:e9:fc:d6:ee:e7:50:ea:5e:bf:06:91:f7:2e:d6:1c:ee:9e:6a
Signer

Actual PE Digest

f2:25:3e:53:48:53:ec:65:69:d3:68:7f:b0:6f:e9:fc:d6:ee:e7:50:ea:5e:bf:06:91:f7:2e:d6:1c:ee:9e:6a

Digest Algorithm

sha256

PE Digest Matches

true

2e:b4:5f:e6:98:13:37:36:10:4f:4d:92:85:36:3e:08:ff:aa:c3:3e
Signer

Actual PE Digest

2e:b4:5f:e6:98:13:37:36:10:4f:4d:92:85:36:3e:08:ff:aa:c3:3e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_lseeki64
_write
_isatty
__pioinfo
__badioinfo
_read
ferror
wctomb
_itoa
_snprintf
_iob
__mb_cur_max
mbtowc
_fileno
isleadbyte
_onexit
__dllonexit
_unlock
_lock
memset
memcpy
_ismbblead
_initterm
_amsg_exit
_XcptFilter
memmove
__CxxFrameHandler
_errno
iswspace
calloc
_wcsdup
towlower
tolower
_wcslwr
_wctime
time
_ltoa
_strnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
free
_strlwr
_vsnwprintf
iswprint
fprintf
fflush
atol
fclose
iswdigit
__unDName
bsearch
fread
fseek
_wfsopen
wcstoul
strchr
_wfullpath
_wgetenv
_chsize
_close
_get_osfhandle
_open_osfhandle
ftell
_mbscmp
_memicmp
wcsrchr
strstr
_wcsicmp
_wcsnicmp
qsort
iswxdigit
wcsncmp
wcsstr
wcschr
??3@YAXPAX@Z
??2@YAPAXI@Z
_wsopen
memcmp

kernel32

InitializeCriticalSectionAndSpinCount
DeviceIoControl
GetFileType
CopyFileExW
SetFileAttributesW
LCMapStringW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExA
FormatMessageW
GetModuleHandleW
FlushViewOfFile
MapViewOfFileEx
LocalFree
VirtualFree
GetVersion
RtlUnwind
InterlockedCompareExchange
InterlockedExchange
GetThreadSelectorEntry
TerminateThread
CreateThread
HeapCreate
HeapDestroy
VirtualQueryEx
GetThreadTimes
GetThreadPriority
GetPriorityClass
GetThreadContext
ResumeThread
SuspendThread
CreateFileMappingA
GetSystemInfo
LoadLibraryA
Sleep
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlCaptureContext
GetTickCount
GetCurrentThreadId
QueryPerformanceCounter
ReadProcessMemory
SetLastError
FindClose
GetLastError
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
CreateFileA
GetFileSize
ReadFile
CloseHandle
TlsGetValue
TlsSetValue
FreeLibrary
TlsAlloc
TlsFree
GetVersionExA
InitializeCriticalSection
GetProcessHeap
DeleteCriticalSection
HeapReAlloc
HeapAlloc
HeapFree
IsDBCSLeadByte
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcess
UnmapViewOfFile
CreateDirectoryA
VirtualAlloc
VirtualProtect
DuplicateHandle
MapViewOfFile
GetModuleHandleA
GetCurrentProcessId
OpenProcess
WriteFile
OutputDebugStringA
SetErrorMode
GetFileAttributesA
DelayLoadFailureHook

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
StackWalkEx
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymAddrIncludeInlineTrace
SymCleanup
SymCompareInlineTrace
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsEx
SymEnumSymbolsExW
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromInlineContext
SymFromInlineContextW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromInlineContext
SymGetLineFromInlineContextW
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymQueryInlineTrace
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
inlinedbg
itoldyouso
lmi
lminfo
omap
optdbgdump
optdbgdumpaddr
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 1010KB - Virtual size: 1010KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
setting.ini
sites.dll
.dll regsvr32 windows x86

7cdaa49aef13a3fc34a9451984d76df0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:ed:fc:66:0d:32:65:39:29:98:47:40:c3:d1:92:35:5d:bf:bf:24:22:ad:5e:cb:45:ff:9b:d4:9e:4a:ce:16
Signer

Actual PE Digest

12:ed:fc:66:0d:32:65:39:29:98:47:40:c3:d1:92:35:5d:bf:bf:24:22:ad:5e:cb:45:ff:9b:d4:9e:4a:ce:16

Digest Algorithm

sha256

PE Digest Matches

true

97:74:0e:67:b0:5b:52:e7:f8:8b:a4:98:f8:15:ed:22:60:59:07:0b
Signer

Actual PE Digest

97:74:0e:67:b0:5b:52:e7:f8:8b:a4:98:f8:15:ed:22:60:59:07:0b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdiplus

GdipSetCompositingQuality
GdipGetCompositingMode
GdipSetCompositingMode
GdipGetPathData
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreatePen1
GdipDeletePen
GdipDeleteGraphics
GdipGetImageWidth
GdipGetImageHeight
GdipCreateSolidFill
GdipCreateLineBrushFromRect
GdipCreateLineBrushFromRectI
GdipCreateFromHDC
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipDrawRectangleI
GdipGetDpiY
GdipGetDpiX
GdipGetPageUnit
GdipGetPointCount
GdipAddPathBezierI
GdipAddPathStringI
GdipSetPenLineJoin
GdipCreateBitmapFromHBITMAP
GdipDrawImagePointsI
GdipCreateRegionPath
GdipAddPathLine2
GdipAddPathLine
GdipClosePathFigures
GdipGetCompositingQuality
GdipCloneBitmapAreaI
GdipGetFontSize
GdipGetFamily
GdipCreateFontFromLogfontW
GdipMeasureString
GdipFillRectangle
GdipSetStringFormatHotkeyPrefix
GdipGetImagePixelFormat
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipDeleteFontFamily
GdipGetSolidFillColor
GdipCreateRegionRectI
GdipFillRegion
GdipCombineRegionPath
GdipDeleteRegion
GdipGetPixelOffsetMode
GdipDrawLineI
GdipAddPathLine2I
GdipSetPenColor
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawString
GdipDrawArcI
GdipAddPathPieI
GdipAddPathEllipseI
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetPenEndCap
GdipSetPenStartCap
GdipDeleteFont
GdipDeleteStringFormat
GdipCreateStringFormat
GdipSetLineWrapMode
GdipGetTextRenderingHint
GdipGetInterpolationMode
GdipSetLineBlend
GdipReleaseDC
GdipSetPageUnit
GdipSetPageScale
GdipGetPageScale
GdipResetPath
GdipGetDC
GdipDeleteCachedBitmap
GdipCreateCachedBitmap
GdipSetPathGradientFocusScales
GdipCreatePen2
GdipDrawImageRectRect
GdipDrawImageI
GdipSetImageAttributesColorMatrix
GdipRestoreGraphics
GdipSaveGraphics
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetClip
GdipSetClipPath
GdipDrawImagePointRectI
GdipFillPath
GdipGraphicsClear
GdipSetTextRenderingHint
GdipCreatePathGradientFromPath
GdipAddPathEllipse
GdipAddPathRectangleI
GdipAddPathCurveI
GdipAddPathArcI
GdipAddPathLineI
GdipClosePathFigure
GdipCreateLineBrushFromRectWithAngleI
GdipSetImageAttributesGamma
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetPathWorldBounds
GdipSetPathGradientCenterPoint
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipSetLinePresetBlend
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdiplusStartup
GdipDrawPath
GdipDeletePath
GdipCreatePath
GdipCloneImage
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipFillPolygonI
GdipCloneBrush
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipFillEllipseI
GdipFillRectangleI
GdipDrawEllipseI
GdipCreateHBITMAPFromBitmap

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmDisableIME

kernel32

CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
SetFilePointer
GetStartupInfoA
SetHandleCount
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
HeapSize
InterlockedCompareExchange
GetOEMCP
GetACP
GetModuleFileNameA
HeapDestroy
HeapCreate
HeapReAlloc
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
GetCommandLineA
GetStdHandle
GetFileType
WriteConsoleW
CreateThread
ExitThread
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
TlsFree
SetEndOfFile
SetFilePointerEx
CreateMutexW
TlsGetValue
OutputDebugStringW
TlsSetValue
HeapUnlock
HeapLock
HeapWalk
ReleaseMutex
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
IsValidCodePage
InterlockedExchange
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetModuleHandleW
lstrcmpiW
CloseHandle
CreateFileW
MulDiv
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
lstrlenA
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
LoadLibraryW
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
SetLastError
GetLongPathNameW
GetCurrentProcessId
FindNextFileW
FindClose
GetVersionExW
GetFullPathNameW
FindFirstFileW
GetCurrentDirectoryW
GlobalFree
GlobalAlloc
ReadFile
GetFileSizeEx
GetTickCount
GlobalUnlock
GlobalLock
FreeResource
LockResource
GetSystemInfo
GlobalMemoryStatusEx
QueryPerformanceFrequency
TlsAlloc
DeviceIoControl
SetThreadLocale
GetThreadLocale
GetPrivateProfileStringW
WriteFile
WaitForSingleObject
Sleep
FlushFileBuffers
LocalFree
GetFileTime
VirtualAlloc
VirtualQuery
OpenThread
VirtualProtect
HeapFree
GetProcessHeap
WideCharToMultiByte

user32

SetCapture
GetWindow
GetWindowRgn
GetParent
SetRectEmpty
OffsetRect
GetCaretPos
FindWindowW
SystemParametersInfoW
DrawIconEx
FillRect
DrawFocusRect
GetFocus
CharUpperW
ReleaseCapture
GetKeyState
SetWindowsHookExW
GetClassInfoW
GetClassNameW
UnionRect
RegisterClipboardFormatW
GetAsyncKeyState
GetIconInfo
IsIconic
RegisterWindowMessageW
SetWindowRgn
UpdateLayeredWindow
KillTimer
DestroyCursor
GetDCEx
GetSysColor
EnableScrollBar
CreateCaret
HideCaret
ShowCaret
SetCaretPos
ScrollWindowEx
CloseClipboard
GetClipboardData
OpenClipboard
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
EnableWindow
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
PrintWindow
EnumChildWindows
GetWindowTextW
SetWindowTextW
SendMessageTimeoutW
GetDesktopWindow
SendNotifyMessageW
GetCursor
wsprintfW
SetTimer
RedrawWindow
GetClientRect
MoveWindow
IsZoomed
PostMessageW
SendMessageW
UnhookWindowsHookEx
WindowFromPoint
GetCapture
IsWindowEnabled
GetWindowThreadProcessId
CallNextHookEx
SetLayeredWindowAttributes
EndPaint
BeginPaint
UpdateWindow
GetSystemMetrics
InvalidateRect
IntersectRect
EqualRect
RegisterClassExW
CreateWindowExW
SetFocus
GetClassInfoExW
IsWindowVisible
ShowWindow
ClientToScreen
GetWindowRect
SetWindowPos
DestroyWindow
GetActiveWindow
MessageBoxW
GetCursorPos
ScreenToClient
LoadCursorW
SetCursor
IsWindow
InflateRect
CopyRect
PtInRect
IsRectEmpty
DrawTextW
GetDC
CharNextW
CharLowerW
DefWindowProcW
CallWindowProcW
SetRect
LoadStringW
GetWindowLongW
FrameRect
SetWindowLongW
UnregisterClassA
ReleaseDC

gdi32

CreatePatternBrush
SetRectRgn
PatBlt
CombineRgn
EnumFontFamiliesW
CreateFontW
GetObjectA
GetClipBox
CreateRectRgnIndirect
OffsetClipRgn
SelectClipRgn
RoundRect
Polygon
GetStockObject
CreateSolidBrush
Rectangle
FrameRgn
SetWindowOrgEx
GetRgnBox
CreateRectRgn
CreateBitmap
BitBlt
SetViewportOrgEx
SetBkColor
ExtTextOutW
GetDeviceCaps
GetCurrentObject
CreateDIBSection
LineTo
MoveToEx
CreatePen
SetDIBColorTable
StretchBlt
SetStretchBltMode
SetTextColor
SetBkMode
GetObjectW
DeleteDC
SelectObject
CreateCompatibleDC
DeleteObject
CreateFontIndirectW
GetTextMetricsW
GetDIBits
SetDIBits
GetTextExtentPoint32W
GetTextColor
GetPath
EndPath
TextOutW
BeginPath
CreateCompatibleBitmap

advapi32

RegQueryValueExA
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW

shell32

ShellExecuteW

ole32

OleInitialize
RegisterDragDrop
OleDuplicateData
DoDragDrop
RevokeDragDrop
CLSIDFromString
IIDFromString
CreateStreamOnHGlobal
CoCreateInstance
ReleaseStgMedium
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

UnRegisterTypeLi
SafeArrayLock
SysFreeString
SysAllocString
SysAllocStringLen
VarUI4FromStr
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
VariantChangeType
DispCallFunc
SafeArrayGetVartype
SafeArrayCopy
SafeArrayGetUBound
SafeArrayGetLBound
VarBstrCmp
VarBstrCat
VariantCopy
RegisterTypeLi
SafeArrayDestroy
SysStringByteLen
SysAllocStringByteLen
SafeArrayCreate
SafeArrayRedim
SafeArrayUnlock

shlwapi

PathRemoveBackslashW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathCombineW
SHGetValueW
PathIsRelativeW
PathFindFileNameW
ColorHLSToRGB
ColorRGBToHLS
StrToIntW
PathRelativePathToW
StrToInt64ExW
PathIsDirectoryW
PathRemoveExtensionW
StrStrIW
StrCmpIW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

winmm

timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeGetTime

Exports

Exports

CreateMemoryFile
CreateShadowEdgeInstance
CreateXMLDOMDocument
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetFactory
GetFileDataFromStorage
GetFileLengthFromStorage
GetFileLengthFromStorageEx
GetFontCharset
GetMainThreadClub
GetPerformanceEvaluation
IsDesignerMode
SetDefaultResourceInfo
SetDesignerMode
SetFontCharset
SmartDisableIME
UninitMainThreadClub
scale
scale_font
set_dpi_flag
set_dpi_strategy

Sections

.text
Size: 910KB - Virtual size: 910KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 163KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sweeper/360FastFind.dll
.dll windows x86

5503cdd538bc794b84a83a90cbdb0561

Code Sign

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

af:03:36:15:e3:ca:ae:fc:24:43:28:3d:a6:84:c4:40:48:08:fd:1c:6e:2b:df:29:b6:9f:bc:da:cf:4c:eb:70
Signer

Actual PE Digest

af:03:36:15:e3:ca:ae:fc:24:43:28:3d:a6:84:c4:40:48:08:fd:1c:6e:2b:df:29:b6:9f:bc:da:cf:4c:eb:70

Digest Algorithm

sha256

PE Digest Matches

true

2e:d8:f3:38:ef:3a:b1:43:64:5a:a2:ba:c6:07:c2:37:d0:e9:4c:f4
Signer

Actual PE Digest

2e:d8:f3:38:ef:3a:b1:43:64:5a:a2:ba:c6:07:c2:37:d0:e9:4c:f4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeviceIoControl
DeleteCriticalSection
CloseHandle
GetCurrentProcessId
GetTickCount
CreateEventW
SetEvent
WaitForMultipleObjects
DebugBreak
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLastError
GetDiskFreeSpaceExW
DeleteFileW
CreateHardLinkW
ResetEvent
LocalFree
WriteFile
GetFileInformationByHandle
InterlockedExchangeAdd
WideCharToMultiByte
SetFilePointer
ReadFile
MultiByteToWideChar
EnterCriticalSection
GetFileSizeEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetSystemInfo
InterlockedIncrement
WaitForSingleObject
SetLastError
QueryPerformanceFrequency
QueryPerformanceCounter
GetVolumeInformationW
GetVolumeNameForVolumeMountPointW
GetDriveTypeW
QueryDosDeviceW
CreateDirectoryW
GetProcAddress
CreateFileW
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleW
FreeLibrary
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
LoadLibraryA
FlushFileBuffers
GetModuleFileNameW
GetStringTypeW
GetStringTypeA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
InterlockedDecrement
Sleep
InterlockedExchange
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
CreateMutexW
TlsGetValue
OutputDebugStringW
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
GetCurrentThreadId
ReleaseMutex
TlsAlloc
TlsFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetCommandLineA
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
HeapCreate
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
GetModuleHandleA

user32

wsprintfW
SendMessageTimeoutW

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA

shell32

CommandLineToArgvW
SHGetFolderPathW

shlwapi

PathFileExistsW
PathAppendW
PathCombineW

netapi32

NetApiBufferFree
NetUserEnum

Exports

Exports

CreateInterface

Sections

.text
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
symsrv.dll
.dll windows x86

63dcb88f1795f6d58fb17f04a2b1dbd1

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:13:36:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:49:55:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:45

Not After

10/01/2013, 20:55

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:d6:b7:24:88:a5:09:ab:9a:19:2b:52:12:a3:6e:65:69:0e:dd:62:8e:21:9e:ca:25:38:54:56:de:55:5c:8f
Signer

Actual PE Digest

ad:d6:b7:24:88:a5:09:ab:9a:19:2b:52:12:a3:6e:65:69:0e:dd:62:8e:21:9e:ca:25:38:54:56:de:55:5c:8f

Digest Algorithm

sha256

PE Digest Matches

true

13:38:35:8e:5b:59:31:e4:18:ef:cb:d8:6e:ed:f1:36:4b:59:e6:15
Signer

Actual PE Digest

13:38:35:8e:5b:59:31:e4:18:ef:cb:d8:6e:ed:f1:36:4b:59:e6:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

__badioinfo
__pioinfo
_isatty
_write
_lseeki64
ferror
wctomb
_itoa
_snprintf
_iob
__mb_cur_max
mbtowc
_fileno
isleadbyte
memset
memcpy
_initterm
malloc
free
_amsg_exit
_XcptFilter
_errno
_wtoi64
_wcslwr
strrchr
wcsstr
fclose
wcsrchr
fgetws
_wfopen
_stricmp
getenv
iswspace
tolower
isspace
towlower
??2@YAPAXI@Z
??3@YAXPAX@Z
_wcsnicmp
_wcsicmp
wcschr
memcmp

kernel32

LoadLibraryExA
GetModuleHandleA
FreeLibrary
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
RtlUnwind
OutputDebugStringA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
Sleep
GlobalFree
ReleaseMutex
LocalFileTimeToFileTime
DeleteFileA
GetFileInformationByHandle
FileTimeToLocalFileTime
SetFileTime
SetFilePointer
CreateFileA
DosDateTimeToFileTime
FileTimeToDosDateTime
DeleteCriticalSection
InitializeCriticalSection
CreateThread
GetSystemTime
GetFileTime
ReadFile
WaitForSingleObject
SetWaitableTimer
GetFileSize
LoadLibraryA
LocalFree
DebugBreak
CloseHandle
LocalAlloc
LocalReAlloc
WriteFile
GetSystemTimeAsFileTime
GetCurrentProcess
EnterCriticalSection
SetLastError
GetLastError
LeaveCriticalSection
RaiseException

advapi32

RegCloseKey
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken

Exports

Exports

EulaDlgProc
RunDllEntry
SymbolServer
SymbolServerByIndex
SymbolServerByIndexW
SymbolServerClose
SymbolServerDeltaName
SymbolServerDeltaNameW
SymbolServerGetIndexString
SymbolServerGetIndexStringW
SymbolServerGetOptions
SymbolServerGetSupplement
SymbolServerGetSupplementW
SymbolServerGetVersion
SymbolServerIsStore
SymbolServerIsStoreW
SymbolServerPing
SymbolServerPingW
SymbolServerSetOptions
SymbolServerSetOptionsW
SymbolServerStoreFile
SymbolServerStoreFileW
SymbolServerStoreSupplement
SymbolServerStoreSupplementW
SymbolServerW
httpCloseHandle
httpOpenFileHandle
httpOpenFileHandleW
httpQueryDataAvailable
httpReadFile

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
symsrv.yes

Sharing

General

Malware Config

Signatures

Files

25891920ef54bbbfe5ca4376cce425bd

Code Sign

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7eCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:deCertificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

42:d2:0e:42:e8:81:06:c1:a2:71:33:c8:cb:9f:1c:ed:4a:d1:4a:21:7a:6f:51:84:38:18:fc:6d:a7:27:01:b6Signer

d0:29:8a:9d:8a:e0:be:60:e0:4e:3a:b3:31:67:c3:61:2e:9a:54:c0Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

msimg32

version

gdiplus

psapi

wintrust

crypt32

comctl32

Sections

.text Size: 875KB - Virtual size: 875KB

.rdata Size: 228KB - Virtual size: 228KB

.data Size: 14KB - Virtual size: 29KB

.rsrc Size: 466KB - Virtual size: 465KB

.reloc Size: 49KB - Virtual size: 49KB

b4af695cd5bc3c511098fd4eeb5afde8

Code Sign

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7eCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

42:d2:0e:42:e8:81:06:c1:a2:71:33:c8:cb:9f:1c:ed:4a:d1:4a:21:7a:6f:51:84:38:18:fc:6d:a7:27:01:b6
Signer

d0:29:8a:9d:8a:e0:be:60:e0:4e:3a:b3:31:67:c3:61:2e:9a:54:c0
Signer

.text
Size: 875KB - Virtual size: 875KB

.rdata
Size: 228KB - Virtual size: 228KB

.data
Size: 14KB - Virtual size: 29KB

.rsrc
Size: 466KB - Virtual size: 465KB

.reloc
Size: 49KB - Virtual size: 49KB

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

47:2e:ea:23:8e:5f:4d:5f:e7:d5:86:b6:5a:5e:bc:75:40:90:12:a5:a5:c1:e7:df:52:51:1f:78:21:03:35:2f
Signer

68:bb:29:39:32:bb:9c:4e:2c:eb:38:0e:77:07:9e:a3:3b:00:b9:b1
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 374KB - Virtual size: 374KB

.data
Size: 24KB - Virtual size: 39KB

.pdata
Size: 77KB - Virtual size: 77KB

text
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 465KB - Virtual size: 465KB

.reloc
Size: 20KB - Virtual size: 19KB

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

43:55:12:04:1f:2a:8d:6b:73:2a:60:21:6f:dd:5b:4b:e2:14:f6:f8:22:e0:50:9d:55:5a:91:63:23:1c:f2:4f
Signer

ff:5d:66:d6:73:77:29:50:b2:d6:cf:fe:6b:93:c8:dd:ff:2f:4b:84
Signer