Overview
overview
7Static
static
3c38621fb8b...90.exe
windows7-x64
3c38621fb8b...90.exe
windows10-2004-x64
3$1.exe
windows7-x64
7$1.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...et.dll
windows7-x64
3$PLUGINSDI...et.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$TEMP/repair.exe
windows7-x64
7$TEMP/repair.exe
windows10-2004-x64
7mfc42u.dll
windows7-x64
1mfc42u.dll
windows10-2004-x64
1repair.exe
windows7-x64
7repair.exe
windows10-2004-x64
7Static task
static1
Behavioral task
behavioral1
Sample
c38621fb8bb7d1473305a37d3e44d590.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c38621fb8bb7d1473305a37d3e44d590.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$1.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$1.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Internet.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/Internet.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
$TEMP/repair.exe
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
$TEMP/repair.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
mfc42u.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
mfc42u.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
repair.exe
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
repair.exe
Resource
win10v2004-20240226-en
General
-
Target
c38621fb8bb7d1473305a37d3e44d590
-
Size
3.3MB
-
MD5
c38621fb8bb7d1473305a37d3e44d590
-
SHA1
b6958184f975aae302ce5ddab25dc8f967c55f38
-
SHA256
5dc45f81d979a91a69b61d566abbb14aa2a4642bc7f477923f8d313a34c734f4
-
SHA512
885c19dff4c0b6ec101e411d22fa3a3af775bc0ddb667f95f33b576745663b4ae4b51efa1070cec6b5393751be08dcbbce0b37f31cb3bfe1b3a946fd540d8fc6
-
SSDEEP
98304:6V+S6UHZEubGRZJgsA5zpzPzjvmtlui4sb:6UWqZ6LP/il44
Malware Config
Signatures
-
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource c38621fb8bb7d1473305a37d3e44d590 unpack001/$PLUGINSDIR/InstallOptions.dll unpack001/$PLUGINSDIR/Internet.dll unpack001/$PLUGINSDIR/StartMenu.dll unpack001/$PLUGINSDIR/System.dll unpack001/$PLUGINSDIR/UserInfo.dll -
NSIS installer 1 IoCs
resource yara_rule sample nsis_installer_1
Files
-
c38621fb8bb7d1473305a37d3e44d590.exe windows:4 windows x86 arch:x86
099c0646ea7282d232219f8807883be0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 48KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$1.exe windows:4 windows x86 arch:x86
5452a94adc21d5edb872aff57ecd6419
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01/08/1996, 00:00Not After31/12/2020, 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06/08/2003, 00:00Not After05/08/2013, 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:ddCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before22/10/2008, 00:00Not After23/11/2010, 23:59SubjectCN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathRemoveFileSpecW
PathIsRootW
PathFindFileNameW
SHGetValueW
PathFileExistsW
PathCombineW
wvnsprintfW
StrStrIW
PathIsDirectoryW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetExitCodeThread
ResumeThread
FindNextFileW
SetLastError
GetFullPathNameW
FindFirstFileW
FindClose
GetCommandLineW
lstrcpyW
FlushInstructionCache
GetCurrentProcess
FlushFileBuffers
WriteFile
ReadFile
GetFileSize
CreateFileW
FreeResource
GlobalUnlock
LockResource
SizeofResource
LoadResource
FindResourceW
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
CreateMutexW
GetLastError
DebugBreak
OutputDebugStringW
lstrlenA
GetProcAddress
GetModuleHandleW
GetVersionExW
GlobalFree
GlobalLock
GlobalAlloc
GetFileSizeEx
GetPrivateProfileIntW
GetPrivateProfileStringW
GetTickCount
CloseHandle
GetFileAttributesExW
TerminateProcess
GetSystemDirectoryW
CopyFileW
MultiByteToWideChar
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
LoadLibraryW
FreeLibrary
WideCharToMultiByte
GetVersion
MulDiv
WritePrivateProfileStringW
GetModuleFileNameW
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
TlsSetValue
TlsGetValue
TlsAlloc
GetLongPathNameW
GetSystemTime
GetFileType
QueryPerformanceCounter
ResetEvent
GetLocalTime
InterlockedExchangeAdd
CreateWaitableTimerW
SetWaitableTimer
CreateSemaphoreW
MoveFileW
SetEndOfFile
GetThreadTimes
WaitForMultipleObjects
ReleaseSemaphore
ReleaseMutex
GetCurrentThread
SetFilePointer
VirtualAlloc
VirtualFree
LocalFree
InterlockedIncrement
lstrlenW
GetTempPathW
GetCurrentProcessId
GetTempFileNameW
RemoveDirectoryW
SetErrorMode
SetUnhandledExceptionFilter
Sleep
DeleteFileW
InterlockedDecrement
FormatMessageW
HeapFree
TlsFree
SetEnvironmentVariableW
HeapAlloc
GetProcessHeap
GetEnvironmentVariableW
OpenThread
GetStartupInfoW
GetExitCodeProcess
user32
SetWindowPos
EndDialog
DefWindowProcW
DestroyWindow
SetWindowLongW
PostMessageW
MapWindowPoints
GetClientRect
SystemParametersInfoW
SendMessageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetForegroundWindow
ShowWindow
GetActiveWindow
DialogBoxParamW
LoadStringW
MessageBoxW
CallNextHookEx
UnhookWindowsHookEx
CheckDlgButton
BeginPaint
EndPaint
SetCursor
GetSysColor
GetDC
ReleaseDC
GetWindowTextW
InflateRect
GetScrollInfo
MoveWindow
GetScrollRange
GetScrollPos
SetScrollPos
SetFocus
SetScrollInfo
ShowScrollBar
GetCursorPos
ScreenToClient
DrawTextW
GetSystemMenu
EnableMenuItem
DestroyMenu
GetWindowPlacement
BringWindowToTop
LoadIconW
UpdateWindow
PostQuitMessage
IsDialogMessageW
KillTimer
SetTimer
CreateWindowExW
CallWindowProcW
InvalidateRect
RedrawWindow
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
IsWindow
IsWindowVisible
IsIconic
ExitWindowsEx
EnableWindow
OffsetRect
GetDlgItem
PtInRect
CopyRect
CharLowerW
SetDlgItemTextW
CharUpperW
CharNextW
wvsprintfW
GetSystemMetrics
LoadImageW
SetWindowTextW
GetParent
GetWindowLongW
GetWindow
SetWindowsHookExW
IsDlgButtonChecked
GetDlgItemTextW
CreateDialogParamW
GetWindowRect
gdi32
SetBkColor
BitBlt
CreateCompatibleBitmap
ExtTextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
SelectObject
SetTextColor
DeleteObject
GetDeviceCaps
CreateFontIndirectW
advapi32
RegQueryValueExW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegDeleteKeyW
RegCloseKey
shell32
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHBrowseForFolderW
Shell_NotifyIconW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
ShellExecuteExW
ShellExecuteW
ole32
CreateStreamOnHGlobal
CLSIDFromProgID
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
OleRun
oleaut32
VariantClear
SysAllocString
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
VariantInit
VariantChangeType
GetErrorInfo
SysFreeString
OleLoadPicture
comctl32
InitCommonControlsEx
msimg32
TransparentBlt
msvcp60
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Xran@std@@YAXXZ
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Xlen@std@@YAXXZ
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
??0_Lockit@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z
?nothrow@std@@3Unothrow_t@1@B
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1_Lockit@std@@QAE@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
ws2_32
htons
htonl
ntohl
WSAStartup
inet_addr
inet_ntoa
gethostbyname
gethostname
WSACleanup
WSASetLastError
WSAAsyncSelect
bind
socket
connect
WSAGetLastError
closesocket
setsockopt
send
recv
ntohs
ioctlsocket
accept
listen
shutdown
getpeername
sendto
recvfrom
WSACancelAsyncRequest
WSAAsyncGetHostByName
setupapi
SetupIterateCabinetW
wininet
HttpQueryInfoW
InternetErrorDlg
InternetOpenUrlW
InternetOpenW
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCloseHandle
msvcrt
fclose
_wcsicmp
wcsncmp
_wcsnicmp
printf
exit
malloc
wcscmp
_wtoi
iswdigit
time
srand
rand
wcsstr
memmove
realloc
free
fread
_wfopen
_ftol
wcscat
_purecall
wprintf
fwrite
__RTDynamicCast
iswspace
isdigit
_CxxThrowException
_except_handler3
_endthread
_wremove
_wstat
_CIpow
toupper
setlocale
fflush
fwprintf
_vsnprintf
fprintf
ctime
sprintf
atoi
_vsnwprintf
_endthreadex
strncpy
strtol
strchr
_wtoi64
memchr
_strnicmp
isspace
_atoi64
_callnewh
_errno
wcstok
strerror
wcschr
swscanf
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_exit
_XcptFilter
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsupr
_itoa
strncmp
swprintf
wcsrchr
wcscpy
_snwprintf
wcslen
_beginthreadex
wcsncat
wcsncpy
__CxxFrameHandler
??2@YAPAXI@Z
psapi
GetModuleFileNameExW
EnumProcessModules
iphlpapi
GetNetworkParams
GetAdaptersInfo
secur32
InitializeSecurityContextA
AcquireCredentialsHandleA
FreeCredentialsHandle
winhttp
WinHttpGetIEProxyConfigForCurrentUser
Sections
.text Size: 544KB - Virtual size: 543KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/InstallOptions.dll.dll windows:4 windows x86 arch:x86
b1cd0d78f652ce5fc63f0879371af012
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc
user32
MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect
gdi32
SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject
shell32
SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA
comdlg32
GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Exports
Exports
dialog
initDialog
show
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1012B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/Internet.dll.dll windows:4 windows x86 arch:x86
04281f88c3d826e409dc7c24629e7efc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapAlloc
GetProcessHeap
GlobalFree
user32
wsprintfA
wsock32
inet_addr
gethostname
gethostbyname
WSACleanup
WSAStartup
wininet
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
Exports
Exports
GetLocalHostIP
GetLocalHostName
GetUrlCode
Ver
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 620B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/StartMenu.dll.dll windows:4 windows x86 arch:x86
7868cd55f358bfb360f9eb8ce1512ca0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpynA
GlobalAlloc
MulDiv
GetModuleHandleA
GlobalFree
FindClose
FindNextFileA
FindFirstFileA
lstrcmpiA
lstrcatA
lstrcpyA
user32
TranslateMessage
GetMessageA
IsDialogMessageA
PostMessageA
DispatchMessageA
GetWindowLongA
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
IsDlgButtonChecked
GetWindowTextA
DestroyWindow
GetDlgItem
CreateDialogParamA
SetWindowLongA
wsprintfA
CallWindowProcA
gdi32
GetTextMetricsA
SelectObject
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32
CoTaskMemFree
Exports
Exports
Init
Select
Show
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/System.dll.dll windows:4 windows x86 arch:x86
4ec328f99bdd944fc98d8a5cf11f7a62
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Exports
Exports
Alloc
Call
Copy
Free
Get
Int64Op
Store
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/UserInfo.dll.dll windows:4 windows x86 arch:x86
6bc108eed3ca99f68adee56e9c99fac6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynA
GlobalAlloc
advapi32
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken
Exports
Exports
GetAccountType
GetName
GetOriginalAccountType
Sections
.text Size: 1024B - Virtual size: 741B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 657B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 85B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 154B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/ioSpecial.ini
-
$PLUGINSDIR/modern-header.bmp
-
$PLUGINSDIR/modern-wizard.bmp
-
$TEMP/repair.exe.exe windows:4 windows x86 arch:x86
5452a94adc21d5edb872aff57ecd6419
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01/08/1996, 00:00Not After31/12/2020, 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06/08/2003, 00:00Not After05/08/2013, 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:ddCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before22/10/2008, 00:00Not After23/11/2010, 23:59SubjectCN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathRemoveFileSpecW
PathIsRootW
PathFindFileNameW
SHGetValueW
PathFileExistsW
PathCombineW
wvnsprintfW
StrStrIW
PathIsDirectoryW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetExitCodeThread
ResumeThread
FindNextFileW
SetLastError
GetFullPathNameW
FindFirstFileW
FindClose
GetCommandLineW
lstrcpyW
FlushInstructionCache
GetCurrentProcess
FlushFileBuffers
WriteFile
ReadFile
GetFileSize
CreateFileW
FreeResource
GlobalUnlock
LockResource
SizeofResource
LoadResource
FindResourceW
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
CreateMutexW
GetLastError
DebugBreak
OutputDebugStringW
lstrlenA
GetProcAddress
GetModuleHandleW
GetVersionExW
GlobalFree
GlobalLock
GlobalAlloc
GetFileSizeEx
GetPrivateProfileIntW
GetPrivateProfileStringW
GetTickCount
CloseHandle
GetFileAttributesExW
TerminateProcess
GetSystemDirectoryW
CopyFileW
MultiByteToWideChar
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
LoadLibraryW
FreeLibrary
WideCharToMultiByte
GetVersion
MulDiv
WritePrivateProfileStringW
GetModuleFileNameW
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
TlsSetValue
TlsGetValue
TlsAlloc
GetLongPathNameW
GetSystemTime
GetFileType
QueryPerformanceCounter
ResetEvent
GetLocalTime
InterlockedExchangeAdd
CreateWaitableTimerW
SetWaitableTimer
CreateSemaphoreW
MoveFileW
SetEndOfFile
GetThreadTimes
WaitForMultipleObjects
ReleaseSemaphore
ReleaseMutex
GetCurrentThread
SetFilePointer
VirtualAlloc
VirtualFree
LocalFree
InterlockedIncrement
lstrlenW
GetTempPathW
GetCurrentProcessId
GetTempFileNameW
RemoveDirectoryW
SetErrorMode
SetUnhandledExceptionFilter
Sleep
DeleteFileW
InterlockedDecrement
FormatMessageW
HeapFree
TlsFree
SetEnvironmentVariableW
HeapAlloc
GetProcessHeap
GetEnvironmentVariableW
OpenThread
GetStartupInfoW
GetExitCodeProcess
user32
SetWindowPos
EndDialog
DefWindowProcW
DestroyWindow
SetWindowLongW
PostMessageW
MapWindowPoints
GetClientRect
SystemParametersInfoW
SendMessageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetForegroundWindow
ShowWindow
GetActiveWindow
DialogBoxParamW
LoadStringW
MessageBoxW
CallNextHookEx
UnhookWindowsHookEx
CheckDlgButton
BeginPaint
EndPaint
SetCursor
GetSysColor
GetDC
ReleaseDC
GetWindowTextW
InflateRect
GetScrollInfo
MoveWindow
GetScrollRange
GetScrollPos
SetScrollPos
SetFocus
SetScrollInfo
ShowScrollBar
GetCursorPos
ScreenToClient
DrawTextW
GetSystemMenu
EnableMenuItem
DestroyMenu
GetWindowPlacement
BringWindowToTop
LoadIconW
UpdateWindow
PostQuitMessage
IsDialogMessageW
KillTimer
SetTimer
CreateWindowExW
CallWindowProcW
InvalidateRect
RedrawWindow
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
IsWindow
IsWindowVisible
IsIconic
ExitWindowsEx
EnableWindow
OffsetRect
GetDlgItem
PtInRect
CopyRect
CharLowerW
SetDlgItemTextW
CharUpperW
CharNextW
wvsprintfW
GetSystemMetrics
LoadImageW
SetWindowTextW
GetParent
GetWindowLongW
GetWindow
SetWindowsHookExW
IsDlgButtonChecked
GetDlgItemTextW
CreateDialogParamW
GetWindowRect
gdi32
SetBkColor
BitBlt
CreateCompatibleBitmap
ExtTextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
SelectObject
SetTextColor
DeleteObject
GetDeviceCaps
CreateFontIndirectW
advapi32
RegQueryValueExW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegDeleteKeyW
RegCloseKey
shell32
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHBrowseForFolderW
Shell_NotifyIconW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
ShellExecuteExW
ShellExecuteW
ole32
CreateStreamOnHGlobal
CLSIDFromProgID
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
OleRun
oleaut32
VariantClear
SysAllocString
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
VariantInit
VariantChangeType
GetErrorInfo
SysFreeString
OleLoadPicture
comctl32
InitCommonControlsEx
msimg32
TransparentBlt
msvcp60
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Xran@std@@YAXXZ
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Xlen@std@@YAXXZ
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
??0_Lockit@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z
?nothrow@std@@3Unothrow_t@1@B
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1_Lockit@std@@QAE@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
ws2_32
htons
htonl
ntohl
WSAStartup
inet_addr
inet_ntoa
gethostbyname
gethostname
WSACleanup
WSASetLastError
WSAAsyncSelect
bind
socket
connect
WSAGetLastError
closesocket
setsockopt
send
recv
ntohs
ioctlsocket
accept
listen
shutdown
getpeername
sendto
recvfrom
WSACancelAsyncRequest
WSAAsyncGetHostByName
setupapi
SetupIterateCabinetW
wininet
HttpQueryInfoW
InternetErrorDlg
InternetOpenUrlW
InternetOpenW
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCloseHandle
msvcrt
fclose
_wcsicmp
wcsncmp
_wcsnicmp
printf
exit
malloc
wcscmp
_wtoi
iswdigit
time
srand
rand
wcsstr
memmove
realloc
free
fread
_wfopen
_ftol
wcscat
_purecall
wprintf
fwrite
__RTDynamicCast
iswspace
isdigit
_CxxThrowException
_except_handler3
_endthread
_wremove
_wstat
_CIpow
toupper
setlocale
fflush
fwprintf
_vsnprintf
fprintf
ctime
sprintf
atoi
_vsnwprintf
_endthreadex
strncpy
strtol
strchr
_wtoi64
memchr
_strnicmp
isspace
_atoi64
_callnewh
_errno
wcstok
strerror
wcschr
swscanf
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_exit
_XcptFilter
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsupr
_itoa
strncmp
swprintf
wcsrchr
wcscpy
_snwprintf
wcslen
_beginthreadex
wcsncat
wcsncpy
__CxxFrameHandler
??2@YAPAXI@Z
psapi
GetModuleFileNameExW
EnumProcessModules
iphlpapi
GetNetworkParams
GetAdaptersInfo
secur32
InitializeSecurityContextA
AcquireCredentialsHandleA
FreeCredentialsHandle
winhttp
WinHttpGetIEProxyConfigForCurrentUser
Sections
.text Size: 544KB - Virtual size: 543KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
mfc42u.dll.dll regsvr32 windows:4 windows x86 arch:x86
65f3cdf30468a1b024ce7f377d2f1556
Code Sign
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before04/12/2003, 00:00Not After03/12/2008, 23:59SubjectCN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before04/04/2006, 17:44Not After26/04/2012, 07:00SubjectCN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
61:46:9e:cb:00:04:00:00:00:65Certificate
IssuerCN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before04/04/2006, 19:43Not After04/10/2007, 19:53SubjectCN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
72:d1:19:4d:bd:ca:1c:99:5e:7e:6e:9b:5c:78:6c:42:5b:38:5b:b9Signer
Actual PE Digest72:d1:19:4d:bd:ca:1c:99:5e:7e:6e:9b:5c:78:6c:42:5b:38:5b:b9Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
MFC42U.pdb
Imports
msvcrt
memmove
malloc
free
abort
memset
_get_osfhandle
__doserrno
_fdopen
_open_osfhandle
fclose
clearerr
fread
fwrite
fputws
fgetws
ftell
fseek
fflush
realloc
wcscmp
wcschr
wcspbrk
_wcsupr
_wcslwr
_wcsrev
wcsrchr
wcsstr
wcsspn
wcscspn
vswprintf
swprintf
wcslen
wcsncmp
iswdigit
_wtoi
iswspace
mktime
gmtime
localtime
wcsftime
time
_purecall
_msize
calloc
memcmp
abs
wcstoul
wcstol
wcstod
_expand
_wcsdup
_endthreadex
_beginthreadex
__p___wargv
__p___argc
_wtol
_wfullpath
_wsplitpath
floor
fabs
ceil
modf
_itow
labs
_ultow
_ltow
wcscpy
wcsncpy
_wcsnicmp
??1type_info@@UAE@XZ
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_initterm
_adjust_fdiv
strcmp
strcpy
memcpy
_CxxThrowException
__CxxFrameHandler
kernel32
CreateFileW
GlobalSize
GlobalLock
GlobalAlloc
GlobalReAlloc
GlobalUnlock
GlobalFree
GetFileAttributesW
GetFileSize
GetFullPathNameW
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFileAttributesW
InterlockedDecrement
WideCharToMultiByte
MultiByteToWideChar
InterlockedIncrement
LocalFree
FormatMessageW
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalAlloc
LeaveCriticalSection
GlobalHandle
EnterCriticalSection
TlsGetValue
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
WaitForSingleObject
CreateSemaphoreW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
CreateEventW
WaitForMultipleObjects
GetVersionExA
GetModuleHandleW
lstrcatW
FreeLibrary
LoadLibraryA
GlobalDeleteAtom
GlobalFindAtomW
GetVersion
GlobalAddAtomW
GetCurrentThreadId
FreeResource
LockResource
LoadResource
FindResourceW
GlobalGetAtomNameW
GetModuleHandleA
MulDiv
GetProfileIntW
VirtualProtect
lstrcpyA
FindResourceExW
SizeofResource
GetProcessVersion
lstrcmpW
GlobalFlags
GetTempFileNameW
GetDiskFreeSpaceW
LocalUnlock
LocalLock
SearchPathW
GetTempPathW
SetThreadPriority
ResumeThread
SetEvent
SuspendThread
lstrcmpiA
GetCurrentThread
SetErrorMode
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetCurrentDirectoryW
FindNextFileW
GetTickCount
CopyFileW
GetUserDefaultLCID
IsDBCSLeadByte
lstrcatA
GetSystemDirectoryA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVolumeInformationW
FindFirstFileW
FindClose
lstrcpyW
LoadLibraryW
GetProcAddress
WriteFile
GetCurrentProcess
DuplicateHandle
GetModuleFileNameW
GetShortPathNameW
lstrcmpiW
GetThreadLocale
GetStringTypeExW
DeleteFileW
MoveFileW
SetEndOfFile
UnlockFile
LockFile
CloseHandle
FlushFileBuffers
SetFilePointer
ReadFile
lstrlenA
lstrcmpA
OutputDebugStringW
lstrlenW
IsBadReadPtr
IsBadWritePtr
IsBadStringPtrA
IsBadStringPtrW
GetLastError
SetLastError
lstrcpynW
RaiseException
OutputDebugStringA
InterlockedExchange
GetFileTime
gdi32
TextOutW
MoveToEx
GetWindowExtEx
EnumFontFamiliesW
GetPixel
GetPaletteEntries
RealizePalette
CreatePalette
OffsetRgn
SetBrushOrgEx
CreateMetaFileW
CopyMetaFileW
LPtoDP
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
DPtoLP
GetMapMode
CombineRgn
SetRectRgn
CreateHatchBrush
ExtCreatePen
CreateDIBPatternBrushPt
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
OffsetWindowOrgEx
SelectPalette
StartDocW
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
LineTo
OffsetClipRgn
ExcludeClipRect
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
EnumFontFamiliesExW
CreateDCW
CreateRectRgnIndirect
UnrealizeObject
CreateBitmap
CreatePatternBrush
CreatePen
PatBlt
Rectangle
GetViewportExtEx
DeleteMetaFile
CloseMetaFile
ScaleWindowExtEx
ScaleViewportExtEx
IntersectClipRect
GetDeviceCaps
SetMapMode
SetWindowExtEx
SetViewportExtEx
OffsetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
GetWindowOrgEx
SetWindowOrgEx
GetTextExtentPoint32A
GetTextFaceW
GetTextAlign
RectVisible
PtVisible
GetTextColor
GetStretchBltMode
GetROP2
GetPolyFillMode
GetBkMode
GetBkColor
Escape
GetNearestColor
SaveDC
RestoreDC
GetStockObject
CreateFontW
GetCharWidthW
DeleteObject
CreateCompatibleBitmap
StretchDIBits
DeleteDC
CreateFontIndirectW
GetTextMetricsW
GetTextExtentPoint32W
ExtTextOutW
BitBlt
SelectObject
CreateCompatibleDC
CreateSolidBrush
GetObjectW
SetBkColor
SetTextColor
GetClipBox
GetCurrentPositionEx
user32
EndDeferWindowPos
MessageBoxA
LoadStringW
FrameRect
InvalidateRgn
EnumChildWindows
DrawEdge
ClipCursor
GetNextDlgGroupItem
CharNextW
SetWindowContextHelpId
CountClipboardFormats
WindowFromDC
CreateMenu
PostThreadMessageW
InSendMessage
CopyAcceleratorTableW
RegisterClipboardFormatW
InsertMenuW
GetMenuStringW
ShowOwnedPopups
UnregisterClassW
PostQuitMessage
ValidateRect
RemoveMenu
GetTabbedTextExtentW
MessageBeep
IsClipboardFormatAvailable
FindWindowW
SystemParametersInfoW
SetCursorPos
DestroyCursor
DestroyIcon
SetMenuItemBitmaps
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
MoveWindow
IsDialogMessageW
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetWindowTextW
GetClassNameW
GetSysColorBrush
EndPaint
BeginPaint
TabbedTextOutW
GetDialogBaseUnits
MapDialogRect
GetAsyncKeyState
wvsprintfW
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
DrawFocusRect
UnionRect
GrayStringW
DrawTextW
GetTabbedTextExtentA
LockWindowUpdate
GetDCEx
SetParent
GetSystemMenu
AppendMenuW
DeleteMenu
IsRectEmpty
IsZoomed
GetDC
KillTimer
wsprintfW
GetSystemMetrics
CharUpperW
UnhookWindowsHookEx
MsgWaitForMultipleObjects
GetWindow
CopyRect
GetWindowRect
GetWindowPlacement
IsIconic
SystemParametersInfoA
IntersectRect
OffsetRect
SetWindowPos
SetWindowLongW
GetWindowLongW
CallWindowProcW
DefWindowProcW
SendMessageW
GetDlgCtrlID
GetWindowTextW
GetWindowTextLengthW
GetDlgItem
SetWindowPlacement
RegisterClassW
GetClassInfoW
GetMenuItemCount
GetMenuItemID
GetSubMenu
PostMessageW
GetMenu
GetClientRect
GetParent
UpdateWindow
MessageBoxW
IsWindowVisible
SetActiveWindow
SetScrollInfo
GetScrollInfo
ShowScrollBar
ScrollWindow
GetLastActivePopup
DeferWindowPos
EqualRect
ScreenToClient
SetForegroundWindow
AdjustWindowRectEx
GetForegroundWindow
GetSysColor
MapWindowPoints
EnableWindow
PeekMessageW
LoadIconW
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
DestroyWindow
GetKeyState
TrackPopupMenu
IsChild
GetTopWindow
SetTimer
BeginDeferWindowPos
SetFocus
IsWindow
GetFocus
GetMessagePos
GetMessageTime
RemovePropW
GetPropW
DispatchMessageW
SetPropW
CallNextHookEx
SetWindowsHookExW
CreateWindowExW
SendDlgItemMessageA
SendDlgItemMessageW
WinHelpW
GetCapture
RegisterWindowMessageW
LoadAcceleratorsW
TranslateAcceleratorW
IsWindowEnabled
GetDesktopWindow
ShowWindow
SetMenu
BringWindowToTop
SetRectEmpty
InvalidateRect
ReleaseCapture
SetCursor
DestroyMenu
LoadMenuW
ReuseDDElParam
UnpackDDElParam
GetActiveWindow
LoadCursorW
ClientToScreen
GetWindowThreadProcessId
SetCapture
WindowFromPoint
GetCursorPos
TranslateMessage
GetMessageW
WaitMessage
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
RedrawWindow
InflateRect
PtInRect
FillRect
InvertRect
GetWindowDC
ReleaseDC
LoadBitmapW
SetRect
Exports
Exports
?classCCachedDataPathProperty@CCachedDataPathProperty@@2UCRuntimeClass@@B
?classCDataPathProperty@CDataPathProperty@@2UCRuntimeClass@@B
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 604KB - Virtual size: 602KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 204KB - Virtual size: 201KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
repair.exe.exe windows:4 windows x86 arch:x86
5452a94adc21d5edb872aff57ecd6419
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01/08/1996, 00:00Not After31/12/2020, 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06/08/2003, 00:00Not After05/08/2013, 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:ddCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before22/10/2008, 00:00Not After23/11/2010, 23:59SubjectCN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathRemoveFileSpecW
PathIsRootW
PathFindFileNameW
SHGetValueW
PathFileExistsW
PathCombineW
wvnsprintfW
StrStrIW
PathIsDirectoryW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetExitCodeThread
ResumeThread
FindNextFileW
SetLastError
GetFullPathNameW
FindFirstFileW
FindClose
GetCommandLineW
lstrcpyW
FlushInstructionCache
GetCurrentProcess
FlushFileBuffers
WriteFile
ReadFile
GetFileSize
CreateFileW
FreeResource
GlobalUnlock
LockResource
SizeofResource
LoadResource
FindResourceW
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
CreateMutexW
GetLastError
DebugBreak
OutputDebugStringW
lstrlenA
GetProcAddress
GetModuleHandleW
GetVersionExW
GlobalFree
GlobalLock
GlobalAlloc
GetFileSizeEx
GetPrivateProfileIntW
GetPrivateProfileStringW
GetTickCount
CloseHandle
GetFileAttributesExW
TerminateProcess
GetSystemDirectoryW
CopyFileW
MultiByteToWideChar
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
LoadLibraryW
FreeLibrary
WideCharToMultiByte
GetVersion
MulDiv
WritePrivateProfileStringW
GetModuleFileNameW
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
TlsSetValue
TlsGetValue
TlsAlloc
GetLongPathNameW
GetSystemTime
GetFileType
QueryPerformanceCounter
ResetEvent
GetLocalTime
InterlockedExchangeAdd
CreateWaitableTimerW
SetWaitableTimer
CreateSemaphoreW
MoveFileW
SetEndOfFile
GetThreadTimes
WaitForMultipleObjects
ReleaseSemaphore
ReleaseMutex
GetCurrentThread
SetFilePointer
VirtualAlloc
VirtualFree
LocalFree
InterlockedIncrement
lstrlenW
GetTempPathW
GetCurrentProcessId
GetTempFileNameW
RemoveDirectoryW
SetErrorMode
SetUnhandledExceptionFilter
Sleep
DeleteFileW
InterlockedDecrement
FormatMessageW
HeapFree
TlsFree
SetEnvironmentVariableW
HeapAlloc
GetProcessHeap
GetEnvironmentVariableW
OpenThread
GetStartupInfoW
GetExitCodeProcess
user32
SetWindowPos
EndDialog
DefWindowProcW
DestroyWindow
SetWindowLongW
PostMessageW
MapWindowPoints
GetClientRect
SystemParametersInfoW
SendMessageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetForegroundWindow
ShowWindow
GetActiveWindow
DialogBoxParamW
LoadStringW
MessageBoxW
CallNextHookEx
UnhookWindowsHookEx
CheckDlgButton
BeginPaint
EndPaint
SetCursor
GetSysColor
GetDC
ReleaseDC
GetWindowTextW
InflateRect
GetScrollInfo
MoveWindow
GetScrollRange
GetScrollPos
SetScrollPos
SetFocus
SetScrollInfo
ShowScrollBar
GetCursorPos
ScreenToClient
DrawTextW
GetSystemMenu
EnableMenuItem
DestroyMenu
GetWindowPlacement
BringWindowToTop
LoadIconW
UpdateWindow
PostQuitMessage
IsDialogMessageW
KillTimer
SetTimer
CreateWindowExW
CallWindowProcW
InvalidateRect
RedrawWindow
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
IsWindow
IsWindowVisible
IsIconic
ExitWindowsEx
EnableWindow
OffsetRect
GetDlgItem
PtInRect
CopyRect
CharLowerW
SetDlgItemTextW
CharUpperW
CharNextW
wvsprintfW
GetSystemMetrics
LoadImageW
SetWindowTextW
GetParent
GetWindowLongW
GetWindow
SetWindowsHookExW
IsDlgButtonChecked
GetDlgItemTextW
CreateDialogParamW
GetWindowRect
gdi32
SetBkColor
BitBlt
CreateCompatibleBitmap
ExtTextOutW
CreateCompatibleDC
DeleteDC
SetBkMode
SelectObject
SetTextColor
DeleteObject
GetDeviceCaps
CreateFontIndirectW
advapi32
RegQueryValueExW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegDeleteKeyW
RegCloseKey
shell32
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHBrowseForFolderW
Shell_NotifyIconW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
ShellExecuteExW
ShellExecuteW
ole32
CreateStreamOnHGlobal
CLSIDFromProgID
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
OleRun
oleaut32
VariantClear
SysAllocString
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
VariantInit
VariantChangeType
GetErrorInfo
SysFreeString
OleLoadPicture
comctl32
InitCommonControlsEx
msimg32
TransparentBlt
msvcp60
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Xran@std@@YAXXZ
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Xlen@std@@YAXXZ
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
??0_Lockit@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z
?nothrow@std@@3Unothrow_t@1@B
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1_Lockit@std@@QAE@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
ws2_32
htons
htonl
ntohl
WSAStartup
inet_addr
inet_ntoa
gethostbyname
gethostname
WSACleanup
WSASetLastError
WSAAsyncSelect
bind
socket
connect
WSAGetLastError
closesocket
setsockopt
send
recv
ntohs
ioctlsocket
accept
listen
shutdown
getpeername
sendto
recvfrom
WSACancelAsyncRequest
WSAAsyncGetHostByName
setupapi
SetupIterateCabinetW
wininet
HttpQueryInfoW
InternetErrorDlg
InternetOpenUrlW
InternetOpenW
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCloseHandle
msvcrt
fclose
_wcsicmp
wcsncmp
_wcsnicmp
printf
exit
malloc
wcscmp
_wtoi
iswdigit
time
srand
rand
wcsstr
memmove
realloc
free
fread
_wfopen
_ftol
wcscat
_purecall
wprintf
fwrite
__RTDynamicCast
iswspace
isdigit
_CxxThrowException
_except_handler3
_endthread
_wremove
_wstat
_CIpow
toupper
setlocale
fflush
fwprintf
_vsnprintf
fprintf
ctime
sprintf
atoi
_vsnwprintf
_endthreadex
strncpy
strtol
strchr
_wtoi64
memchr
_strnicmp
isspace
_atoi64
_callnewh
_errno
wcstok
strerror
wcschr
swscanf
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_exit
_XcptFilter
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsupr
_itoa
strncmp
swprintf
wcsrchr
wcscpy
_snwprintf
wcslen
_beginthreadex
wcsncat
wcsncpy
__CxxFrameHandler
??2@YAPAXI@Z
psapi
GetModuleFileNameExW
EnumProcessModules
iphlpapi
GetNetworkParams
GetAdaptersInfo
secur32
InitializeSecurityContextA
AcquireCredentialsHandleA
FreeCredentialsHandle
winhttp
WinHttpGetIEProxyConfigForCurrentUser
Sections
.text Size: 544KB - Virtual size: 543KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ