bd0ecf36f7d24bbbb772fea073093fa7_JaffaCakes118

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/NSISPlugin.dll
unpack001/$PLUGINSDIR/NSISPlugin_JApply.dll
unpack001/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsDialogs.dll
unpack002/$PLUGINSDIR/nsProcess.dll
unpack002/$PLUGINSDIR/nsUnzip.dll
unpack003/Tenio/June.dll
unpack003/Tenio/TenFact.dll
unpack003/Tenio/TenTPF.dll
unpack003/Tenio/VFS.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/TCLSCOPY/TenProtect/TP/TPHelper.Installer.exe	nsis_installer_1
static1/unpack001/TCLSCOPY/TenProtect/TP/TPHelper.Installer.exe	nsis_installer_2

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 78ca941981136f8de181216770bc32154be849c0d172314744f96c0ce8df9ed1
MD5 bd0ecf36f7d24bbbb772fea073093fa7
SHA1 6cf9922e01bea949a542369b912da6547a87f1f8
SHA512 5ef2cded0f6b032d2a2807e1567b20d0683b8d01f5acecac8c94fc95165b3b850d234d9d7d5235f5d92fda655fb028e24102adadd2d6aa674f871ec9b2f1ac04
SSDEEP 393216:DgSoLYCSMS2VO14A74NOivZ6+fgbEUinQDkgSd:kSoLozMO1jqAjiISd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

09:29:f7:de:f5:fb:3c:29:1b:f1:0b:32:40:c9:5b:d1:0f:e8:1f:1d:8a:63:54:3c:d0:7f:19:39:05:e0:ad:6b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jul 12, 2017

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

f2:9c:c4:d5:98:c4:ba:34:2c:8a:6d:48:0d:17:88:88:cb:30:57:8c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jul 12, 2017

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 4, 2016 - Mar 28, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2016 - Mar 28, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

0

Major OS version

5

Entry point

14467

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/InstallOptions.dll

IMPHASH cd90e33ffbc335413a25300c682c83df
SHA256 f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277
MD5 89351a0a6a89519c86c5531e20dab9ea
SHA1 9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00
SHA512 13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08
SSDEEP 384:/MnT0MKT/Xwr2izZQ86mpAT8F9lN8Ov0J:EQMKzwTFnVX8i0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

7399

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW GetModuleHandleW GlobalLock GlobalUnlock GetCurrentDirectoryW SetCurrentDirectoryW GetPrivateProfileIntW GetPrivateProfileStringW lstrcatW WritePrivateProfileStringW lstrcpynW lstrlenW lstrcpyW GlobalFree GlobalAlloc

user32

OpenClipboard DestroyIcon LoadCursorW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW ShowWindow SetWindowLongW GetClientRect SetWindowRgn LoadIconW LoadImageW CreateWindowExW MapDialogRect GetClipboardData GetWindowRect CreateDialogParamW EnableMenuItem GetSystemMenu EnableWindow GetDlgItem SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW wsprintfW CharNextW MessageBoxW CloseClipboard GetDlgCtrlID MapWindowPoints SetWindowPos PtInRect GetWindowTextW SetWindowTextW SendMessageW DestroyWindow

gdi32

SelectObject CreateRectRgn GetObjectW CombineRgn DeleteObject CreateCompatibleDC GetDIBits SetTextColor

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW CommDlgExtendedError GetSaveFileNameW

ole32

CoTaskMemFree

$PLUGINSDIR/NSISPlugin.dll

IMPHASH 113bfc7886d2a6fb29af8c5aceec28e5
SHA256 f2b73ba3ca42dd9097727f6e0aabfa63b566c2d78be0d41791d72c6d16240d78
MD5 362eddf4162293770bcff8fa9bfabb7f
SHA1 aa80ab76aac054e6c3ebb2487ce396f92e97dc21
SHA512 cbf4ba93afb6a9d6ac0a6a1cfef473d163b59e7737bb644e358ec6107a4730bd0cadfba6b8baeb2a597a8af90d5c861f6441b3d4f78873a06a82872af14a2e36
SSDEEP 24576:Ix8E92oL6HJRtUj9xcSI338TzMQyK/O0:8H28BPYcTAQyKX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

636383

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FindNextFileW FindFirstFileW MoveFileW lstrlenA MultiByteToWideChar LeaveCriticalSection EnterCriticalSection MoveFileExW SetFileAttributesW GetModuleFileNameW FreeLibrary GetProcAddress LoadLibraryW DeleteFileA WritePrivateProfileStringW GetVolumeInformationW GetVersionExW GetCurrentProcessId SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime CreateDirectoryW SetFileTime GlobalUnlock GlobalLock GlobalAlloc GlobalSize LockResource FindClose SizeofResource SetFileAttributesA CopyFileA FindFirstFileA FindNextFileA CreateFileA CreateEventA GetFullPathNameA CreateThread ResetEvent SetEvent TerminateThread DeleteCriticalSection InitializeCriticalSection OutputDebugStringA VirtualAlloc VirtualFree GlobalFree lstrcpyW lstrcpynW SleepEx GetTickCount GetSystemTimeAsFileTime LoadLibraryA SetEndOfFile Process32Next Process32First GetSystemInfo CreateProcessW GetDiskFreeSpaceExW GetPrivateProfileIntW GetPrivateProfileStringW GetFileAttributesW DeleteFileW WideCharToMultiByte lstrlenW TerminateProcess WaitForSingleObject GetLogicalDriveStringsW QueryDosDeviceW OutputDebugStringW CreateToolhelp32Snapshot Process32FirstW OpenProcess Process32NextW OpenFileMappingW MapViewOfFile UnmapViewOfFile GetLastError CreateFileW CloseHandle WriteFile SetFilePointer GetFileSize LoadResource ReadFile GetVersionExA GetLocalTime Module32First LockFile LockFileEx UnlockFile UnlockFileEx FlushFileBuffers CreateDirectoryA GenerateConsoleCtrlEvent ExitProcess GetFileAttributesA

user32

CharUpperW SendMessageW FindWindowW KillTimer SetTimer GetDlgItem FindWindowExW ShowWindow BringWindowToTop CreateWindowExW RegisterClassW LoadCursorW UnregisterClassW DestroyWindow IsWindow DefWindowProcW GetUpdateRect wsprintfW GetDC GetWindowInfo EnableMenuItem GetSystemMenu CallWindowProcW ReleaseDC GetIconInfo DrawTextW LoadIconW

gdi32

CombineRgn CreateFontIndirectW SetTextColor SetBkMode StretchDIBits RectVisible CreateBitmap SetBkColor StretchBlt GetClipBox CreateRectRgnIndirect ExtSelectClipRgn SetStretchBltMode SetDIBitsToDevice DeleteObject GetObjectW RealizePalette GetDIBits CreateDIBSection DeleteDC CreateDIBitmap CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt GetStockObject CreateRectRgn

psapi

GetProcessImageFileNameW GetModuleFileNameExW

msvcrt

_CxxThrowException swprintf _CIpow div _CIacos _CIfmod longjmp _setjmp3 __CxxLongjmpUnwind printf isprint strncmp abort sprintf gmtime strtod sscanf getenv _mbsnbicmp _mbsnbcpy _mbsnbcat _mbslwr floor memmove _mbsicmp _mbsnbcmp remove _rmdir _access _mbsrchr _mkdir _mbschr _assert vsprintf _msize rand srand _snprintf _except_handler3 ?terminate@@YAXXZ __dllonexit _onexit _initterm _adjust_fdiv ??1type_info@@UAE@XZ realloc strlen strcmp calloc toupper strcat malloc free fgetc fwscanf _wcsupr wcscmp wcstok wcsstr time localtime fseek strncpy wcscat memcmp _itow _wtol strcpy wcsrchr _wcsicmp wcscpy _snwprintf _ftol _wcsnicmp _wtoi wcschr fputc fflush fwrite fread fopen __CxxFrameHandler _purecall _vsnwprintf _wcslwr wcsncat wcslen wcsncpy ??3@YAXPAX@Z _wfopen fclose _waccess ftell _vsnprintf fprintf atoi strspn __mb_cur_max _isctype _pctype tolower _iob fwprintf putc getc exit memcpy ??2@YAPAXI@Z memset strchr memchr strstr _errno asctime _lseeki64 _pipe _popen _pclose _get_osfhandle _fullpath strrchr signal fscanf _getcwd _chdir _stat _fstat strtol atof mbstowcs setlocale wcstombs mktime vfprintf _utime _close _open _strdup _stricmp wcsftime _strnicmp

mfc42u

ord6066 ord6130 ord4125 ord2859 ord668 ord4053 ord2773 ord2762 ord356 ord640 ord1633 ord323 ord6132

msvcp60

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z ??0_Lockit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Xran@std@@YAXXZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Xlen@std@@YAXXZ ?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

ws2_32

inet_addr select ntohs __WSAFDIsSet ntohl inet_ntoa htons gethostbyname WSAStartup WSACleanup socket setsockopt ioctlsocket listen bind WSAGetLastError connect accept closesocket send recv getsockopt htonl

shlwapi

PathFileExistsW StrTrimW

wininet

InternetOpenW InternetOpenUrlW InternetCloseHandle

ole32

CoInitialize CoCreateInstance CoUninitialize

winmm

timeKillEvent timeBeginPeriod timeGetDevCaps timeSetEvent

??0CxExifInfo@CxImageJPG@@QAE@PAUtag_ExifInfo@1@@Z ??0CxFile@@QAE@ABV0@@Z ??0CxFile@@QAE@XZ ??0CxIOFile@@QAE@ABV0@@Z ??0CxIOFile@@QAE@PAU_iobuf@@@Z ??0CxImage@@QAE@ABV0@_N11@Z ??0CxImage@@QAE@K@Z ??0CxImage@@QAE@KKKK@Z ??0CxImage@@QAE@PAEKK@Z ??0CxImage@@QAE@PAU_iobuf@@K@Z ??0CxImage@@QAE@PAVCxFile@@K@Z ??0CxImage@@QAE@PBGK@Z ??0CxImageGIF@@QAE@ABV0@@Z ??0CxImageGIF@@QAE@XZ ??0CxImageJPG@@QAE@ABV0@@Z ??0CxImageJPG@@QAE@XZ ??0CxMemFile@@QAE@ABV0@@Z ??0CxMemFile@@QAE@PAEK@Z ??0CxPoint2@@QAE@ABV0@@Z ??0CxPoint2@@QAE@MM@Z ??0CxPoint2@@QAE@XZ ??0CxRect2@@QAE@ABV0@@Z ??0CxRect2@@QAE@MMMM@Z ??0CxRect2@@QAE@XZ ??1CxExifInfo@CxImageJPG@@QAE@XZ ??1CxFile@@UAE@XZ ??1CxIOFile@@UAE@XZ ??1CxImage@@UAE@XZ ??1CxImageGIF@@UAE@XZ ??1CxImageJPG@@UAE@XZ ??1CxMemFile@@UAE@XZ ??4CxExifInfo@CxImageJPG@@QAEAAV01@ABV01@@Z ??4CxFile@@QAEAAV0@ABV0@@Z ??4CxIOFile@@QAEAAV0@ABV0@@Z ??4CxImage@@QAEAAV0@ABV0@@Z ??4CxImageGIF@@QAEAAV0@ABV0@@Z ??4CxImageJPG@@QAEAAV0@ABV0@@Z ??4CxMemFile@@QAEAAV0@ABV0@@Z ??4CxPoint2@@QAEAAV0@ABV0@@Z ??4CxRect2@@QAEAAV0@ABV0@@Z ??_7CxFile@@6B@ ??_7CxIOFile@@6B@ ??_7CxImage@@6B@ ??_7CxImageGIF@@6B@ ??_7CxImageJPG@@6B@ ??_7CxMemFile@@6B@ ??_FCxExifInfo@CxImageJPG@@QAEXXZ ??_FCxIOFile@@QAEXXZ ??_FCxImage@@QAEXXZ ??_FCxMemFile@@QAEXXZ ??_OCxImage@@QAEXABV0@@Z ?AddAveragingCont@CxImage@@IAEXABUtagRGBQUAD@@MAAM111@Z ?Alloc@CxMemFile@@IAEXK@Z ?AlphaClear@CxImage@@QAEXXZ ?AlphaCopy@CxImage@@QAE_NAAV1@@Z ?AlphaCreate@CxImage@@QAEXXZ ?AlphaDelete@CxImage@@QAEXXZ ?AlphaFlip@CxImage@@QAE_NXZ ?AlphaGet@CxImage@@QAEEJJ@Z ?AlphaGetMax@CxImage@@QBEEXZ ?AlphaGetPointer@CxImage@@QAEPAEJJ@Z ?AlphaInvert@CxImage@@QAEXXZ ?AlphaIsValid@CxImage@@QAE_NXZ ?AlphaMirror@CxImage@@QAE_NXZ ?AlphaPaletteClear@CxImage@@QAEXXZ ?AlphaPaletteEnable@CxImage@@QAEX_N@Z ?AlphaPaletteIsEnabled@CxImage@@QAE_NXZ ?AlphaPaletteIsValid@CxImage@@QAE_NXZ ?AlphaPaletteSplit@CxImage@@QAE_NPAV1@@Z ?AlphaSet@CxImage@@QAEXABJ0ABE@Z ?AlphaSet@CxImage@@QAEXE@Z ?AlphaSet@CxImage@@QAE_NAAV1@@Z ?AlphaSetMax@CxImage@@QAEXE@Z ?AlphaSplit@CxImage@@QAE_NPAV1@@Z ?AlphaStrip@CxImage@@QAEXXZ ?Bitfield2RGB@CxImage@@IAEXPAEGGGE@Z ?BlendPalette@CxImage@@QAEXKJ@Z ?BlendPixelColor@CxImage@@QAEXJJUtagRGBQUAD@@M_N@Z ?BlindAlphaGet@CxImage@@IAEEJJ@Z ?BlindGetPixelColor@CxImage@@IAE?AUtagRGBQUAD@@JJ@Z ?BlindGetPixelIndex@CxImage@@IAEEJJ@Z ?BlindGetPixelPointer@CxImage@@IAEPAXJJ@Z ?Center@CxRect2@@QBE?AVCxPoint2@@XZ ?CircleTransform@CxImage@@QAE_NHJM@Z ?Clear@CxImage@@QAEXE@Z ?Close@CxIOFile@@UAE_NXZ ?Close@CxMemFile@@UAE_NXZ ?CompareColors@CxImage@@KAHPBX0@Z ?ConvertAnyFormat@CxExifInfo@CxImageJPG@@IAENPAXH@Z ?Copy@CxImage@@QAEXABV1@_N11@Z ?CopyInfo@CxImage@@IAEXABV1@@Z ?CopyToHandle@CxImage@@QAEPAXXZ ?Create@CxImage@@QAEPAXKKKK@Z ?CreateFromArray@CxImage@@QAE_NPAEKKKK_N@Z ?CreateFromHANDLE@CxImage@@QAE_NPAX@Z ?CreateFromHBITMAP@CxImage@@QAE_NPAUHBITMAP__@@PAUHPALETTE__@@@Z ?CreateFromHICON@CxImage@@QAE_NPAUHICON__@@@Z ?CreateFromMatrix@CxImage@@QAE_NPAPAEKKKK_N@Z ?Crop@CxImage@@QAE_NABUtagRECT@@PAV1@@Z ?Crop@CxImage@@QAE_NJJJJPAV1@@Z ?CropRotatedRectangle@CxImage@@QAE_NJJJJMPAV1@@Z ?CrossSection@CxRect2@@QBE?AV1@ABV1@@Z ?Decode@CxImage@@QAE_NPAEKK@Z ?Decode@CxImage@@QAE_NPAU_iobuf@@K@Z ?Decode@CxImage@@QAE_NPAVCxFile@@K@Z ?Decode@CxImageGIF@@QAE_NPAU_iobuf@@@Z ?Decode@CxImageGIF@@QAE_NPAVCxFile@@@Z ?Decode@CxImageJPG@@QAE_NPAU_iobuf@@@Z ?Decode@CxImageJPG@@QAE_NPAVCxFile@@@Z ?DecodeExif@CxExifInfo@CxImageJPG@@QAE_NPAVCxFile@@H@Z ?DecodeExif@CxImageJPG@@QAE_NPAU_iobuf@@@Z ?DecodeExif@CxImageJPG@@QAE_NPAVCxFile@@@Z ?DecodeExtension@CxImageGIF@@IAE_NPAVCxFile@@@Z ?DecreaseBpp@CxImage@@QAE_NK_NPAUtagRGBQUAD@@K@Z ?Destroy@CxImage@@QAE_NXZ ?DiscardAllButExif@CxExifInfo@CxImageJPG@@QAEXXZ ?Distance@CxPoint2@@QAEMMM@Z ?Distance@CxPoint2@@QAEMV1@@Z ?Dither@CxImage@@QAE_NJ@Z ?Draw2@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@@Z ?Draw2@CxImage@@QAEJPAUHDC__@@JJJJ@Z ?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z ?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z ?DrawLine@CxImage@@QAEXHHHHK@Z ?DrawLine@CxImage@@QAEXHHHHUtagRGBQUAD@@_N@Z ?DrawString@CxImage@@QAEJPAUHDC__@@JJPBGUtagRGBQUAD@@1JJEE_N@Z ?DrawStringEx@CxImage@@QAEJPAUHDC__@@JJPAUtagCxTextInfo@1@_N@Z ?Enable@CxImage@@QAEX_N@Z ?Encode2RGBA@CxImage@@QAE_NAAPAEAAJ@Z ?Encode2RGBA@CxImage@@QAE_NPAVCxFile@@@Z ?Encode@CxImage@@QAE_NAAPAEAAJK@Z ?Encode@CxImage@@QAE_NPAU_iobuf@@K@Z ?Encode@CxImage@@QAE_NPAU_iobuf@@PAPAV1@HK@Z ?Encode@CxImage@@QAE_NPAVCxFile@@K@Z ?Encode@CxImage@@QAE_NPAVCxFile@@PAPAV1@HK@Z ?Encode@CxImageGIF@@QAE_NPAU_iobuf@@@Z ?Encode@CxImageGIF@@QAE_NPAU_iobuf@@PAPAVCxImage@@H_N@Z ?Encode@CxImageGIF@@QAE_NPAVCxFile@@@Z ?Encode@CxImageGIF@@QAE_NPAVCxFile@@PAPAVCxImage@@H_N@Z ?Encode@CxImageJPG@@QAE_NPAU_iobuf@@@Z ?Encode@CxImageJPG@@QAE_NPAVCxFile@@@Z ?EncodeBody@CxImageGIF@@IAEXPAVCxFile@@_N@Z ?EncodeComment@CxImageGIF@@IAEXPAVCxFile@@@Z ?EncodeExif@CxExifInfo@CxImageJPG@@QAE_NPAVCxFile@@@Z ?EncodeExtension@CxImageGIF@@IAEXPAVCxFile@@@Z ?EncodeHeader@CxImageGIF@@IAEXPAVCxFile@@@Z ?EncodeLoopExtension@CxImageGIF@@IAEXPAVCxFile@@@Z ?EncodeRGB@CxImageGIF@@IAE_NPAVCxFile@@@Z ?EncodeSafeCheck@CxImage@@IAE_NPAVCxFile@@@Z ?Eof@CxIOFile@@UAE_NXZ ?Eof@CxMemFile@@UAE_NXZ ?Error@CxIOFile@@UAEJXZ ?Error@CxMemFile@@UAEJXZ ?Expand@CxImage@@QAE_NJJJJUtagRGBQUAD@@PAV1@@Z ?Expand@CxImage@@QAE_NJJUtagRGBQUAD@@PAV1@@Z ?FindSection@CxExifInfo@CxImageJPG@@IAEPAXH@Z ?Flip@CxImage@@QAE_NXZ ?Flush@CxIOFile@@UAE_NXZ ?Flush@CxMemFile@@UAE_NXZ ?Free@CxMemFile@@IAEXXZ ?FreeMemory@CxImage@@QAEXPAX@Z ?Get16m@CxExifInfo@CxImageJPG@@IAEHPAX@Z ?Get16u@CxExifInfo@CxImageJPG@@IAEHPAX@Z ?Get32s@CxExifInfo@CxImageJPG@@IAEJPAX@Z ?Get32u@CxExifInfo@CxImageJPG@@IAEKPAX@Z ?GetAreaColorInterpolated@CxImage@@QAE?AUtagRGBQUAD@@MMMMW4InterpolationMethod@1@W4OverflowMethod@1@QAU2@@Z ?GetBits@CxImage@@QAEPAEK@Z ?GetBpp@CxImage@@QBEGXZ ?GetBuffer@CxMemFile@@QAEPAE_N@Z ?GetC@CxIOFile@@UAEJXZ ?GetC@CxMemFile@@UAEJXZ ?GetClrImportant@CxImage@@QBEKXZ ?GetCodecOption@CxImage@@QAEKK@Z ?GetColorType@CxImage@@QAEEXZ ?GetComment@CxImageGIF@@QAEXPAD@Z ?GetDIB@CxImage@@QBEPAXXZ ?GetDisposalMethod@CxImageGIF@@QAEJXZ ?GetEffWidth@CxImage@@QBEKXZ ?GetEscape@CxImage@@QBEJXZ ?GetFlags@CxImage@@QBEKXZ ?GetFrame@CxImage@@QBEJXZ ?GetFrameDelay@CxImage@@QBEKXZ ?GetHeight@CxImage@@QBEKXZ ?GetJpegQuality@CxImage@@QBEEXZ ?GetJpegScale@CxImage@@QBEEXZ ?GetLastError@CxImage@@QAEPBDXZ ?GetLoops@CxImageGIF@@QAEJXZ ?GetNearestIndex@CxImage@@QAEEUtagRGBQUAD@@@Z ?GetNumColors@CxImage@@QBEKXZ ?GetNumFrames@CxImage@@QBEJXZ ?GetOffset@CxImage@@QAEXPAJ0@Z ?GetPalette@CxImage@@QBEPAUtagRGBQUAD@@XZ ?GetPaletteColor@CxImage@@QAE?AUtagRGBQUAD@@E@Z ?GetPaletteColor@CxImage@@QAE_NEPAE00@Z ?GetPaletteSize@CxImage@@QAEKXZ ?GetPixelColor@CxImage@@QAE?AUtagRGBQUAD@@JJ_N@Z ?GetPixelColorInterpolated@CxImage@@QAE?AUtagRGBQUAD@@MMW4InterpolationMethod@1@W4OverflowMethod@1@QAU2@@Z ?GetPixelColorWithOverflow@CxImage@@QAE?AUtagRGBQUAD@@JJW4OverflowMethod@1@QAU2@@Z ?GetPixelGray@CxImage@@QAEEJJ@Z ?GetPixelIndex@CxImage@@QAEEJJ@Z ?GetProgress@CxImage@@QBEJXZ ?GetSize@CxImage@@QAEJXZ ?GetTransColor@CxImage@@QAE?AUtagRGBQUAD@@XZ ?GetTransIndex@CxImage@@QBEJXZ ?GetType@CxImage@@QBEKXZ ?GetVersion@CxImage@@QAEPBGXZ ?GetVersionNumber@CxImage@@QAE?BMXZ ?GetWidth@CxImage@@QBEKXZ ?GetXDPI@CxImage@@QBEJXZ ?GetYDPI@CxImage@@QBEJXZ ?Ghost@CxImage@@IAEXPAV1@@Z ?GifMix@CxImageGIF@@IAEXAAVCxImage@@AAUtag_image@1@@Z ?GifNextPixel@CxImageGIF@@IAEHXZ ?GrayScale@CxImage@@QAE_NXZ ?Height@CxRect2@@QBEMXZ ?IncreaseBpp@CxImage@@QAE_NK@Z ?InitTextInfo@CxImage@@QAEXPAUtagCxTextInfo@1@@Z ?IsEnabled@CxImage@@QBE_NXZ ?IsGrayScale@CxImage@@QAE_NXZ ?IsIndexed@CxImage@@QBE_NXZ ?IsInside@CxImage@@QAE_NJJ@Z ?IsSamePalette@CxImage@@QAE_NAAV1@_N@Z ?IsTransparent@CxImage@@QAE_NJJ@Z ?IsTransparent@CxImage@@QBE_NXZ ?IsValid@CxImage@@QBE_NXZ ?JApplyPatch@@YAHPBG00HH@Z ?KernelBSpline@CxImage@@SAMM@Z ?KernelBessel@CxImage@@SAMM@Z ?KernelBessel_J1@CxImage@@SAMM@Z ?KernelBessel_Order1@CxImage@@SAMM@Z ?KernelBessel_P1@CxImage@@SAMM@Z ?KernelBessel_Q1@CxImage@@SAMM@Z ?KernelBlackman@CxImage@@SAMM@Z ?KernelBox@CxImage@@SAMM@Z ?KernelCatrom@CxImage@@SAMM@Z ?KernelCubic@CxImage@@SAMM@Z ?KernelGaussian@CxImage@@SAMM@Z ?KernelGeneralizedCubic@CxImage@@SAMMM@Z ?KernelHamming@CxImage@@SAMM@Z ?KernelHermite@CxImage@@SAMM@Z ?KernelLanczosSinc@CxImage@@SAMMM@Z ?KernelLinear@CxImage@@SAMM@Z ?KernelMitchell@CxImage@@SAMM@Z ?KernelQuadratic@CxImage@@SAMM@Z ?KernelSinc@CxImage@@SAMM@Z ?Load@CxImage@@QAE_NPBGK@Z ?LoadBuffer@CxImage@@QAE_NPBXIK@Z ?LoadResource@CxImage@@QAE_NPAUHRSRC__@@KPAUHINSTANCE__@@@Z ?MakeBitmap@CxImage@@QAEPAUHBITMAP__@@PAUHDC__@@@Z ?Mirror@CxImage@@QAE_NXZ ?Negative@CxImage@@QAE_NXZ ?Open@CxIOFile@@QAE_NPBD0@Z ?Open@CxMemFile@@QAE_NXZ ?OverflowCoordinates@CxImage@@QAEXAAJ0W4OverflowMethod@1@@Z ?OverflowCoordinates@CxImage@@QAEXAAM0W4OverflowMethod@1@@Z ?ProcessExifDir@CxExifInfo@CxImageJPG@@IAE_NPAE0IQAUtag_ExifInfo@2@QAPAE@Z ?PutC@CxFile@@UAE_NE@Z ?PutC@CxIOFile@@UAE_NE@Z ?PutC@CxMemFile@@UAE_NE@Z ?Putword@CxImageGIF@@IAEXHPAVCxFile@@@Z ?QIShrink@CxImage@@QAE_NJJQAV1@@Z ?RGBQUADtoRGB@CxImage@@SAKUtagRGBQUAD@@@Z ?RGBtoBGR@CxImage@@IAEXPAEH@Z ?RGBtoRGBQUAD@CxImage@@SA?AUtagRGBQUAD@@K@Z ?Read@CxIOFile@@UAEIPAXII@Z ?Read@CxMemFile@@UAEIPAXII@Z ?Resample2@CxImage@@QAE_NJJW4InterpolationMethod@1@W4OverflowMethod@1@QAV1@_N@Z ?Resample@CxImage@@QAE_NJJHPAV1@@Z ?Rotate180@CxImage@@QAE_NPAV1@@Z ?Rotate2@CxImage@@QAE_NMPAV1@W4InterpolationMethod@1@W4OverflowMethod@1@PAUtagRGBQUAD@@_N4@Z ?Rotate@CxImage@@QAE_NMPAV1@@Z ?RotateLeft@CxImage@@QAE_NPAV1@@Z ?RotateRight@CxImage@@QAE_NPAV1@@Z ?Save@CxImage@@QAE_NPBGK@Z ?Seek@CxIOFile@@UAE_NJH@Z ?Seek@CxMemFile@@UAE_NJH@Z ?SelectionAddColor@CxImage@@QAE_NUtagRGBQUAD@@@Z ?SelectionAddEllipse@CxImage@@QAE_NUtagRECT@@@Z ?SelectionAddPixel@CxImage@@QAE_NHH@Z ?SelectionAddPolygon@CxImage@@QAE_NPAUtagPOINT@@J@Z ?SelectionAddRect@CxImage@@QAE_NUtagRECT@@@Z ?SelectionClear@CxImage@@QAE_NXZ ?SelectionCopy@CxImage@@QAE_NAAV1@@Z ?SelectionCreate@CxImage@@QAE_NXZ ?SelectionDelete@CxImage@@QAE_NXZ ?SelectionGetBox@CxImage@@QAEXAAUtagRECT@@@Z ?SelectionInvert@CxImage@@QAE_NXZ ?SelectionIsInside@CxImage@@QAE_NJJ@Z ?SelectionIsValid@CxImage@@QAE_NXZ ?SelectionSplit@CxImage@@QAE_NPAV1@@Z ?SelectionToHRGN@CxImage@@QAE_NAAPAUHRGN__@@@Z ?SetBuffer@CxMemFile@@QAEXPAEK@Z ?SetClrImportant@CxImage@@QAEXK@Z ?SetCodecOption@CxImage@@QAE_NKK@Z ?SetComment@CxImageGIF@@QAEXPBD@Z ?SetDisposalMethod@CxImageGIF@@QAEXH@Z ?SetEscape@CxImage@@QAEXJ@Z ?SetFlags@CxImage@@QAEXK_N@Z ?SetFrame@CxImage@@QAEXJ@Z ?SetFrameDelay@CxImage@@QAEXK@Z ?SetGrayPalette@CxImage@@QAEXXZ ?SetJpegQuality@CxImage@@QAEXE@Z ?SetJpegScale@CxImage@@QAEXE@Z ?SetLoops@CxImageGIF@@QAEXH@Z ?SetOffset@CxImage@@QAEXJJ@Z ?SetPalette@CxImage@@QAEXKPAE00@Z ?SetPalette@CxImage@@QAEXPAUrgb_color@1@K@Z ?SetPalette@CxImage@@QAEXPAUtagRGBQUAD@@K@Z ?SetPaletteColor@CxImage@@QAEXEEEEE@Z ?SetPaletteColor@CxImage@@QAEXEK@Z ?SetPaletteColor@CxImage@@QAEXEUtagRGBQUAD@@@Z ?SetPixelColor@CxImage@@QAEXJJK@Z ?SetPixelColor@CxImage@@QAEXJJUtagRGBQUAD@@_N@Z ?SetPixelIndex@CxImage@@QAEXJJE@Z ?SetProgress@CxImage@@QAEXJ@Z ?SetStdPalette@CxImage@@QAEXXZ ?SetTransColor@CxImage@@QAEXUtagRGBQUAD@@@Z ?SetTransIndex@CxImage@@QAEXJ@Z ?SetXDPI@CxImage@@QAEXJ@Z ?SetYDPI@CxImage@@QAEXJ@Z ?Size@CxIOFile@@UAEJXZ ?Size@CxMemFile@@UAEJXZ ?Skew@CxImage@@QAE_NMMJJ_N@Z ?Startup@CxImage@@IAEXK@Z ?Stretch@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@1K@Z ?Stretch@CxImage@@QAEJPAUHDC__@@JJJJJJJJK@Z ?Surface@CxRect2@@QBEMXZ ?SwapIndex@CxImage@@QAEXEE@Z ?Tell@CxIOFile@@UAEJXZ ?Tell@CxMemFile@@UAEJXZ ?Thumbnail@CxImage@@QAE_NJJUtagRGBQUAD@@PAV1@@Z ?Tile@CxImage@@QAEJPAUHDC__@@PAUtagRECT@@@Z ?Transfer@CxImage@@QAE_NAAV1@@Z ?Width@CxRect2@@QBEMXZ ?Write@CxIOFile@@UAEIPBXII@Z ?Write@CxMemFile@@UAEIPBXII@Z ?char_out@CxImageGIF@@IAEXH@Z ?cl_hash@CxImageGIF@@IAEXJ@Z ?compressLZW@CxImageGIF@@IAEXHPAVCxFile@@@Z ?compressNONE@CxImageGIF@@IAEXHPAVCxFile@@@Z ?compressRLE@CxImageGIF@@IAEXHPAVCxFile@@@Z ?decoder@CxImageGIF@@IAEFPAVCxFile@@PAVCImageIterator@@FAAH@Z ?flush_char@CxImageGIF@@IAEXXZ ?get_byte@CxImageGIF@@IAEHPAVCxFile@@@Z ?get_next_code@CxImageGIF@@IAEFPAVCxFile@@@Z ?get_num_frames@CxImageGIF@@IAEHPAVCxFile@@PAUtag_TabCol@1@PAUtag_dscgif@1@@Z ?init_exp@CxImageGIF@@IAEFF@Z ?out_line@CxImageGIF@@IAEHPAVCImageIterator@@PAEH@Z ?output@CxImageGIF@@IAEXF@Z ?process_COM@CxExifInfo@CxImageJPG@@IAEXPBEH@Z ?process_EXIF@CxExifInfo@CxImageJPG@@IAE_NPAEI@Z ?process_SOFn@CxExifInfo@CxImageJPG@@IAEXPBEH@Z ?rle_block_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_block_out@CxImageGIF@@IAEXEPAUtag_RLE@1@@Z ?rle_clear@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_compute_triangle_count@CxImageGIF@@IAEIII@Z ?rle_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_flush_clearorrep@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_flush_fromclear@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_flush_withtable@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_isqrt@CxImageGIF@@IAEII@Z ?rle_output@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_output_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_output_plain@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_reset_out_clear@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_write_block@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?seek_next_image@CxImageGIF@@IAEJPAVCxFile@@J@Z AdjustInstallDir CheckFile CheckOldNewFileMd5 CheckSpanFile CheckTheFile CreateNextSetup DoOpterator FormatInstallSpaceInfo FormatLicText GetGameName GetIPV4 GetSYSVerison GetVolumeFileSystemInfo ICreateAESRWFilter ICreateBuffer ICreateBufferCache ICreateCoderRWFilter ICreateFileMapper ICreateFileSysMgr ICreateGeneralFileSys ICreateHandleAlloc ICreateLZMARWFilter ICreateVFileSys ICreateZlibRWFilter IfDiskSpaceEnough InitCheck InitTpfManager IsEqualFile IsFilePaintable IsForceShortCut IsModuleExist IsValidVersion JApply KillProcRunning LaunchSetupByStrategy MakeUpCmd MegerXLP MegerXLPC MegerXLPCPro MegerXLPCProWd OpenURL OutputString2DebugView PaintBackGround RegesterUserWnd ReportInstallState ReportType ResetModuleName RestartUpdate SetBitMapToStatic SetDiffList SetError SetINIValue SetParentWindow SetTmpDir SgSetDeleteFile SplitAdapterID StopPaintBackGroud TQosReport UninstallReport UpdateVFSWithPatch VFSDefrag VFSDeleteEnd VFSDeleteOneFile VFSDeleteStart VFSUpdataFile VFSUpdateFile VerifyAndPatchVFS VerifyAndPatchVFSEx WriteString2Log

Name

.text

Size

820KB

Virtual Size

817KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

96KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=4, version=9782,

count=6, id=12, version=7291,

count=2, id=11, version=8047,

count=4, id=10, version=8047,

count=4, id=4, version=8047,

count=9, id=14, version=7299,

count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=12, productName=Unmarked objects (old),

count=13, id=19, version=8034,

count=372, id=1, productName=Unmarked objects,

count=75, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=18, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=20, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=18, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

$PLUGINSDIR/NSISPlugin_JApply.dll

IMPHASH f7f99bdd3b6ce4a87df0ce0eebcde6c0
SHA256 92e9ed1b41664c0c1a4a01e71e948ee8f1c83b89128eae10cd000eec8218f453
MD5 a405afddf84d2d5ea445f67b500c3ef8
SHA1 1c93e082a52fa77190fd040f218ecab3e9d8f72a
SHA512 ae8fa9ff11e6580717ddcfaee78daea706b93248fb667a3199dbec8ccb63ca5321ccf1e867ec34f01c412cfd6d5c30d1116c3b28e0be75e560ab0b13ad098d98
SSDEEP 24576:dxqrmrclm8UDYF3mG2OjBjARt06TJwtBvSgoTjvQyKYT:0TmG2q6tAOTrQyK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

630716

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LeaveCriticalSection WriteFile EnterCriticalSection MoveFileExW SetFileAttributesW GetModuleFileNameW CreateFileW ReadFile SetFilePointer GetFileSize FreeLibrary GetProcAddress LoadLibraryW DeleteFileA WritePrivateProfileStringW GetVolumeInformationW GetVersionExW GetCurrentProcessId SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime CreateDirectoryW SetFileTime GlobalUnlock GlobalLock GlobalAlloc GlobalSize LockResource MultiByteToWideChar SizeofResource SetFileAttributesA CopyFileA FindFirstFileA FindNextFileA CreateFileA CreateEventA GetFullPathNameA CreateThread ResetEvent SetEvent TerminateThread DeleteCriticalSection InitializeCriticalSection OutputDebugStringA VirtualAlloc VirtualFree GlobalFree lstrcpyW lstrcpynW SleepEx GetTickCount GetSystemTimeAsFileTime LoadLibraryA SetEndOfFile Process32Next Process32First GetSystemInfo lstrlenA MoveFileW FindFirstFileW FindNextFileW FindClose CreateProcessW GetDiskFreeSpaceExW GetPrivateProfileIntW GetPrivateProfileStringW GetFileAttributesW DeleteFileW WideCharToMultiByte lstrlenW TerminateProcess WaitForSingleObject GetLogicalDriveStringsW QueryDosDeviceW OutputDebugStringW CreateToolhelp32Snapshot Process32FirstW OpenProcess Process32NextW OpenFileMappingW MapViewOfFile UnmapViewOfFile CloseHandle LoadResource GetLastError GetVersionExA GetLocalTime Module32First LockFile LockFileEx UnlockFile UnlockFileEx FlushFileBuffers CreateDirectoryA GenerateConsoleCtrlEvent ExitProcess GetFileAttributesA

user32

CharUpperW SendMessageW FindWindowW KillTimer SetTimer GetDlgItem FindWindowExW ShowWindow BringWindowToTop CreateWindowExW RegisterClassW LoadCursorW UnregisterClassW DestroyWindow IsWindow DefWindowProcW GetUpdateRect wsprintfW GetDC GetWindowInfo EnableMenuItem GetSystemMenu CallWindowProcW ReleaseDC GetIconInfo DrawTextW LoadIconW

gdi32

CombineRgn CreateFontIndirectW SetTextColor SetBkMode StretchDIBits RectVisible CreateBitmap SetBkColor StretchBlt GetClipBox CreateRectRgnIndirect ExtSelectClipRgn SetStretchBltMode SetDIBitsToDevice DeleteObject GetObjectW RealizePalette GetDIBits CreateDIBSection DeleteDC CreateDIBitmap CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt GetStockObject CreateRectRgn

psapi

GetProcessImageFileNameW GetModuleFileNameExW

msvcrt

_CxxThrowException swprintf _CIpow div _CIacos _CIfmod longjmp _setjmp3 __CxxLongjmpUnwind printf isprint strncmp abort sprintf gmtime strtod sscanf getenv _mbsnbicmp _mbsnbcpy _mbsnbcat _mbslwr floor memmove _mbsicmp _mbsnbcmp remove _rmdir _access _mbsrchr _mkdir _mbschr _assert vsprintf _msize rand srand _snprintf _except_handler3 ?terminate@@YAXXZ __dllonexit _onexit _initterm _adjust_fdiv ??1type_info@@UAE@XZ realloc strlen strcmp calloc wcsncat toupper strcat malloc free fgetc fwscanf _wcsupr wcscmp wcstok wcsstr time fwprintf wcsftime strncpy wcscat memcmp ??2@YAPAXI@Z _itow _wtol strcpy wcsrchr memset wcsncpy _wcslwr _wcsicmp wcscpy _snwprintf memcpy _ftol _vsnwprintf _wcsnicmp _wtoi wcschr wcslen fputc fflush fwrite fread fopen __CxxFrameHandler ??3@YAXPAX@Z _purecall _waccess _vsnprintf _wfopen atoi strspn __mb_cur_max _isctype _pctype tolower fclose ftell fprintf fseek _iob exit putc getc strchr memchr strstr _errno asctime _lseeki64 _pipe _popen _pclose _get_osfhandle _fullpath strrchr signal fscanf _getcwd _chdir _stat _fstat strtol atof mbstowcs setlocale wcstombs mktime vfprintf _utime _close _open _strdup _stricmp localtime _strnicmp

mfc42u

ord6066 ord6130 ord4125 ord2859 ord668 ord4053 ord2773 ord2762 ord356 ord640 ord1633 ord323 ord6132

msvcp60

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z ??0_Lockit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Xran@std@@YAXXZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Xlen@std@@YAXXZ ?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

ws2_32

inet_addr select ntohs __WSAFDIsSet ntohl inet_ntoa htons gethostbyname WSAStartup WSACleanup socket setsockopt ioctlsocket listen bind WSAGetLastError connect accept closesocket send recv getsockopt htonl

shlwapi

PathFileExistsW StrTrimW

wininet

InternetOpenW InternetOpenUrlW InternetCloseHandle

ole32

CoInitialize CoCreateInstance CoUninitialize

winmm

timeKillEvent timeBeginPeriod timeGetDevCaps timeSetEvent

??0CxExifInfo@CxImageJPG@@QAE@PAUtag_ExifInfo@1@@Z ??0CxFile@@QAE@ABV0@@Z ??0CxFile@@QAE@XZ ??0CxIOFile@@QAE@ABV0@@Z ??0CxIOFile@@QAE@PAU_iobuf@@@Z ??0CxImage@@QAE@ABV0@_N11@Z ??0CxImage@@QAE@K@Z ??0CxImage@@QAE@KKKK@Z ??0CxImage@@QAE@PAEKK@Z ??0CxImage@@QAE@PAU_iobuf@@K@Z ??0CxImage@@QAE@PAVCxFile@@K@Z ??0CxImage@@QAE@PBGK@Z ??0CxImageGIF@@QAE@ABV0@@Z ??0CxImageGIF@@QAE@XZ ??0CxImageJPG@@QAE@ABV0@@Z ??0CxImageJPG@@QAE@XZ ??0CxMemFile@@QAE@ABV0@@Z ??0CxMemFile@@QAE@PAEK@Z ??0CxPoint2@@QAE@ABV0@@Z ??0CxPoint2@@QAE@MM@Z ??0CxPoint2@@QAE@XZ ??0CxRect2@@QAE@ABV0@@Z ??0CxRect2@@QAE@MMMM@Z ??0CxRect2@@QAE@XZ ??1CxExifInfo@CxImageJPG@@QAE@XZ ??1CxFile@@UAE@XZ ??1CxIOFile@@UAE@XZ ??1CxImage@@UAE@XZ ??1CxImageGIF@@UAE@XZ ??1CxImageJPG@@UAE@XZ ??1CxMemFile@@UAE@XZ ??4CxExifInfo@CxImageJPG@@QAEAAV01@ABV01@@Z ??4CxFile@@QAEAAV0@ABV0@@Z ??4CxIOFile@@QAEAAV0@ABV0@@Z ??4CxImage@@QAEAAV0@ABV0@@Z ??4CxImageGIF@@QAEAAV0@ABV0@@Z ??4CxImageJPG@@QAEAAV0@ABV0@@Z ??4CxMemFile@@QAEAAV0@ABV0@@Z ??4CxPoint2@@QAEAAV0@ABV0@@Z ??4CxRect2@@QAEAAV0@ABV0@@Z ??_7CxFile@@6B@ ??_7CxIOFile@@6B@ ??_7CxImage@@6B@ ??_7CxImageGIF@@6B@ ??_7CxImageJPG@@6B@ ??_7CxMemFile@@6B@ ??_FCxExifInfo@CxImageJPG@@QAEXXZ ??_FCxIOFile@@QAEXXZ ??_FCxImage@@QAEXXZ ??_FCxMemFile@@QAEXXZ ??_OCxImage@@QAEXABV0@@Z ?AddAveragingCont@CxImage@@IAEXABUtagRGBQUAD@@MAAM111@Z ?Alloc@CxMemFile@@IAEXK@Z ?AlphaClear@CxImage@@QAEXXZ ?AlphaCopy@CxImage@@QAE_NAAV1@@Z ?AlphaCreate@CxImage@@QAEXXZ ?AlphaDelete@CxImage@@QAEXXZ ?AlphaFlip@CxImage@@QAE_NXZ ?AlphaGet@CxImage@@QAEEJJ@Z ?AlphaGetMax@CxImage@@QBEEXZ ?AlphaGetPointer@CxImage@@QAEPAEJJ@Z ?AlphaInvert@CxImage@@QAEXXZ ?AlphaIsValid@CxImage@@QAE_NXZ ?AlphaMirror@CxImage@@QAE_NXZ ?AlphaPaletteClear@CxImage@@QAEXXZ ?AlphaPaletteEnable@CxImage@@QAEX_N@Z ?AlphaPaletteIsEnabled@CxImage@@QAE_NXZ ?AlphaPaletteIsValid@CxImage@@QAE_NXZ ?AlphaPaletteSplit@CxImage@@QAE_NPAV1@@Z ?AlphaSet@CxImage@@QAEXABJ0ABE@Z ?AlphaSet@CxImage@@QAEXE@Z ?AlphaSet@CxImage@@QAE_NAAV1@@Z ?AlphaSetMax@CxImage@@QAEXE@Z ?AlphaSplit@CxImage@@QAE_NPAV1@@Z ?AlphaStrip@CxImage@@QAEXXZ ?Bitfield2RGB@CxImage@@IAEXPAEGGGE@Z ?BlendPalette@CxImage@@QAEXKJ@Z ?BlendPixelColor@CxImage@@QAEXJJUtagRGBQUAD@@M_N@Z ?BlindAlphaGet@CxImage@@IAEEJJ@Z ?BlindGetPixelColor@CxImage@@IAE?AUtagRGBQUAD@@JJ@Z ?BlindGetPixelIndex@CxImage@@IAEEJJ@Z ?BlindGetPixelPointer@CxImage@@IAEPAXJJ@Z ?Center@CxRect2@@QBE?AVCxPoint2@@XZ ?CircleTransform@CxImage@@QAE_NHJM@Z ?Clear@CxImage@@QAEXE@Z ?Close@CxIOFile@@UAE_NXZ ?Close@CxMemFile@@UAE_NXZ ?CompareColors@CxImage@@KAHPBX0@Z ?ConvertAnyFormat@CxExifInfo@CxImageJPG@@IAENPAXH@Z ?Copy@CxImage@@QAEXABV1@_N11@Z ?CopyInfo@CxImage@@IAEXABV1@@Z ?CopyToHandle@CxImage@@QAEPAXXZ ?Create@CxImage@@QAEPAXKKKK@Z ?CreateFromArray@CxImage@@QAE_NPAEKKKK_N@Z ?CreateFromHANDLE@CxImage@@QAE_NPAX@Z ?CreateFromHBITMAP@CxImage@@QAE_NPAUHBITMAP__@@PAUHPALETTE__@@@Z ?CreateFromHICON@CxImage@@QAE_NPAUHICON__@@@Z ?CreateFromMatrix@CxImage@@QAE_NPAPAEKKKK_N@Z ?Crop@CxImage@@QAE_NABUtagRECT@@PAV1@@Z ?Crop@CxImage@@QAE_NJJJJPAV1@@Z ?CropRotatedRectangle@CxImage@@QAE_NJJJJMPAV1@@Z ?CrossSection@CxRect2@@QBE?AV1@ABV1@@Z ?Decode@CxImage@@QAE_NPAEKK@Z ?Decode@CxImage@@QAE_NPAU_iobuf@@K@Z ?Decode@CxImage@@QAE_NPAVCxFile@@K@Z ?Decode@CxImageGIF@@QAE_NPAU_iobuf@@@Z ?Decode@CxImageGIF@@QAE_NPAVCxFile@@@Z ?Decode@CxImageJPG@@QAE_NPAU_iobuf@@@Z ?Decode@CxImageJPG@@QAE_NPAVCxFile@@@Z ?DecodeExif@CxExifInfo@CxImageJPG@@QAE_NPAVCxFile@@H@Z ?DecodeExif@CxImageJPG@@QAE_NPAU_iobuf@@@Z ?DecodeExif@CxImageJPG@@QAE_NPAVCxFile@@@Z ?DecodeExtension@CxImageGIF@@IAE_NPAVCxFile@@@Z ?DecreaseBpp@CxImage@@QAE_NK_NPAUtagRGBQUAD@@K@Z ?Destroy@CxImage@@QAE_NXZ ?DiscardAllButExif@CxExifInfo@CxImageJPG@@QAEXXZ ?Distance@CxPoint2@@QAEMMM@Z ?Distance@CxPoint2@@QAEMV1@@Z ?Dither@CxImage@@QAE_NJ@Z ?Draw2@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@@Z ?Draw2@CxImage@@QAEJPAUHDC__@@JJJJ@Z ?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z ?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z ?DrawLine@CxImage@@QAEXHHHHK@Z ?DrawLine@CxImage@@QAEXHHHHUtagRGBQUAD@@_N@Z ?DrawString@CxImage@@QAEJPAUHDC__@@JJPBGUtagRGBQUAD@@1JJEE_N@Z ?DrawStringEx@CxImage@@QAEJPAUHDC__@@JJPAUtagCxTextInfo@1@_N@Z ?Enable@CxImage@@QAEX_N@Z ?Encode2RGBA@CxImage@@QAE_NAAPAEAAJ@Z ?Encode2RGBA@CxImage@@QAE_NPAVCxFile@@@Z ?Encode@CxImage@@QAE_NAAPAEAAJK@Z ?Encode@CxImage@@QAE_NPAU_iobuf@@K@Z ?Encode@CxImage@@QAE_NPAU_iobuf@@PAPAV1@HK@Z ?Encode@CxImage@@QAE_NPAVCxFile@@K@Z ?Encode@CxImage@@QAE_NPAVCxFile@@PAPAV1@HK@Z ?Encode@CxImageGIF@@QAE_NPAU_iobuf@@@Z ?Encode@CxImageGIF@@QAE_NPAU_iobuf@@PAPAVCxImage@@H_N@Z ?Encode@CxImageGIF@@QAE_NPAVCxFile@@@Z ?Encode@CxImageGIF@@QAE_NPAVCxFile@@PAPAVCxImage@@H_N@Z ?Encode@CxImageJPG@@QAE_NPAU_iobuf@@@Z ?Encode@CxImageJPG@@QAE_NPAVCxFile@@@Z ?EncodeBody@CxImageGIF@@IAEXPAVCxFile@@_N@Z ?EncodeComment@CxImageGIF@@IAEXPAVCxFile@@@Z ?EncodeExif@CxExifInfo@CxImageJPG@@QAE_NPAVCxFile@@@Z ?EncodeExtension@CxImageGIF@@IAEXPAVCxFile@@@Z ?EncodeHeader@CxImageGIF@@IAEXPAVCxFile@@@Z ?EncodeLoopExtension@CxImageGIF@@IAEXPAVCxFile@@@Z ?EncodeRGB@CxImageGIF@@IAE_NPAVCxFile@@@Z ?EncodeSafeCheck@CxImage@@IAE_NPAVCxFile@@@Z ?Eof@CxIOFile@@UAE_NXZ ?Eof@CxMemFile@@UAE_NXZ ?Error@CxIOFile@@UAEJXZ ?Error@CxMemFile@@UAEJXZ ?Expand@CxImage@@QAE_NJJJJUtagRGBQUAD@@PAV1@@Z ?Expand@CxImage@@QAE_NJJUtagRGBQUAD@@PAV1@@Z ?FindSection@CxExifInfo@CxImageJPG@@IAEPAXH@Z ?Flip@CxImage@@QAE_NXZ ?Flush@CxIOFile@@UAE_NXZ ?Flush@CxMemFile@@UAE_NXZ ?Free@CxMemFile@@IAEXXZ ?FreeMemory@CxImage@@QAEXPAX@Z ?Get16m@CxExifInfo@CxImageJPG@@IAEHPAX@Z ?Get16u@CxExifInfo@CxImageJPG@@IAEHPAX@Z ?Get32s@CxExifInfo@CxImageJPG@@IAEJPAX@Z ?Get32u@CxExifInfo@CxImageJPG@@IAEKPAX@Z ?GetAreaColorInterpolated@CxImage@@QAE?AUtagRGBQUAD@@MMMMW4InterpolationMethod@1@W4OverflowMethod@1@QAU2@@Z ?GetBits@CxImage@@QAEPAEK@Z ?GetBpp@CxImage@@QBEGXZ ?GetBuffer@CxMemFile@@QAEPAE_N@Z ?GetC@CxIOFile@@UAEJXZ ?GetC@CxMemFile@@UAEJXZ ?GetClrImportant@CxImage@@QBEKXZ ?GetCodecOption@CxImage@@QAEKK@Z ?GetColorType@CxImage@@QAEEXZ ?GetComment@CxImageGIF@@QAEXPAD@Z ?GetDIB@CxImage@@QBEPAXXZ ?GetDisposalMethod@CxImageGIF@@QAEJXZ ?GetEffWidth@CxImage@@QBEKXZ ?GetEscape@CxImage@@QBEJXZ ?GetFlags@CxImage@@QBEKXZ ?GetFrame@CxImage@@QBEJXZ ?GetFrameDelay@CxImage@@QBEKXZ ?GetHeight@CxImage@@QBEKXZ ?GetJpegQuality@CxImage@@QBEEXZ ?GetJpegScale@CxImage@@QBEEXZ ?GetLastError@CxImage@@QAEPBDXZ ?GetLoops@CxImageGIF@@QAEJXZ ?GetNearestIndex@CxImage@@QAEEUtagRGBQUAD@@@Z ?GetNumColors@CxImage@@QBEKXZ ?GetNumFrames@CxImage@@QBEJXZ ?GetOffset@CxImage@@QAEXPAJ0@Z ?GetPalette@CxImage@@QBEPAUtagRGBQUAD@@XZ ?GetPaletteColor@CxImage@@QAE?AUtagRGBQUAD@@E@Z ?GetPaletteColor@CxImage@@QAE_NEPAE00@Z ?GetPaletteSize@CxImage@@QAEKXZ ?GetPixelColor@CxImage@@QAE?AUtagRGBQUAD@@JJ_N@Z ?GetPixelColorInterpolated@CxImage@@QAE?AUtagRGBQUAD@@MMW4InterpolationMethod@1@W4OverflowMethod@1@QAU2@@Z ?GetPixelColorWithOverflow@CxImage@@QAE?AUtagRGBQUAD@@JJW4OverflowMethod@1@QAU2@@Z ?GetPixelGray@CxImage@@QAEEJJ@Z ?GetPixelIndex@CxImage@@QAEEJJ@Z ?GetProgress@CxImage@@QBEJXZ ?GetSize@CxImage@@QAEJXZ ?GetTransColor@CxImage@@QAE?AUtagRGBQUAD@@XZ ?GetTransIndex@CxImage@@QBEJXZ ?GetType@CxImage@@QBEKXZ ?GetVersion@CxImage@@QAEPBGXZ ?GetVersionNumber@CxImage@@QAE?BMXZ ?GetWidth@CxImage@@QBEKXZ ?GetXDPI@CxImage@@QBEJXZ ?GetYDPI@CxImage@@QBEJXZ ?Ghost@CxImage@@IAEXPAV1@@Z ?GifMix@CxImageGIF@@IAEXAAVCxImage@@AAUtag_image@1@@Z ?GifNextPixel@CxImageGIF@@IAEHXZ ?GrayScale@CxImage@@QAE_NXZ ?Height@CxRect2@@QBEMXZ ?IncreaseBpp@CxImage@@QAE_NK@Z ?InitTextInfo@CxImage@@QAEXPAUtagCxTextInfo@1@@Z ?IsEnabled@CxImage@@QBE_NXZ ?IsGrayScale@CxImage@@QAE_NXZ ?IsIndexed@CxImage@@QBE_NXZ ?IsInside@CxImage@@QAE_NJJ@Z ?IsSamePalette@CxImage@@QAE_NAAV1@_N@Z ?IsTransparent@CxImage@@QAE_NJJ@Z ?IsTransparent@CxImage@@QBE_NXZ ?IsValid@CxImage@@QBE_NXZ ?KernelBSpline@CxImage@@SAMM@Z ?KernelBessel@CxImage@@SAMM@Z ?KernelBessel_J1@CxImage@@SAMM@Z ?KernelBessel_Order1@CxImage@@SAMM@Z ?KernelBessel_P1@CxImage@@SAMM@Z ?KernelBessel_Q1@CxImage@@SAMM@Z ?KernelBlackman@CxImage@@SAMM@Z ?KernelBox@CxImage@@SAMM@Z ?KernelCatrom@CxImage@@SAMM@Z ?KernelCubic@CxImage@@SAMM@Z ?KernelGaussian@CxImage@@SAMM@Z ?KernelGeneralizedCubic@CxImage@@SAMMM@Z ?KernelHamming@CxImage@@SAMM@Z ?KernelHermite@CxImage@@SAMM@Z ?KernelLanczosSinc@CxImage@@SAMMM@Z ?KernelLinear@CxImage@@SAMM@Z ?KernelMitchell@CxImage@@SAMM@Z ?KernelQuadratic@CxImage@@SAMM@Z ?KernelSinc@CxImage@@SAMM@Z ?Load@CxImage@@QAE_NPBGK@Z ?LoadBuffer@CxImage@@QAE_NPBXIK@Z ?LoadResource@CxImage@@QAE_NPAUHRSRC__@@KPAUHINSTANCE__@@@Z ?MakeBitmap@CxImage@@QAEPAUHBITMAP__@@PAUHDC__@@@Z ?Mirror@CxImage@@QAE_NXZ ?Negative@CxImage@@QAE_NXZ ?Open@CxIOFile@@QAE_NPBD0@Z ?Open@CxMemFile@@QAE_NXZ ?OverflowCoordinates@CxImage@@QAEXAAJ0W4OverflowMethod@1@@Z ?OverflowCoordinates@CxImage@@QAEXAAM0W4OverflowMethod@1@@Z ?ProcessExifDir@CxExifInfo@CxImageJPG@@IAE_NPAE0IQAUtag_ExifInfo@2@QAPAE@Z ?PutC@CxFile@@UAE_NE@Z ?PutC@CxIOFile@@UAE_NE@Z ?PutC@CxMemFile@@UAE_NE@Z ?Putword@CxImageGIF@@IAEXHPAVCxFile@@@Z ?QIShrink@CxImage@@QAE_NJJQAV1@@Z ?RGBQUADtoRGB@CxImage@@SAKUtagRGBQUAD@@@Z ?RGBtoBGR@CxImage@@IAEXPAEH@Z ?RGBtoRGBQUAD@CxImage@@SA?AUtagRGBQUAD@@K@Z ?Read@CxIOFile@@UAEIPAXII@Z ?Read@CxMemFile@@UAEIPAXII@Z ?Resample2@CxImage@@QAE_NJJW4InterpolationMethod@1@W4OverflowMethod@1@QAV1@_N@Z ?Resample@CxImage@@QAE_NJJHPAV1@@Z ?Rotate180@CxImage@@QAE_NPAV1@@Z ?Rotate2@CxImage@@QAE_NMPAV1@W4InterpolationMethod@1@W4OverflowMethod@1@PAUtagRGBQUAD@@_N4@Z ?Rotate@CxImage@@QAE_NMPAV1@@Z ?RotateLeft@CxImage@@QAE_NPAV1@@Z ?RotateRight@CxImage@@QAE_NPAV1@@Z ?Save@CxImage@@QAE_NPBGK@Z ?Seek@CxIOFile@@UAE_NJH@Z ?Seek@CxMemFile@@UAE_NJH@Z ?SelectionAddColor@CxImage@@QAE_NUtagRGBQUAD@@@Z ?SelectionAddEllipse@CxImage@@QAE_NUtagRECT@@@Z ?SelectionAddPixel@CxImage@@QAE_NHH@Z ?SelectionAddPolygon@CxImage@@QAE_NPAUtagPOINT@@J@Z ?SelectionAddRect@CxImage@@QAE_NUtagRECT@@@Z ?SelectionClear@CxImage@@QAE_NXZ ?SelectionCopy@CxImage@@QAE_NAAV1@@Z ?SelectionCreate@CxImage@@QAE_NXZ ?SelectionDelete@CxImage@@QAE_NXZ ?SelectionGetBox@CxImage@@QAEXAAUtagRECT@@@Z ?SelectionInvert@CxImage@@QAE_NXZ ?SelectionIsInside@CxImage@@QAE_NJJ@Z ?SelectionIsValid@CxImage@@QAE_NXZ ?SelectionSplit@CxImage@@QAE_NPAV1@@Z ?SelectionToHRGN@CxImage@@QAE_NAAPAUHRGN__@@@Z ?SetBuffer@CxMemFile@@QAEXPAEK@Z ?SetClrImportant@CxImage@@QAEXK@Z ?SetCodecOption@CxImage@@QAE_NKK@Z ?SetComment@CxImageGIF@@QAEXPBD@Z ?SetDisposalMethod@CxImageGIF@@QAEXH@Z ?SetEscape@CxImage@@QAEXJ@Z ?SetFlags@CxImage@@QAEXK_N@Z ?SetFrame@CxImage@@QAEXJ@Z ?SetFrameDelay@CxImage@@QAEXK@Z ?SetGrayPalette@CxImage@@QAEXXZ ?SetJpegQuality@CxImage@@QAEXE@Z ?SetJpegScale@CxImage@@QAEXE@Z ?SetLoops@CxImageGIF@@QAEXH@Z ?SetOffset@CxImage@@QAEXJJ@Z ?SetPalette@CxImage@@QAEXKPAE00@Z ?SetPalette@CxImage@@QAEXPAUrgb_color@1@K@Z ?SetPalette@CxImage@@QAEXPAUtagRGBQUAD@@K@Z ?SetPaletteColor@CxImage@@QAEXEEEEE@Z ?SetPaletteColor@CxImage@@QAEXEK@Z ?SetPaletteColor@CxImage@@QAEXEUtagRGBQUAD@@@Z ?SetPixelColor@CxImage@@QAEXJJK@Z ?SetPixelColor@CxImage@@QAEXJJUtagRGBQUAD@@_N@Z ?SetPixelIndex@CxImage@@QAEXJJE@Z ?SetProgress@CxImage@@QAEXJ@Z ?SetStdPalette@CxImage@@QAEXXZ ?SetTransColor@CxImage@@QAEXUtagRGBQUAD@@@Z ?SetTransIndex@CxImage@@QAEXJ@Z ?SetXDPI@CxImage@@QAEXJ@Z ?SetYDPI@CxImage@@QAEXJ@Z ?Size@CxIOFile@@UAEJXZ ?Size@CxMemFile@@UAEJXZ ?Skew@CxImage@@QAE_NMMJJ_N@Z ?Startup@CxImage@@IAEXK@Z ?Stretch@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@1K@Z ?Stretch@CxImage@@QAEJPAUHDC__@@JJJJJJJJK@Z ?Surface@CxRect2@@QBEMXZ ?SwapIndex@CxImage@@QAEXEE@Z ?Tell@CxIOFile@@UAEJXZ ?Tell@CxMemFile@@UAEJXZ ?Thumbnail@CxImage@@QAE_NJJUtagRGBQUAD@@PAV1@@Z ?Tile@CxImage@@QAEJPAUHDC__@@PAUtagRECT@@@Z ?Transfer@CxImage@@QAE_NAAV1@@Z ?Width@CxRect2@@QBEMXZ ?Write@CxIOFile@@UAEIPBXII@Z ?Write@CxMemFile@@UAEIPBXII@Z ?char_out@CxImageGIF@@IAEXH@Z ?cl_hash@CxImageGIF@@IAEXJ@Z ?compressLZW@CxImageGIF@@IAEXHPAVCxFile@@@Z ?compressNONE@CxImageGIF@@IAEXHPAVCxFile@@@Z ?compressRLE@CxImageGIF@@IAEXHPAVCxFile@@@Z ?decoder@CxImageGIF@@IAEFPAVCxFile@@PAVCImageIterator@@FAAH@Z ?flush_char@CxImageGIF@@IAEXXZ ?get_byte@CxImageGIF@@IAEHPAVCxFile@@@Z ?get_next_code@CxImageGIF@@IAEFPAVCxFile@@@Z ?get_num_frames@CxImageGIF@@IAEHPAVCxFile@@PAUtag_TabCol@1@PAUtag_dscgif@1@@Z ?init_exp@CxImageGIF@@IAEFF@Z ?out_line@CxImageGIF@@IAEHPAVCImageIterator@@PAEH@Z ?output@CxImageGIF@@IAEXF@Z ?process_COM@CxExifInfo@CxImageJPG@@IAEXPBEH@Z ?process_EXIF@CxExifInfo@CxImageJPG@@IAE_NPAEI@Z ?process_SOFn@CxExifInfo@CxImageJPG@@IAEXPBEH@Z ?rle_block_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_block_out@CxImageGIF@@IAEXEPAUtag_RLE@1@@Z ?rle_clear@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_compute_triangle_count@CxImageGIF@@IAEIII@Z ?rle_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_flush_clearorrep@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_flush_fromclear@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_flush_withtable@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_isqrt@CxImageGIF@@IAEII@Z ?rle_output@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_output_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_output_plain@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_reset_out_clear@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_write_block@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?seek_next_image@CxImageGIF@@IAEJPAVCxFile@@J@Z AdjustInstallDir CheckFile CheckOldNewFileMd5 CheckSpanFile CheckTheFile CreateNextSetup DoOpterator FormatInstallSpaceInfo FormatLicText GetGameName GetIPV4 GetSYSVerison GetVolumeFileSystemInfo ICreateAESRWFilter ICreateBuffer ICreateBufferCache ICreateCoderRWFilter ICreateFileMapper ICreateFileSysMgr ICreateGeneralFileSys ICreateHandleAlloc ICreateLZMARWFilter ICreateVFileSys ICreateZlibRWFilter IfDiskSpaceEnough InitCheck InitTpfManager IsEqualFile IsFilePaintable IsForceShortCut IsModuleExist IsValidVersion JApply JApplyPatch KillProcRunning LaunchSetupByStrategy MakeUpCmd MegerXLP MegerXLPC MegerXLPCPro MegerXLPCProWd OpenURL OutputString2DebugView PaintBackGround RegesterUserWnd ReportInstallState ReportType ResetModuleName RestartUpdate SetBitMapToStatic SetDiffList SetError SetINIValue SetParentWindow SetTmpDir SgSetDeleteFile SplitAdapterID StopPaintBackGroud TQosReport UninstallReport UpdateVFSWithPatch VFSDefrag VFSDeleteEnd VFSDeleteOneFile VFSDeleteStart VFSUpdataFile VFSUpdateFile VerifyAndPatchVFS VerifyAndPatchVFSEx WriteString2Log

Name

.text

Size

812KB

Virtual Size

811KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

96KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=4, version=9782,

count=6, id=12, version=7291,

count=2, id=11, version=8047,

count=4, id=10, version=8047,

count=4, id=4, version=8047,

count=9, id=14, version=7299,

count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=12, productName=Unmarked objects (old),

count=13, id=19, version=8034,

count=372, id=1, productName=Unmarked objects,

count=75, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=18, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=19, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=19, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 689a67b30946cbe12dce92d17207ec0488e850a806be608e6fb174f853f86b57
MD5 6f98fcda445825382121e480a64ae24c
SHA1 d5071f4928fc8c38fc8d015501bfc1f4229b1799
SHA512 68cb5b4ec06e4955ea8b5208f5f8569a37120c185dc9a10966c89ab5fd2bb0c6038d901d7b0fd15b1db8409a2b1ede18451f3d09cb17156a14fe4940095a7d0d
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 f9a386de4c39875933e41ddfc73c67cef09fdd005cebf816324407d5a40b67d5
MD5 9648b8991f6443509d5352342dde192f
SHA1 48e71b8b1970d19eab7db41dd6a634c95f9bb495
SHA512 dfa7454b306dbb8ab4d27560fdec50bb8cac0ec29ccea93316d5c146db0dba76554a7684f48ab04cdf55b372a39b783cdebdc2888c0cdd60b9e19cb6ddee25ea
SSDEEP 384:e18ZfQOso04OFLxuvTrPglA2uorHKzkkxkdEKPi39MLKRoeOEk4/j9B46MoKGrx:umQOsb4OL6XP30mA3JPQumRo1Lo46MYV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 be7fdccc1f688b0a07611641f6e548907dd31e48f508ef845e02356d1aeb9f0a
MD5 348b40fe521aba85a831e45bc66e4788
SHA1 4affe8803006d8f7a7d3aa7c6b06e81a4af1207d
SHA512 fa7cc3dcff1769b3e1321e14a203ff1c330d7f5c3613ba4f37c5aaf4a681ae2df711cf0a454be40260045f322241582a9895bd539b290061989d44808e9b64eb
SSDEEP 3072:Dj69Aa4fvm3CgiEARfgb7Siv2rkGejDw+8ZXRzQ1EMyGtbl3aN:3la4fvmllARfgbhuQVj+XRaj3tbl3g
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

TCLSCOPY/TCLSCheck.lst

SHA256 6fc9e6bcfc45007e2e88a41c11e6269c64e29eb259775e24bce84bc80f2dce68
MD5 47b11172a904e6b5c14072471c51d850
SHA1 25ca49f5fc9dbf32c11b952334a842d4495c9aa1
SHA512 945960da87e43acd47f1505ddccd48ee0f1e38e2138e29bfcee949557ebdfc5fcf491585daea71d73ef8b93d637b8fd6ca0ca51597101c3fc11057922281b328
MD5 SHA1 SHA512

NSIS installer

installer

TCLSCOPY/TenProtect/SecureCheck.dll

IMPHASH 2d65f7bb6cb1a161ea3b58bd44b53c76
SHA256 ecc02c355886331aefc098cfbd29c88b89bb4773d5752061debf63dd80cceb19
MD5 22f44d5d7b693dc67a5de9ac5041ca63
SHA1 5275a92d8365e8c9c4a1718f3413f78a9a82ac80
SHA512 3ea78965c53469652fa869e60fbdc09d468b0b22c2546516498c915d4674b11da81dc9fb77c437f629dd1fdbb390d4030b72d741feb24f972a1111225dc5de00
SSDEEP 49152:j/S58dcaq458qhScpwR6KiZtGSz5XzwwyRQiPDU0oT:j/yicaqDup66KsVXsd1oT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

85:4c:9d:6b:5d:b6:a5:0f:67:91:f5:c3:31:7b:cd:de:40:a6:29:53:8c:60:30:03:c6:a6:c0:b3:12:21:5e:97

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jul 6, 2017

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

c1:fc:c8:93:01:61:b7:56:81:6f:1b:14:e6:0a:73:02:3d:a8:31:5a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jul 6, 2017

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 4, 2016 - Mar 28, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2016 - Mar 28, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

0

Major OS version

5

Entry point

201632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\.jenkins\workspace\tas-secscan-trunk\Output\TASSecScan.pdb

kernel32

GetPrivateProfileIntA Sleep InitializeCriticalSection DeleteCriticalSection UnmapViewOfFile GetCurrentProcessId CreateFileMappingA MapViewOfFile MultiByteToWideChar LoadLibraryW GetProcAddress FreeLibrary GetModuleFileNameW GetModuleHandleW GetFileSize GetFileTime GetLocalTime SystemTimeToFileTime CreateFileA CreateSemaphoreA ReleaseSemaphore GetLastError CreateToolhelp32Snapshot Module32First OpenProcess ReadProcessMemory FindFirstFileA FindNextFileA FindClose ExpandEnvironmentStringsA OpenMutexA OpenEventA OpenFileMappingA Process32First ReadFile Process32Next GetModuleFileNameA Module32Next IsBadReadPtr WriteFile CreateDirectoryA GetCurrentThreadId GetModuleHandleA GetVolumePathNamesForVolumeNameW FindFirstVolumeW QueryDosDeviceW FindNextVolumeW FindVolumeClose WideCharToMultiByte GetCurrentProcess LoadLibraryA GetTickCount IsBadWritePtr DeleteFileA GetTempPathA GetTempFileNameA MoveFileExA MoveFileA DeviceIoControl GetVersionExA GetSystemDirectoryA CopyFileA ResetEvent WriteConsoleW GetConsoleOutputCP WriteConsoleA TerminateThread CloseHandle CreateThread SetEvent WaitForSingleObject CreateEventA LeaveCriticalSection EnterCriticalSection TerminateProcess DisableThreadLibraryCalls FlushFileBuffers GetProcessHeap SetEndOfFile SetStdHandle InitializeCriticalSectionAndSpinCount GetLocaleInfoW GetConsoleMode GetConsoleCP GetTimeZoneInformation SetEnvironmentVariableA GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID SetFilePointer GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA SetHandleCount GetCurrentDirectoryA GetFileType PeekNamedPipe GetFileInformationByHandle GetFullPathNameA HeapDestroy HeapCreate HeapReAlloc IsValidCodePage GetOEMCP GetACP VirtualFree VirtualAlloc InterlockedIncrement InterlockedDecrement InterlockedExchange GetLocaleInfoA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA GetCommandLineA RaiseException RtlUnwind GetCPInfo LCMapStringA LCMapStringW CompareStringA CompareStringW GetStringTypeW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetStdHandle HeapSize ExitProcess

user32

GetWindowThreadProcessId FindWindowA

advapi32

OpenProcessToken LookupPrivilegeValueA RegQueryValueExA RegEnumValueA RegDeleteKeyA RegCloseKey RegDeleteValueA RegOpenKeyExA AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize CoCreateGuid CoUninitialize

urlmon

URLDownloadToFileA

psapi

GetModuleInformation GetModuleFileNameExA

shlwapi

PathAppendA PathRemoveFileSpecA PathRemoveFileSpecW PathAddBackslashA StrStrIA PathAppendW

netapi32

NetWkstaTransportEnum NetApiBufferFree Netbios

wininet

InternetSetStatusCallback HttpQueryInfoA InternetOpenUrlA InternetOpenA InternetGetConnectedState InternetCloseHandle InternetReadFileExA

Name

.text

Size

299KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tvm0

Size

97KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

TCLSCOPY/TenProtect/TP/TPHelper.Installer.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 6db8e3776e594dbbffbac641b6cb0cb8cbd256ffeef890f8d41165832d06f21e
MD5 1e58366794fd45f46e7045c24b8a9057
SHA1 596ec948e37a1194de0294b3bcb66f597454dc31
SHA512 2d2acc2492796e8ff8c2595aff9e5f23e50f3834d1615ca9ebc09d69f0d74b966c82ac90c339077d4161cf05b848ede1d70066b85e9c98434eb815c3414838f1
SSDEEP 196608:0Dy14Aze/q47XS3WFnxNUivZ67VZyfgf/ZuiEMUSinQtp:0O14A74NOivZ6+fgbEUinQD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

3c:2e:d9:9f:28:dc:52:65:21:cb:c4:02:6b:0c:c9:6f:ea:bf:a0:65:6d:4e:bb:4b:2a:ef:8b:75:87:cb:df:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jun 30, 2017

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

81:2a:56:eb:d5:7d:ad:85:d3:ee:49:2b:9f:f4:44:e7:03:3e:92:be

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jun 30, 2017

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 4, 2016 - Mar 28, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2016 - Mar 28, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH a49b0342971aa199fc6349725b90146d
SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
MD5 faa7f034b38e729a983965c04cc70fc1
SHA1 df8bda55b498976ea47d25d8a77539b049dab55e
SHA512 7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf
SSDEEP 48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsUnzip.dll

IMPHASH f61b492d16b51856da71c9a124fee190
SHA256 4e4e429ecf1c49119a21c817899f64152b03b41b036fc1d92aee335043364c43
MD5 77a26c23948070dc012bba65e7f390aa
SHA1 7e112775770f9b3b24e2a238b5f7c66f8802e5d8
SHA512 2e7ffa4ed5c97f555e1b0d6f55ffcfd53cd28302fc77d95fdaea89e0b6b42e67e366331e52358e78e8266d079cc2ca3ea4c909197fb38a5b4c8151c7678d0065
SSDEEP 3072:3imoHcJg67rm+2X7jiYwJAmcxaw2VvnCNizd9XER4I6CAZJPtAY3:3I8Jlrm7SnjCNizdhER4I3kP3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

73267

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess InitializeCriticalSection ReleaseMutex WaitForSingleObject InterlockedExchange CreateMutexA GetDriveTypeA GetVolumeInformationA LeaveCriticalSection EnterCriticalSection lstrlenA FindFirstFileA FindNextFileA FindClose GetVersion LocalFileTimeToFileTime SystemTimeToFileTime GetLocalTime FileTimeToSystemTime FileTimeToLocalFileTime SetEndOfFile SetFilePointer CreateFileA GetFullPathNameA GetLocaleInfoA DosDateTimeToFileTime SetFileAttributesA GetFileAttributesA GetFileTime SetVolumeLabelA GetCurrentDirectoryA DeleteFileA CreateDirectoryA SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoW HeapSize LoadLibraryA ReadFile GetCurrentProcessId GetTickCount QueryPerformanceCounter GetLastError GetProcessHeap HeapAlloc HeapFree CloseHandle GlobalUnlock GlobalLock lstrcpyA lstrcmpA lstrcmpiA GlobalFree GlobalAlloc lstrcpynA SetFileTime GetSystemTimeAsFileTime SetStdHandle GetFileType HeapReAlloc MultiByteToWideChar GetCurrentThreadId GetCommandLineA GetVersionExA RtlUnwind SetHandleCount GetStdHandle GetStartupInfoA DeleteCriticalSection ExitProcess GetProcAddress GetModuleHandleA TerminateProcess GetCPInfo TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue GetUserDefaultLCID EnumSystemLocalesA IsValidLocale IsValidCodePage GetStringTypeA GetStringTypeW HeapDestroy HeapCreate VirtualFree VirtualAlloc LCMapStringA WideCharToMultiByte LCMapStringW GetTimeZoneInformation GetACP GetOEMCP WriteFile FlushFileBuffers GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW UnhandledExceptionFilter VirtualProtect GetSystemInfo VirtualQuery SetEnvironmentVariableW

user32

OemToCharA CharToOemA wsprintfA DialogBoxParamA GetDlgItem SetWindowTextA SetDlgItemTextA SendMessageA EnableWindow GetWindowTextLengthA GetWindowTextA EndDialog CharUpperA

advapi32

GetSecurityDescriptorControl OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges GetKernelObjectSecurity SetKernelObjectSecurity IsValidSecurityDescriptor GetSecurityDescriptorDacl IsValidAcl GetSecurityDescriptorSacl GetSecurityDescriptorOwner IsValidSid GetSecurityDescriptorGroup

BugTrace.ini

SHA256 12ce9f1f7c9f9f5412c0fde12e5d9908dfbe5d2f13e6bb67f5261a195bfa002a
MD5 bf04d44f0c296e37d4b36137fdad5cb9
SHA1 9b9ba75a120e7689fa399f4a4008f816846abf98
SHA512 a262ac5398be4d2610487512ffd3f79520f3fd86e117aa2586ddac969bf76c9281d1dfaf809dc5f423f5a089fdc9e615686cd804b63043dd6819c34de948ac3f
MD5 SHA1 SHA512

NSIS installer

installer

Res.vfs

SHA256 ec116c676c06144e99aad067ece968f8a77305a323e20d6ca510352b25793473
MD5 0239539f24786c744ae2387cbba83fa1
SHA1 4049807efb78e5367b98eccde367edd5f50c55c2
SHA512 ff32880233b404f345cd968c85ddff00defa100bbf756b4f74b2c5df12ccdfa7cdf62ca6989e6db19da0280388dcba8ce8d9c8580ecc8ae0f404493c7d128ff1
SSDEEP 24576:3eu8TZeuulMzfWTJpJIKao1V1UzmMscJ4sGSJGjRoWphdr4XzJd1En:3ehZeblufmXMYkzNSsGSEjRb/lq5c
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

TPHelper.exe

IMPHASH 1ddb4199de7fe2b240b36deb9b7f65c0
SHA256 81c5b055bece2b600dd68bd830e38feafa29be63b3dc1c76551267d949166cfd
MD5 a300794c743e95898ff903223db6e01f
SHA1 17e82069e276eba775f764b6fca249abd952db51
SHA512 681deaf978918e6d97129ff1d7939b9bfc35d491d332c34fc77f43a2e0b40b5bf9d3e013430137720237120959f0d56d7be60b77c2ccf2f1178ddc07a8a3b53e
SSDEEP 24576:0rdK8AU6l8SKcExMqLL+6h6CxTcY8oZZ+ujYZqt5gG+a:0By1KwW2YRY5KZ+a
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

31:6a:9b:dc:4e:45:d1:c1:be:3c:68:27:62:b2:92:1f:a4:a4:8c:af:73:8d:2d:a7:6d:2f:e4:20:d2:bd:c0:c0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jun 30, 2017

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

f2:16:be:ad:81:a0:a3:a2:d2:11:2b:b5:7f:f8:54:ff:80:00:ef:28

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jun 30, 2017

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 4, 2016 - Mar 28, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2016 - Mar 28, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

5

Entry point

2682041

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\.jenkins\workspace\tphelper-trunk\Release\TPHelper.pdb

Name

.tp3

Size

507KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tp3

Size

452KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tp3

Size

82KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tp3

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tp3

Size

654KB

Virtual Size

653KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tvm0

Size

119KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tp3

Size

23KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

TPHelperBase.dll

IMPHASH 87bed5a7cba00c7e1f4015f1bdae2183
SHA256 834b6f2523c339bb4802ccb44a03cd389981a8d563637fe40427f26ed8dd785a
MD5 dc6b801a2c9fb7887afa7a01977b4ab8
SHA1 3e88ab216730d38c582472026364a6e5209989d4
SHA512 04030c85f93effe24f4577377b3131455e3a04d72f77cfede6e0fbabe9d04fcd3dbc4feba77eba1f8211edf6d7d3dcb9a16f10930d5bbf84d2b82fe199299e94
SSDEEP 196608:UHglfhh50TyRV/ky8oUyVcFwKsLpv9i+WlS:UH6QTyRV/kLo3GFiVWlS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

ac:23:d7:6a:ea:ca:26:00:cd:35:22:e1:dc:04:ea:21:c9:b2:7c:06:b9:44:1c:1f:5c:89:9c:fa:57:93:46:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jun 30, 2017

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

2e:7d:f1:23:59:2e:b5:23:93:89:cd:2f:57:b0:0c:f1:4d:3b:3e:9c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jun 30, 2017

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 4, 2016 - Mar 28, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2016 - Mar 28, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\.jenkins\workspace\tenprotect3-trunk-alternative\output\Release\TP3Shell.pdb

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

179KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

822KB

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata2

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc2

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1001KB

Virtual Size

1004KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tvm0

Size

9.6MB

Virtual Size

9.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

115KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

TPWeb.exe

IMPHASH 0a8195987a141de7f818320ba072fc11
SHA256 b0d8b44c718a1bd5ad76f908267e6719182029ac133e013d4e2bfa9649fa3a85
MD5 7ababcbe2cdfd5cb2125cb4d65e240e2
SHA1 9c5a97f82aca40fec2216467306bd480792704ab
SHA512 95ad8549b1e8ec90a30b06f0ceac02ab55625d380ff5ec94561fd70904b310c1c14f210f1fd9c37915135671f0c5ce3924a56972ec613f7f0e61d02bb4a63ea4
SSDEEP 12288:OBWvpy+dHHlFmmM38L29wm+qa4kfmBRMFJ1tY5rC6L2wOUPNU/biqTBxcpamfnZs:OBKM38S97oIRSECxTcFZiz
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

ad:4e:75:8e:aa:e0:df:31:a8:ef:73:68:9e:2c:c4:d2:ff:27:29:ca:a4:39:9d:0b:2a:10:d5:73:23:71:0e:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jun 30, 2017

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

ed:99:2c:fd:22:1e:d8:21:4f:db:8b:05:92:0b:c3:d7:64:d5:37:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jun 30, 2017

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 4, 2016 - Mar 28, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2016 - Mar 28, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

5

Entry point

210735

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\.jenkins\workspace\tphelper-trunk\Release\TPWeb.pdb

libcef

cef_string_multimap_alloc cef_string_multimap_free cef_string_list_copy cef_string_utf16_cmp cef_string_utf8_to_utf16 cef_string_utf16_set cef_string_utf8_clear cef_string_utf16_to_utf8 cef_string_list_free cef_string_list_alloc cef_browser_host_create_browser cef_string_userfree_utf16_free cef_quit_message_loop cef_currently_on cef_execute_process cef_api_hash cef_post_task cef_string_utf16_clear cef_process_message_create cef_v8value_create_bool cef_v8value_create_int cef_v8value_create_string cef_v8value_create_function cef_v8context_get_current_context cef_string_list_append cef_string_map_append cef_string_multimap_append cef_string_map_value cef_string_map_key cef_string_map_size cef_string_multimap_value cef_string_multimap_key cef_string_multimap_size cef_string_list_value cef_string_list_size cef_string_map_free cef_string_map_alloc

kernel32

TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW HeapFree HeapAlloc RtlUnwind RaiseException HeapReAlloc HeapSize Sleep ExitProcess GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime VirtualAlloc InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA InterlockedExchange GetModuleHandleA GetCurrentProcess FlushFileBuffers SetFilePointer WriteFile GlobalFlags GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom LoadLibraryW LoadLibraryA lstrcmpW GetVersionExA lstrlenA lstrcmpA InterlockedIncrement GetCurrentThreadId CloseHandle lstrlenW GetCurrentProcessId FreeLibrary FindResourceW LoadResource LockResource SizeofResource InterlockedDecrement GetModuleFileNameW GetModuleHandleW GetProcAddress TlsFree GlobalFree LocalReAlloc TlsSetValue TlsAlloc GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock TlsGetValue LocalAlloc SetLastError MultiByteToWideChar WideCharToMultiByte LocalFree FormatMessageW GetLastError DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetEnvironmentStringsW

user32

PostQuitMessage GrayStringW DrawTextExW DrawTextW TabbedTextOutW DestroyMenu ClientToScreen SetWindowTextW RegisterWindowMessageW LoadIconW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect PtInRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem RemovePropW GetWindowTextW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx DispatchMessageW GetKeyState PeekMessageW ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx GetSystemMetrics ShowWindow

gdi32

DeleteDC RectVisible GetStockObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape CreateBitmap GetDeviceCaps PtVisible SetMapMode RestoreDC SaveDC ExtTextOutW DeleteObject SetBkColor SetTextColor GetClipBox TextOutW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

shell32

ShellExecuteW

oleaut32

VariantClear VariantChangeType VariantInit

oleacc

LresultFromObject CreateStdAccessibleObject

Tenio.ini

SHA256 faac4bee09c352eafbbe4f2f91c75be6f3d19e6ebe046495b64a5c1cb696df14
MD5 aa9a9394c19edf1311d27fc03251ea67
SHA1 a9c024285ed884cc371d7266f1e3729cd4ebcf88
SHA512 78c4fa80698b7e25ebfc9f1d61c0fd13a02359b60c26ae36a0a44995dd0b161422855578210fa0322a9182c70b1cd472c55bbb601b1ad05ee53ecf88a30d3efd
MD5 SHA1 SHA512

NSIS installer

installer

config.dat

SHA256 7e03615497daeee808fd1fba070ea1b545751957157c28fd2aa194ce34d7f3a8
MD5 f27963323432c0f01e4bcadc7848a423
SHA1 86f59bb2a5847160577b0db6ee162478537b109a
SHA512 03cc6038da31d1fa7d1d922744788e4c26cf52086d48c6ef699b3150f300d55ef9f0ec69963ac435d364b97a38ca866516fcf291dffc3ea67b0d2767c338985f
MD5 SHA1 SHA512

NSIS installer

installer

config/cursor.xml

SHA256 d94720ffdd3d8e903d7a2cd17e9d302bb60ecbc10e2e5abd977bf28e1dc9f193
MD5 c9aa2a8da913e6efdb832bd477f6f203
SHA1 9248c624dd6b1756466e8c0bbe8c9574943a6be5
SHA512 a6a09968122db4422f36cdf0c4f787d4ae3218da5a1dc865ccf8a8bda171d6ccf6709fbdcfdc82d62e5252a6772f9d40b8463c3d1515a133dd98b7eccb9577d2
MD5 SHA1 SHA512

NSIS installer

installer

config/name2id.xml

SHA256 78c842946389e0f47cc63b66d72c8102b456a59669686bd8e2849c0ca3e375b5
MD5 d283506bb25237069e3c025dd9f8a65d
SHA1 1877b5b5160564aebd07f279a5d6e80aa3d84794
SHA512 b1109c03606c43c516684b5cea21ca8988f0d8c74e02f98d6da8652fd197ce528dc7d4bd2a1b8a6a9890a5317c51b08e52b604efebf033171a399aa5f5281013
MD5 SHA1 SHA512

NSIS installer

installer

config/uiconfig.xml

SHA256 8f215103f654608f9dd12ed2c04c2fed97be0bbbe659c0d38a59b4eb7f8a77b8
MD5 6b0160e78a05f043d2848216e85339e6
SHA1 8ed84df92b8f2ae2442b760cbdf38824cb16d76d
SHA512 371b32f6688b358f367892e6948e5e158172c41e4b66e9afd12ccd48ff4b3290244d912dc0c9831b15737f20d6788681ac3360c71f50336fcafcacb10d79a3d6
MD5 SHA1 SHA512

NSIS installer

installer

TCLSCOPY/TenProtect/TP/TPHelper.a.dat

SHA256 4a040dece7d78b1f62589afab913942ae49d1d535968242d78c29217e15397cb
MD5 377aa20284400dd68dbfb3a10254e26c
SHA1 cb596084bca7474679f39e305a77e8285022d81a
SHA512 e9b8396fba4bd29c3658dec91b141c9161288236877b08d22044bf487f7e280b003a15c0c33bd5d167b9a24fcd356493bc3429ae93d77e9bd8910e10985665de
SSDEEP 49152:7jfOaEAY3lAqETzE15TJzfu8S/s6UuqVss91vPTyouwwrL:7jfOaEA+lAqlHCbUduLsjHmouwM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

BugTrace.dll

IMPHASH b1e558cf7f9d998ad1ccc516edf07da7
SHA256 395bddd46457f0a7dc0d9ff0969dc6d5a85a3d97bf17c79acecc61b3f9ec0ca9
MD5 78e380a399e72fd196f4a5729d0fc08b
SHA1 03fa0f0c27b342184c64ca2ba18e52b369248d64
SHA512 4bf3dc9eb71ab3cdae0fe522768f2ac6a61db1566a9967d3aa7a5c602bc762fbeccc9040a5ba0a9990328db13c9e202020c2457b08be210117d2de3a7ff4f106
SSDEEP 24576:ptxxS2nDFt5FW/MJy/Kvpzk4yN++uM3fgQAfz3vfP/G:1XO/UtBzk4yN5nPgQAfz3vfP/G
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

07:5b:24:cc:88:5e:45:4f:95:b9:1b:9d:65:37:a7:a7:6d:01:88:1e:50:dd:46:9e:ef:14:9a:ed:f7:2b:ed:31

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

May 24, 2017

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

b4:c0:49:13:7e:ba:03:de:6c:e3:85:74:9d:ef:04:e8:4d:e0:3c:7c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

May 24, 2017

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 4, 2016 - Mar 28, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2016 - Mar 28, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

0

Major OS version

5

Entry point

382280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\.jenkins\workspace\BugTraceEx-1.1.0.x\output\vc9\Release\BugTrace.pdb

ws2_32

gethostname listen accept recvfrom sendto getaddrinfo freeaddrinfo getpeername ntohs getsockname WSAIoctl __WSAFDIsSet WSASetLastError WSACleanup ntohl htons getsockopt send gethostbyname closesocket socket htonl bind recv setsockopt WSAGetLastError select inet_addr WSAStartup connect ioctlsocket

kernel32

WriteFile WideCharToMultiByte ReadFile MultiByteToWideChar GetLastError IsBadReadPtr Process32First VirtualFree GetFileAttributesA VirtualAlloc Process32Next LocalAlloc GetModuleFileNameA CreateToolhelp32Snapshot LocalFree GetModuleHandleA GetCurrentProcess GetProcAddress InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetSystemDirectoryA SetLastError InterlockedDecrement SetUnhandledExceptionFilter InterlockedExchange DisableThreadLibraryCalls LoadLibraryA CreateThread Sleep AddVectoredExceptionHandler WriteProcessMemory VirtualQuery GetTickCount GetCurrentThread GetPrivateProfileIntA ReadProcessMemory InterlockedExchangeAdd GetCurrentThreadId ExpandEnvironmentStringsA CreateDirectoryA GetPrivateProfileStringA DeleteFileA OpenProcess Module32First Module32Next GetCurrentProcessId FindFirstFileA FindClose FindNextFileA GetVersionExA FreeLibrary VirtualProtect FlushFileBuffers FindVolumeClose GetModuleHandleW GetWindowsDirectoryA FindNextVolumeW SetFilePointer GetModuleFileNameW Process32FirstW QueryDosDeviceW Module32FirstW Process32NextW GetPrivateProfileSectionA Module32NextW FindFirstVolumeW ExitProcess GetProcessHeap GetCurrentDirectoryA FileTimeToLocalFileTime GetConsoleMode InterlockedIncrement CreateFileA CloseHandle ReleaseMutex OutputDebugStringA CreateMutexA WaitForSingleObject GetConsoleOutputCP WriteConsoleW SetEndOfFile CompareStringA CompareStringW SetEnvironmentVariableA GetTimeZoneInformation GetFullPathNameA SleepEx WriteConsoleA SetStdHandle GetLocaleInfoA SetHandleCount GetStartupInfoA IsValidCodePage GetOEMCP FreeEnvironmentStringsA VerifyVersionInfoA FormatMessageA PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle HeapFree HeapAlloc TerminateProcess UnhandledExceptionFilter IsDebuggerPresent HeapReAlloc ExitThread GetSystemTimeAsFileTime FileTimeToSystemTime GetDriveTypeA GetCommandLineA RaiseException GetCPInfo GetStringTypeW GetStringTypeA GetVolumePathNamesForVolumeNameW GetFileSize LCMapStringA LCMapStringW GetFileInformationByHandle HeapCreate HeapDestroy TlsGetValue TlsAlloc TlsSetValue TlsFree HeapSize InitializeCriticalSectionAndSpinCount GetACP GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetConsoleCP

user32

wsprintfA

advapi32

RegCreateKeyExA CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextA CryptGenRandom CryptReleaseContext AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegQueryValueExA RegSetValueExA RegCloseKey

oleaut32

VariantClear

iphlpapi

GetAdaptersInfo

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

psapi

GetModuleInformation GetModuleBaseNameA GetModuleFileNameExA EnumProcessModules

dbghelp

MiniDumpWriteDump StackWalk SymGetModuleBase SymFunctionTableAccess

shlwapi

UrlEscapeA

ntdll

VerSetConditionMask RtlUnwind

wldap32

ord22 ord211 ord143 ord60 ord50 ord26 ord30 ord200 ord32 ord35 ord79 ord33 ord301 ord27 ord41 ord46

crypt32

CertFreeCertificateContext

Tenio/June.dll

IMPHASH 0cdb79df4d5662f8f47350cdbc82b3db
SHA256 79987a7c9ee35d6d06a493ffc25b57e68faf813fcbf85dab37f5a793df5ce149
MD5 5eb113f738e9c38dfafb24264c79b9e8
SHA1 eb7328370f436f6962281dc627b487384ce0364a
SHA512 63596d2457be2ce81e89a1fd94d81d290a68f2cdf87904f567691dcd96b7d7e45b4b32a39857d4ec1e851182cadab71804538fdd356b16e9fde85e5711d1b95c
SSDEEP 24576:xka69uMlhRpJT0wbl4lFVunw0ToZIcj8TBi+:B83JoFVAToZCT5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

401185

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\TPF_SRC\TPFSrc(2014-2-25)(V1.2.19.59)\Dependence\June\output_VC8\releaseU_mt\pdb\June.pdb

user32

PtInRect DrawTextW OffsetRect EqualRect FrameRect EndPaint BeginPaint IsWindow GetClientRect GetDC ReleaseDC IntersectRect IsRectEmpty CopyRect

msimg32

AlphaBlend

kernel32

InterlockedDecrement Sleep InterlockedExchange GetACP InterlockedIncrement GetThreadLocale GetVersionExA CreateFileW CloseHandle GetFileSize FindResourceW LoadResource LockResource ReadFile GetTickCount GetFileAttributesW lstrlenW WideCharToMultiByte SetFilePointer GetLastError WriteFile GetLocalTime GetCurrentThreadId DebugBreak GetCurrentProcessId LoadLibraryW DeleteCriticalSection GetPrivateProfileStringW GetProcAddress GetModuleHandleW GetModuleFileNameW OutputDebugStringW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetStdHandle FlushFileBuffers CreateFileA WriteConsoleA GetConsoleOutputCP lstrlenA WriteConsoleW SetEndOfFile CompareStringA CompareStringW SetEnvironmentVariableA GetLocaleInfoA GetLocaleInfoW LoadLibraryA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind GetSystemTimeAsFileTime HeapFree GetCommandLineA HeapAlloc GetProcessHeap HeapReAlloc LCMapStringA MultiByteToWideChar LCMapStringW GetCPInfo GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize ExitProcess GetStdHandle GetModuleFileNameA GetTimeZoneInformation SetHandleCount GetFileType GetStartupInfoA GetOEMCP IsValidCodePage HeapDestroy HeapCreate VirtualFree VirtualAlloc FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode

gdi32

GetBkColor GetBkMode CreateRectRgnIndirect ExtSelectClipRgn GetObjectW RealizePalette GetDIBits SetStretchBltMode StretchDIBits SetDIBitsToDevice MoveToEx LineTo CreateRectRgn SelectClipRgn ExtCreatePen CreateSolidBrush SetTextAlign GetTextColor SetBkColor ExtTextOutW CreateFontIndirectW GetCharWidth32W GetTextMetricsW GetTextExtentPointW SetTextColor SetBkMode TextOutW BitBlt CreateDIBSection SaveDC RestoreDC CreateBitmap StretchBlt DeleteObject GetClipBox CreateCompatibleBitmap ExcludeClipRect DeleteDC CreateCompatibleDC SelectObject

Tenio/TenFact.dll

IMPHASH fa0277239d83fd4b08a6b403f8e80a9d
SHA256 8c414267ba0484cc98876382750d5cb2db7e545f3865980473647a47d3fb20d3
MD5 9da3d6e8d5834691c56201d6d5c81c63
SHA1 9f2b10d3a0cfcd2adb0ab7800d7265e243591168
SHA512 e54970566b673250f7bfa1ea178a5f57142611c19083400450500282ad5ea6da5f2a7728ac345835e8a33526152210b652c52c8e212b662341b3f0251641bb24
SSDEEP 3072:sRDGSY0eOGtp8DxiQG9rrp9Ag2MERLQyz5HXjkLipcySP9SStpZYK9:QcHpCiQGtmECHXjNaj/9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

103588

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\TPF_proj\trunk\Dependence\TenioBase\output_VC8\ReleaseU\pdb\TenFact.pdb

user32

SetTimer KillTimer

kernel32

HeapSize CompareStringW CompareStringA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection OutputDebugStringW GetModuleFileNameW GetModuleHandleW GetProcAddress GetPrivateProfileStringW DeleteCriticalSection LoadLibraryW CloseHandle ReadFile GetFileSize CreateFileW GetLastError FreeLibrary CompareFileTime FindClose FindNextFileW FindFirstFileW CreateDirectoryW WriteFile DebugBreak DeleteFileW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind GetSystemTimeAsFileTime GetFileAttributesW GetCurrentThreadId GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetCurrentThread Sleep SetEnvironmentVariableA ExitProcess GetCPInfo GetACP GetOEMCP MultiByteToWideChar LCMapStringA WideCharToMultiByte LCMapStringW GetTimeZoneInformation GetStdHandle GetModuleFileNameA GetTimeFormatA GetDateFormatA SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId FatalAppExitA VirtualAlloc HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode SetConsoleCtrlHandler InterlockedExchange LoadLibraryA GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage GetLocaleInfoW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers

Tenio/TenTPF.dll

IMPHASH bc6b947e41095431abaff24a2340a0da
SHA256 bfd36485a41927349088f1ef5ada27773c85082b67b699edbe5e0dd250ff2165
MD5 16bd9e06664df31a92e1aeb2e702fdb9
SHA1 c0e60041eedc64489a9a8c57e52e95bfb3e4eb72
SHA512 44caebec7d280449b51631298c7c2a490580d80cc518b55d3ae83edd8b34d5dd31e8b5f42e959b6a0cc210b72852cdf0944e1a6dbbbfc468f9eb2d6f8152ec39
SSDEEP 24576:u86yd0veWffuRsBNwsw2KTD9+9hZY29KLEnbXS6EglF0XMXoLVjumFhwehcM:3x+2RsnihThyb7ygr0cYLVjumFhrx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1601883

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\TPF_SRC\TPFSrc(2014-2-25)(V1.2.19.59)\output_VC8\releaseU_mt\pdb\TenTPF.pdb

comctl32

ImageList_Add ImageList_Create _TrackMouseEvent ImageList_Remove

user32

CreateWindowExW RegisterWindowMessageW OffsetRect IntersectRect CopyRect PtInRect CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard IsRectEmpty GetCapture CharNextW GetSysColor InvalidateRgn IsChild GetDlgItem GetClassNameW FillRect GetDesktopWindow DestroyAcceleratorTable GetClassInfoExW RegisterClassExW CreateAcceleratorTableW GetWindowTextW IsWindowEnabled GetClassInfoW RegisterClassW SetWindowRgn SetWindowTextW UnregisterClassW UnregisterClassA EqualRect UnionRect GetKeyState SetTimer BringWindowToTop KillTimer SetParent GetDC ReleaseDC GetWindowRgn GetWindowTextLengthW SetCapture EndPaint BeginPaint ShowCursor WindowFromPoint GetWindowRect DestroyIcon LoadCursorFromFileW IsWindowVisible RedrawWindow ReleaseCapture SetWindowLongW DestroyWindow SetFocus GetWindowLongW CallWindowProcW MoveWindow GetCursorPos InvalidateRect LoadImageW DefWindowProcW LoadCursorW GetMessageW TranslateMessage DispatchMessageW MapWindowPoints ShowWindow SetRectEmpty GetSystemMetrics IsIconic PostMessageW GetFocus SetWindowPos SystemParametersInfoW GetParent GetWindowPlacement GetWindow GetClipCursor GetClientRect ClientToScreen ClipCursor GetSystemMenu EnableMenuItem EnableWindow InflateRect SetCursor SendMessageW ScreenToClient IsWindow

gdi32

SelectObject CreateRectRgn CombineRgn OffsetRgn DeleteObject CreateCompatibleDC GdiFlush GetRgnBox GetDeviceCaps CreateCompatibleBitmap BitBlt CreateSolidBrush GetObjectW GetStockObject DeleteDC

shell32

ShellExecuteW

kernel32

SetHandleCount GetTimeZoneInformation ExitProcess HeapSize IsValidCodePage GetOEMCP GetModuleFileNameA GetStdHandle TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA GetCPInfo LCMapStringW LCMapStringA GetCommandLineA HeapReAlloc GetFileType FreeEnvironmentStringsA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapAlloc GetProcessHeap HeapFree GetVersionExA GetThreadLocale GetLocaleInfoA GetACP Sleep InterlockedExchange InterlockedCompareExchange GetStartupInfoA HeapDestroy HeapCreate GetSystemTimeAsFileTime GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA GetFileAttributesW OpenFileMappingW MapViewOfFile UnmapViewOfFile LoadLibraryExW FindResourceW IsValidLocale GetLocaleInfoW GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile CompareStringA CompareStringW SetEnvironmentVariableA RtlUnwind LoadResource SizeofResource GetCurrentProcessId OutputDebugStringW GetProcAddress GetModuleHandleW DebugBreak GlobalUnlock GlobalSize GlobalLock GlobalAlloc MultiByteToWideChar lstrlenA GetCurrentThreadId GetLocalTime EnterCriticalSection LeaveCriticalSection WriteFile GetLastError SetFilePointer IsDBCSLeadByte WideCharToMultiByte lstrlenW GetTickCount GetSystemTime GetModuleFileNameW WinExec DeleteCriticalSection InitializeCriticalSection GetPrivateProfileStringW LoadLibraryW CloseHandle ReadFile CreateFileW DeleteFileW RaiseException InterlockedIncrement InterlockedDecrement lstrcmpiW FlushInstructionCache GetCurrentProcess lstrcmpW MulDiv SetLastError FreeLibrary

advapi32

RegQueryValueW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCreateKeyExW RegCloseKey

ole32

CoCreateInstance CoTaskMemAlloc OleUninitialize OleInitialize CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID CoGetClassObject OleLockRunning StringFromGUID2 CoTaskMemFree CoTaskMemRealloc

oleaut32

SysStringLen VariantClear LoadTypeLi LoadRegTypeLi OleCreateFontIndirect VarUI4FromStr DispCallFunc SysAllocStringLen VariantChangeType VariantInit SysStringByteLen SysAllocStringByteLen SysAllocString VariantCopy SysFreeString

imm32

ImmAssociateContext ImmSetCompositionWindow ImmGetContext ImmReleaseContext

ws2_32

ntohl htonl

Tenio/VFS.dll

IMPHASH c3ce31edc42e6cfed8c80472fd2d52a3
SHA256 7a069cd4ff2fa3fef859b9e264f93443e72218987366bafffff61a50474531af
MD5 b4f83409c8d6f1536afed7fa8e59b7ac
SHA1 1be76500664a5e290de96c51457d1767c914837a
SHA512 f5a0d78dc6e794b9672e784e9557ac34fb123ddbd7efd56cb0fcc59945df476b89519822ce281a5b595e157eae50d94d5bfbcc3804ee45704a5b23a0650b71cf
SSDEEP 12288:yqdcvNzw2kkgL73Q152gPVkBAgvROJTl52GNt/Mai2lKT51QyKgt:yq0NzL2amAgOJTllyai2MT51QyKg
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

256213

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\svn\VFS2_proj\trunk\bin\ReleaseU\VFS.pdb

kernel32

WaitForSingleObject GetLastError CloseHandle CreateThread SetFilePointer SetEndOfFile WriteFile GetFileAttributesW ReadFile CreateFileW FlushFileBuffers SetLastError SetFileAttributesW OutputDebugStringW GetPrivateProfileIntW WideCharToMultiByte MultiByteToWideChar GetTickCount GetModuleFileNameW InitializeCriticalSection DeleteCriticalSection SetEvent ResetEvent CreateEventW LeaveCriticalSection EnterCriticalSection FindFirstFileW FindClose FindNextFileW VirtualFree VirtualAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree HeapAlloc CreateDirectoryW GetFullPathNameW FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW GetSystemTimeAsFileTime DeleteFileW MoveFileW RemoveDirectoryW GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind GetStdHandle GetModuleFileNameA GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement HeapCreate HeapDestroy HeapReAlloc Sleep ExitProcess HeapSize GetCurrentDirectoryA GetDriveTypeA GetFileInformationByHandle PeekNamedPipe GetFileType GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetStartupInfoA GetConsoleCP GetConsoleMode FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId LoadLibraryA GetLocaleInfoA InitializeCriticalSectionAndSpinCount SetStdHandle GetProcessHeap GetTimeZoneInformation LCMapStringW LCMapStringA GetStringTypeA GetStringTypeW CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA SleepEx GetModuleHandleA

ws2_32

connect WSAGetLastError ioctlsocket socket WSACleanup closesocket htons gethostbyname inet_addr select send recv __WSAFDIsSet WSAStartup

TCLSCOPY/mmog_data.xml

SHA256 c7e2a8e656a0e324a897c4ac37ab75982e8127b6af07d5b71c2b7c2b177628b6
MD5 e1ce6a0410e9dfbce5a55609a70e83da
SHA1 2cbcb736731dd5b2aa88d107d94843c744ae05c1
SHA512 8d9739ea3ee2728bd701b04299c3d776c8051d9e88192f9f5b6693209ba3b1f14fb486b6e145f91911078fe0b805060ef40d59278b6c2589b629070aa6e2a48e
MD5 SHA1 SHA512

NSIS installer

installer

TCLSCOPY/plugins/TPDownLoad.dll

IMPHASH 0a02cabb3d72371e349800b0fa7dc129
SHA256 f6f70a7118f25b2649e7d480ca65833015c1fba9aa6a6394df679bc2423c0bdd
MD5 0169ffaf2e463fd393ef6541b6e9af70
SHA1 ae517531845b694b4f6064dbfff1ff653a30e27f
SHA512 f723ac381616b740884e53031e71593551c9259da866307b52a8d0d5f857efc1518bd0460c773d263316f8e3455a5a72442b2b5dbb270260c632480e5daf10d5
SSDEEP 49152:4SFJNJF+g17d+LrywZFZ1mE7a0HepXlxp8+:f3JV17dJS1mE7r+pVxK+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

4d:a8:b8:99:89:17:d6:1c:ed:c5:74:ab:b1:2b:b5:a4:d2:36:0f:b6:a3:fd:51:ea:84:b3:b0:4e:cc:ca:fe:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jul 11, 2017

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

e0:fe:5a:de:ac:c3:0a:dd:d6:7a:89:6b:4b:d9:d6:b5:4f:1f:33:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jul 11, 2017

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 4, 2016 - Mar 28, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2016 - Mar 28, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

0

Major OS version

5

Entry point

653501

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\.jenkins\workspace\tpdownload-trunk\Output\Release\TPDownLoad.pdb

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

CloseHandle CreateThread GetModuleFileNameW GetModuleHandleW GetTickCount TerminateThread MultiByteToWideChar GetLastError GetProcAddress GetModuleHandleA GetCurrentThreadId InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection OutputDebugStringW OutputDebugStringA MoveFileExW DeleteFileW FreeLibrary LoadLibraryW GetVersionExA GetCurrentProcess GetFullPathNameW GetFullPathNameA HeapReAlloc CreateFileA GetFileSize CreateMutexW HeapCompact SetFilePointer MapViewOfFile UnmapViewOfFile SetEndOfFile HeapAlloc SystemTimeToFileTime QueryPerformanceCounter HeapFree InterlockedCompareExchange UnlockFile LockFile ReleaseMutex GetProcessHeap GetSystemTimeAsFileTime FormatMessageA WriteFile WideCharToMultiByte FormatMessageW GetVersionExW HeapDestroy GetFileAttributesA HeapCreate HeapValidate GetFileAttributesW ReadFile CreateFileW FlushFileBuffers GetTempPathW HeapSize LockFileEx GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW GetCurrentProcessId GetTempPathA LocalFree GetSystemTime AreFileApisANSI DeleteFileA CreateDirectoryW SetFileAttributesW GetModuleFileNameA GetDriveTypeW FileTimeToLocalFileTime FileTimeToSystemTime FindClose CreateMutexA ResetEvent CreateEventA Sleep SetEvent WaitForSingleObject FindFirstFileW GetCurrentDirectoryA UnlockFileEx SetUnhandledExceptionFilter lstrlenW GetPrivateProfileIntW GetPrivateProfileStringW GetLocalTime lstrcpynW IsBadReadPtr TerminateProcess UnhandledExceptionFilter GetDriveTypeA IsDebuggerPresent GetCommandLineA RaiseException RtlUnwind TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement ExitProcess GetStdHandle GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW VirtualFree VirtualAlloc GetTimeZoneInformation SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW InterlockedExchange InitializeCriticalSectionAndSpinCount GetLocaleInfoW GetLocaleInfoA GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA

user32

PeekMessageA TranslateMessage SendMessageTimeoutW IsIconic DispatchMessageA FindWindowA ShowWindow

advapi32

RegOpenKeyW RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteKeyW RegQueryValueExW RegCreateKeyExW

shlwapi

PathRemoveFileSpecA wnsprintfW PathFileExistsW PathCombineW PathAppendA

ws2_32

inet_addr sendto htonl WSAGetLastError closesocket connect htons ioctlsocket setsockopt socket WSAStartup shutdown recv send getsockname WSACleanup __WSAFDIsSet select ntohl inet_ntoa gethostbyname

winmm

timeGetTime

shell32

SHGetSpecialFolderPathW ShellExecuteW

ole32

CoTaskMemFree CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream StringFromCLSID CLSIDFromProgID CoUninitialize CoCreateInstance CoInitializeEx CoFreeLibrary CoLoadLibrary

oleaut32

SysFreeString SysAllocStringByteLen

Name

.text

Size

870KB

Virtual Size

869KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

88KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tvm0

Size

986KB

Virtual Size

988KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

30KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

TCLSCOPY/version.ini

SHA256 342c5e4a70aafcb150e047fcae5b19ee8a7313c645485b033f7c913a619d2407
MD5 ea7e58b88fd72e99889407ca325e6bfe
SHA1 31bd790dd650cf0401f3157e9650d7db106694d0
SHA512 d9b741c237d56da87fde0eb32bf0ae207d1f7dbff9c91bcd4062a60cca5854945f764a4691a6283c0b8a960016357216ff501efce40ccf080d3254be77d0d77f
MD5 SHA1 SHA512

NSIS installer

installer

auto.lst

SHA256 c6add7cc94f48b3edecafa29bcc5d3444464bb4d2898fd6c93ae7e2a4ad08b98
MD5 de287d3650a58c8f10c720e39aadecd4
SHA1 fa44245aae5a055ccea75431226ec48822d7b453
SHA512 0318feb6ace91845976ff06ed384d667a28c37fdc556d7d061ceb1f0695ca2aebcda88093ca6b279d8be7eb05e159dc6eb8c9bc7aa7d55f8a72a1257635e6a43
SSDEEP 12288:d643lghxvjjvl+UnIhywiv0EhwF2iMCcCnq1jh5A4:d6Ggv7jvOo0EmF2fwq1jh5X
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

tcls.lst

SHA256 7a5a1f9371e3c24b571426c837a19d0cd50789afefe59a95b39d9b07ceb8783d
MD5 11460620d5777ac03baa22e5951a7b47
SHA1 287e49b9d2cc2ca44dc41f77de11399b33cf00bf
SHA512 6fc88a713a8f0648dae52df7a450573f085f77757da1744d13792adbcc64b4fcc1a181e7c170d238921807c54bec2c0d68da5f873433453abe78f61e379f1f69
SSDEEP 384:fdaUWF4rKKCHFNBcR+IVogWYbxg5s7eMztDj0sJzr+:1aBUKKCHraVoDMFdr+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

地下城与勇士卸载.exe.nsis

SHA256 fcdd1301d9f5f6020d86bc5f0e2bef531e84e0fa5cd97b66b8b5d199bb2c871f
MD5 912c35775b5d9b5e97b7d58606f1f19f
SHA1 cabb797835e377a25fa162233f7223b17f623dab
SHA512 7209d31b8ab01b8f378724ba925b04439902b3206cf7f9df89a25fdf611e533a1f881f62c75d492530813fe6e5f0f80ce75424b5b6703d0bf2ae1d53507ac309
SSDEEP 6144:kBgOlXNsfHPumO+yhZI6uBFD5OpZBwIff9QGCSwrAZ4VY/i7ku77Q56NQ:kBNufHIxZIPBFD5Ofn9tCJMZ4VY/i75K
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer